Passwords and Hashing

Why are passwords necessary?

They are used as a method of authentication to verify identity and ensure the connection between the user and computer are legit

What are the factors of authentication?

Using tough to crack passwords

Relying on sending checks to personal devices

Relies on a personal identifier (ex/ thumbprint, face id, etc)

Pros of passwords

It can be stored manually

They are easy to change

Can be shared with a trusted group

Cons of passwords

Easy to forget

Can be easy to figure out

Can be compromised

Pros of stuff you own?

It’s hard to duplicate

Cons of stuff you own

You can lose the device

Pros of biometrics

You can’t forget it

You can’t replicate

Cons of biometrics?

Your body can change

You can’t share it with a group

Can be compromised if you have a twin/doppelganger

Common password attack types

Brute force

Dictionary attacks

Leaked credentials

Malware

Spyware

Phishing

Man-in-the-middle/eavesdropping attacks

What is brute force?

An attack method in which attackers use trial and error to guess passwords

How do you defend against brute force attacks?

• Using random passwords from a large set of passwords

• Using longer passwords

• Not reusing passwords

• Changing passwords at least yearly

What do people do instead of using preventative measures for brute force attacks?

• Reuse passwords

• Use short passwords

• Never change passwords unless they’re forgotten

What are dictionary attacks?

Attacks where hackers get a list of victim credentials and use them to log in

How do you defend against dictionary attacks?

Using leaked information alerts

What are leaked credential attacks?

Attacks where commonly used/known passwords are used from popular services

This is where hackers impersonate people to obtain credentials

What is credential stuffing?

Using stolen credentials on multiple sites to try and compromise information

How do you prevent leaked credentials and credential stuffing?

Cryptographic hash functions

What are the parts of cryptographic hash functions?

• They must be collision resistant

• They must have pre-image resistance

Definition: Collision resistance

Computationally impossible to find 2 inputs that give the same output

Definition: Pre-Image resistance

Given an output (y), it is computationally impossible to find it’s domain (x)

Definition: salted passwords

Using a random string of letters and numbers to represent it before putting it into a hash function

Definition: Offline dictionary attacks

A pre computer hash of a person’s passwords that are compared to leaked hash passwords

What are the defense mechanisms used to prevent password theft?

• Multifactor authentication

• Password managers

• Passkeys