Why is password hashing considered so important?

Question

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is this:

Isn't password hashing only important if the system is weak enough to give an intruder access to the password database? If so, then why is such an emphasis put on building secure password databases, instead of secure systems that would prevent unauthorized access to important user information? How is it that hashed password databases are so often stolen?

Answer 1

Experience has taught the community that it's effectively impossible to keep intruders out. It is a question of when, not if, somebody will gain access to a your password database.

Doesn't matter whether you are a random blog or a multi-billion dollar government department, you need to assume that somebody will one day gain access. And quite often, they will have enough access to read the database but not enough access to, for example, insert a man-in-the-middle which grabs plaintext passwords as they're used to authenticate someone.

For example, they might not hack your primary server, they might only hack a server that contains backup copies of your database.

Also, most organisations have many employees. An employee doesn't need to hack your network to view the database, they might already have unfettered access (especially if they're an engineer or sysadmin). There are many reasons why it is a bad idea for your employees to know customer passwords.

Even if your website is completely worthless and it wouldn't matter if somebody hacks into it. The username and password used to log into your website is often exactly the same as the one used to log into other much more important services.

For example, somebody might write a bot that attempts to log into Apple's iTunes store with every username/password in your database, and if successful it starts purchasing things through the store. This attack might be successful for as many as 10% of the users in your database, and many of those users will never even notice they've been billed $4.99. This is not a theoretical attack, it happens all day long every day and attempts to stop it do not always succeed.

EDIT: And in the comments, @emory made another point I forgot: somebody might file a subpoena or use some other legal process to gain access to the database, allowing them to see plaintext passwords unless you have a good hash. Note it's not just law enforcement who can do this, any private lawyer with a strong legal case against you can get access to your database.

Answer 2

If so, then why is such an emphasis put on building secure password databases, instead of secure systems that would prevent unauthorized access to important user information?

Because this is a really difficult thing to do. There is no way to guarantee that your system is 100% hack-proof. In fact, if you make such a claim on Reddit your site will probably be compromised within an hour.

There is a commonly used term in security called Defence-in-depth. A compromised password database does not only affect your application. Most people will use the same username and password combination for multiple websites. This makes it trivial for an attacker that has compromised a single password database to gain access to multiple services that a user uses. This is why you often see recommendations by websites that have been compromised for the user's to change their passwords on all their accounts.

Even if you only consider your application to be important, there are many things an attacker can do if he has the plaintext passwords of your users. It is difficult for an attacker to directly modify database values without detection. However, with a compromised plaintext password, he can simply log into a user account and make the changes. This is very difficult to detect.

Answer 3

Besides the already stated reasons there is another one:

A password is supposed to be private!

Having it in cleartext means that you or any of your fellow colleagues managing or developing have access to all passwords and you could impersonate any user. Now you're probably thinking - we would never do that, that is wrong!

Think of a bank system: the database administrators would all have access to passwords. This means that they could simply login into your account from anywhere and withdraw money. Would you put your money in such a bank knowing this? Even worse... many people use the same password in multiple locations. They could now login into the bank account and, with enough information in many other places.

Remember that many attacks are inside jobs - people with privileged information. Attackers don't come all from outside.

Answer 4

There are a lot of ways a database with passwords can end up in unwanted hands. If the passwords are not securely hashed when this happens, the owner of the website is responsible and in much trouble, because often the users reuse their passwords on other sites as well. I would like to give you some examples of how a database can leak:

• SQL injection is an easy attack against your website. I made a small demo to show how easy it is. Just click on the next-arrow to get malicious input. SQL injection can be dealt with by writing clean code, but often you use third party libraries or haven't developed the source code alone, in which case unsafe code could have slipped through.
• If you are hosting your website with an external provider, at least the staff of the hosting company have free access to the database. Often other people have access as well: maybe you need a developer to fix a certain problem or to extend your page.
• Backups are a problem too. If backups are not stored with the same care as the running server is secured, or if they are thrown away without erasing them properly, the passwords are leaking.
• If a server is discarded, it must be cleaned before disposing it. In the case of external hosting, this is not under your control. Cleaning can be quite difficult on RAID systems.
• More and more data is stored in cloud services. A handy thing, these clouds, but it is also cloudy where your database ends up, and properly cleaning in a cloud may even be impossible.

Answer 5

A principle in security is that there is no single bullet-proof mechanism but rather you should rely on multiple mechanisms to protect your system/data. In other words, defense in depth. So rather deciding between (a) securing the password database or (b) securing the system where it resides or is used, you should do both.

Answer 6

This blog post discusses this question. The summary is that you need password hashing as a second line of defence, when attackers achieve a partial, read-only break. This is a frequent consequence of SQL injection attacks, but also happen when a backup tape is stolen, or when an old disk is discarded. In particular, when a disk fails, the failure can be that of the electronic board, but the magnetic medium still contains all the data. If the disk does not start up, the sysadmin will not be able to (easily) wipe out the contents. But if the disk is simply thrown in a dumpster, an industrious attacker could retrieve it, replace the electronic board, and read all the data.

While it is better to not let attackers peek at your server's entrails in the first place, such breaches do occur in practice, and you'd better have some protection against it. See also this detailed answer for how password hashing should be done; the underlying idea being that in order to verify a user's password, the server MUST contain some password-dependent data, and a complete dump of the server's contents is then enough to "try passwords at home". Thus, password hashing is the best that can be done (theoretically), unless special-purpose tamper-resistant hardware is brought in the picture.

Answer 7

msn above mentioned the need for in-house privacy; I'd add another reason based on this: you cannot completely trust everyone who has physical access to your database. Hashing protects the database against internal compromise as well as against external compromise.

Answer 8

One of the points which I don't think is mentioned in the answers here. I think the main reason for implementing password hashing is not to add an extra layer for attacks from outside, but to simply make them unreadable to those inside the network.
A lot of attacks come from within your trusted network. A pissed off developer or system admin shouldn't be able to read user's unhashed passwords, even if he has access to the database.