How Passwords Get Stolen
Every time you register with a website, the website asks you for a password. However, most people do not realize that just saving the password in a database would not make an application safe.
Applications now apply hashing and salting when a user provides a password during registration.
Why Storing Passwords In Plain Text Is Dangerous
Assume that you created an account with the following password:
text
myPassword123
In case the website saved this password as it was provided by the user, the password would be readable in case the database gets hacked or a backup gets leaked.
It would become even worse since people often use the same password for multiple sites. If the attacker found one password, he/she would be able to log in all of your accounts.
That's why storing passwords in plaintext is a very bad practice.
What Is Hashing?
Hashing is the method of converting a password into a unique string of characters called hash.
For example,
text
Password:
myPassword123
Hash:
9d8a4c0d7aef93d8c73d2c87...
The main feature of a hash is that it is one-way: you can calculate it based on the password but you cannot revert this operation and calculate a password based on the hash.
Why Hashing Alone Isn't Enough?
Hashing is far more secure than saving passwords in plaintext form, but a problem exists here.
In case two different users happen to set their passwords equal, then their hashes will also be the same.
text
Alice
Password: password123
Hash: abc123
Bob
Password: password123
Hash: abc123
An attacker, having access to the database, instantly learns that two users use the same password. Moreover, the attacker may also employ pre-computed hash tables, called rainbow tables, for identifying passwords that were used frequently.
This is where salt is needed.
What Is Salting?
A salt is a randomly generated string that is appended to a password prior to hashing.
Examples:
text
Password:
myPassword123
Salt:
A7k!92@
Hashed Data:
A7k!92@myPassword123
Since everyone is given a unique salt, even passwords that are identical will have a unique hash.
text
User 1: Alice
Password: password123
Salt: A1B2C3
Hash: f82c91...
User 2: Bob
Password: password123
Salt: Z9X8Y7
Hash: 1ae7d4...
Both Alice and Bob use the same password but the hashes will be unique.
Best Practices
When developing applications that will keep user accounts, you should use these recommendations:
- Do not keep passwords in plaintext form.
- Hash all passwords prior to storing them.
- Provide a unique salt for each user.
- Apply up-to-date password hashing techniques, such as Argon2, bcrypt, and PBKDF2.
- Recommend creating unique and complex passwords to users and use multi-factor authentication.
Final Words
Password continues to be one of the most popular mechanisms for securing personal online accounts; however, this is also one of the most attractive objects for hackers.
With the help of hashing, sites will not keep your password at all, and with the help of salting, it will be extremely difficult for the hacker to break into a database of passwords.
