Podcast
Questions and Answers
Why is storing passwords as plain text considered a security risk?
Why is storing passwords as plain text considered a security risk?
- Plain text passwords require more storage space than hashed passwords.
- It is more difficult to recover plain text passwords if they are lost.
- Anyone with access to the storage location can easily read the passwords. (correct)
- Plain text passwords are more susceptible to encryption.
What is the primary purpose of hashing passwords?
What is the primary purpose of hashing passwords?
- To compress the passwords to save storage space.
- To encrypt the passwords for secure transmission over a network.
- To convert the passwords into a fixed-length string that cannot be easily reversed. (correct)
- To make the passwords easier for users to remember.
Which of the following is a critical characteristic of a secure hashing function for passwords?
Which of the following is a critical characteristic of a secure hashing function for passwords?
- Producing different length hashes for different password lengths.
- The ability to quickly reverse the hash to retrieve the original password.
- Resistance to collisions, where different inputs produce the same hash. (correct)
- Easy memorization of generated hashes.
What is a 'collision' in the context of hashing functions?
What is a 'collision' in the context of hashing functions?
Why is the inability to reverse a hashing function a desirable property for password storage?
Why is the inability to reverse a hashing function a desirable property for password storage?
In a scenario where an attacker has obtained a file containing password hashes, what is a 'brute force attack'?
In a scenario where an attacker has obtained a file containing password hashes, what is a 'brute force attack'?
If a brute force attack is conducted online against a login system, what is a likely countermeasure that would prevent the attacker from succeeding?
If a brute force attack is conducted online against a login system, what is a likely countermeasure that would prevent the attacker from succeeding?
Why do attackers often prefer to perform brute force attacks offline after obtaining password hashes?
Why do attackers often prefer to perform brute force attacks offline after obtaining password hashes?
What is a 'dictionary attack' in the context of password cracking?
What is a 'dictionary attack' in the context of password cracking?
Why are dictionary attacks often more efficient than pure brute force attacks?
Why are dictionary attacks often more efficient than pure brute force attacks?
How do attackers commonly enhance dictionary attacks to account for predictable user substitutions (e.g., replacing 'o' with '0')?
How do attackers commonly enhance dictionary attacks to account for predictable user substitutions (e.g., replacing 'o' with '0')?
What is a limitation of dictionary attacks in password cracking?
What is a limitation of dictionary attacks in password cracking?
What type of resource is commonly utilized to accelerate password cracking processes, particularly in distributed cracking methods?
What type of resource is commonly utilized to accelerate password cracking processes, particularly in distributed cracking methods?
Why might an attacker use a specialized dictionary containing medical terms when attempting to crack passwords obtained from a medical facility?
Why might an attacker use a specialized dictionary containing medical terms when attempting to crack passwords obtained from a medical facility?
How does salting improve password security?
How does salting improve password security?
What is the purpose of key stretching?
What is the purpose of key stretching?
Which of the following is an example of a strong password policy?
Which of the following is an example of a strong password policy?
Why is multi-factor authentication (MFA) recommended?
Why is multi-factor authentication (MFA) recommended?
Which of the following is a technique to make it computationally expensive to crack multiple passwords at once?
Which of the following is a technique to make it computationally expensive to crack multiple passwords at once?
What strategy might an attacker employ after discovering that a set of password hashes is utilizing a weak hashing algorithm?
What strategy might an attacker employ after discovering that a set of password hashes is utilizing a weak hashing algorithm?
Flashcards
Plain Text Passwords
Plain Text Passwords
Storing passwords in an unencrypted, readable format.
Password Hash
Password Hash
A cryptographic function that converts an input (password) into a fixed-size string of text (message digest or fingerprint).
Hash Collision
Hash Collision
The undesirable event where two different inputs produce the same hash output.
Brute Force Attack
Brute Force Attack
Signup and view all the flashcards
Dictionary Attack
Dictionary Attack
Signup and view all the flashcards
Offline Brute Force Attack
Offline Brute Force Attack
Signup and view all the flashcards
Distributed Cracking
Distributed Cracking
Signup and view all the flashcards
Password Mutation
Password Mutation
Signup and view all the flashcards
Study Notes
- Passwords often serve as the primary credential to protect access to services.
- Storing passwords in clear text or unencrypted form by a service is rare but insecure.
- With clear text passwords, anyone with access to the file or database can view everyone's credentials.
- If developers won't change, you have to use the app with security concerns or remove it entirely.
Password Hashing
- Never store passwords as plain text.
- Passwords should be stored as a hash, a cryptographic method that creates a fixed-length string of text from an input.
- This fixed-length string is called a message digest or fingerprint.
- Each input into a hashing function produces a unique output.
- The goal is to create a hashing function that makes it very difficult to have the same fingerprint or hash between two different inputs, known as a collision.
- If a hashing function has many collisions, a different hashing function may be considered.
- Once a hash is created, it's impossible to reverse the process and obtain the original message.
Hashing Examples
- Different operating systems and applications may use and store hashes in different ways.
- Linux systems store the username, account number, and password hash on the same line in the password file.
- While you can’t reverse a hash to find the original password, you can perform a brute-force attack to try every possible password trying to find a match.
Brute-Force Attacks
- In a brute force attack, every possible combination of letters, numbers, and special characters is tried until a hash match is found.
- Brute-force attacks can be time-consuming, depending on the hashing algorithm being used.
- Brute force example showed how after trying AAAAA, AAAAB, AAAAC, etc., eventually the word “password” was found to match the hash.
- Performing a brute-force attack online is usually not feasible because of account lockouts after a certain number of failed attempts.
- Hackers will often take a copy of the hash file offline and perform the brute-force attack on their own systems.
- This requires significant CPU resources to go through every possible password combination.
Dictionary Attacks
- Dictionary attacks use a list of words from a dictionary to try and match password hashes.
- Dictionary attacks are faster as the number of words in a dictionary is less than the possible combinations of characters in a brute force attack.
- Attackers often use specialized word lists for dictionary attacks.
- Attackers know that users commonly substitute letters with numbers or symbols, such as changing O to 0 or L to 7, and account for these substitutions during dictionary attacks.
- Even with smaller word lists, dictionary attacks can use a lot of CPU, leading to the use of distributed cracking methods or GPUs to increase processing power.
- Dictionary attacks will not be successful if the password is not in the dictionary.
- Dictionary attacks are effective against passwords that contain common words.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
