Good question, and I'm glad you asked it. I want people to find this thread when they Google it so they -- hopefully -- won't make the same mistakes that many other companies make.
You shouldn't just
hash passwords, you should
salt them and make sure your hashing algorithm uses some form of
SlowEquals. You shouldn't stop there: you should use a secure hashing algorithm that greatly resists
collisions, such as bcrypt or scrypt.
Why salt? What are collisions?
I'm going to use md5 as an example because it's very well-known. Do not use it, as it's vulnerable to collisions, and is very fast, which means it's much easier to break. Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time.
For example, "
myDarnPassword" would end up being converted to "
aca6716b8b6e7f0afa47e283053e08d9" when hashed as md5. At this point, you could create a dictionary attack and use rainbow tables. You could even generate a database that converts as many random characters into an easily-searchable database that won't require time-consuming rainbow table lookups. You can slowly create that over time and look up hashes later.
You'd create a table looks like this:
| PASSWORD | UNSALTED_HASH |
| myDarnPassword | aca6716b8b6e7f0afa47e283053e08d9 |
| pleaseDontSueMe11 | 0dd395d0ec612905bed27020fb29f8d3 |
Then you would select from the database somewhat like this:
SELECT [password] FROM [table] WHERE [unsalted_hash] = 'aca6716b8b6e7f0afa47e283053e08d9'
And it would return
myDarnPassword, plus any collisions which occurred.
With enough processing power and time, you could create trillions of combinations, and quite easily crack a large number of passwords in a very short time (I might recommend breaking databases up into password lengths because of the sheer number). You'd need a colossal amount of hard drive space for this, though.
At that point, all you really have to do is look it up without wasting processing power on brute-forcing everything every time. And if you've stolen other people's passwords in the past from a database, you can add those, and convert them to hashes. Many websites have already done this.
When a website validates your password, they will compare the password to the stored hash, and if it matches the hash in the database, it's considered a valid password. You may then allow the user to log in.
Salting the hash can help defeat this attack, but it won't save you vs. collisions. You can compare the hacked hashes to your hash list that generated collisions, and then enter that password on a website, even if you have the wrong password: as long as the hash validates, you're pwned.
Who cares if someone cracks my passwords? I don't care!
Below is just a small collection of examples of what phishers and other malicious individuals could with your unhashed and unsalted plaintext passwords. It may not necessarily be used to target you directly, but let's say
Hacker wants to target
Person A. Let's deduce how you can target
- You are
Hacker. Your job is to hack websites and develop a database to aggregate this information.
Person A is a person of interest.
Person A shows up in one of your hacked sites database. You now know their email address, and the
password they're using for that website.
- Now you can try to log in to their
email address with
password you've stolen from that website. Sweet, it works!
- Now that you have access to their email, you download all of their emails through
IMAP, or through their web-mail. At this point, you find lots of interesting things. They're communicating with
- You can actually google some people's usernames and email addresses, and it could show websites they post on. This will bring up other websites that the user uses. Maybe you can try to hack those websites, or maybe you can just deduce what they're into. Now you can
pretend to be like them, or find additional information. Information/activities could include:
Person A posts online as
Mark Buffalo. That's a relatively unique name. You can then google Mark Buffalo, and look for websites that he posts on. Maybe he reveals more of his personality on other sites?
- Passwords. Maybe
Mark Buffalo has the same password on that website. Maybe you can log in to that website and view his private communications with others?
- Personal Information. Because you know the identity of
Mark Buffalo, what if he shares
personal information on certains website? What if he posts on craigslist searching for male or female escorts, and he's left his phone number there? You already found his phone information, so you can find a way to set him up and blackmail him for money/information/power. This doesn't have much to do with salting the passwords unless you don't include the phone number, but they find their phone number on another website thanks to your leak. It's one of the many very powerful ways that information can be collected and used against you. This is, after all, an
Information Security forum, so I want to use this example.
- Family Information. Now it's getting creepy. We've got Mark Buffalo's personal information. Let's look into his social networking. Oh, he has a
Facebook account (I don't). Can we access this with the same password? If Buffalo is using the same password/email combination, then probably. And you can probably deduce this from his email that you accessed earlier, where you found a lot of interesting things. We can now log in and read his Facebook messages. Now we know who his family members are. We can then coordinate the blackmail attack more easily.
- Other Login Information. Since we got access to his email earlier, we see he also has a Skype account. One of them is secret. We log in, and see he's flirting with people on Skype. We now have more blackmail material.
- Impersonation. You can now log in and impersonate Buffalo on a variety of websites. Maybe he's actually a straight-shooter and never went after any escorts, or anything of the sort? Well, now you can turn him into an escort-seeking reprobate, at least in appearance, by using his credentials to impersonate him online. Imagine the damage that could cause to a politician who was wrongly accused and forced to resign.
- Things that make it easier to hack other people. You can then send emails to
Person B with infected attachments, and pretend you know him. You've read enough emails, so you're able to imitate
Mark Buffalo to the point where you seem just like him. You craft the email in a way that leaves
Person B unsuspecting of what's really going on, and now you can do the same thing to
Person B, or worse.
And that's just a small collection of ideas. There are a lot of different uses for someone else's credentials. Salt and hash your passwords, use collision-resistant hash algorithms such as bcrypt and scrypt, and prevent SQL injection attacks. Please don't turn me into an escort-seeking reprobate! Save Mark Buffalo!
(I'm aware some websites can block your attempt to access their services when using a different IP, but there are many ways around this, and not all websites do this).
By the way, congratulations on your potential class action lawsuit if you get hacked.