When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the database. The user just types 'password123' as password. If someone wants to brute force that account, they can just use a dictionary attack and post to the same login URL with curl. What then is the value of hashing your password at that point?


So what is the value of hashing your password at that point?

The value of hashing and salting passwords is not in brute-force attack "from outside", but when somebody breaks into your application or database (possibly other way) and wants to get users credentials.

If they would be stored without hashing, he can just read them which is not great since many users use the same password for many services. Hashing with md5 will make it only a bit more complicated because of Rainbow tables, but salting gives much more possible values and if attacker wants to get the passwords, he needs to do brute-force attack for every password, even though he knows the salt.

  • I understand that, but how does that protect you from dictionary attack? – user3018765 Oct 25 '15 at 17:23
  • It does not. It protects you against rainbow tables, basically. – Jakuje Oct 25 '15 at 17:24
  • So two factor authentication is the only way to safeguard against dictionary attacks? – user3018765 Oct 25 '15 at 17:27
  • No. Solution can be locking user or rather source of too many requests (because this can be also considered as DOS attack). 2FA mitigates it, by adding another complexity on which you can't use dictionary attack and which changes over time (faster than you can try). – Jakuje Oct 25 '15 at 17:32
  • 1
    Rather than locking you can use increasing delays or other throttling techniques to prevent a lockout while making a dictionary attack take a very long time. – Neil Smithline Oct 25 '15 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.