So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against just a top 100 dictionary, but one specifically for my site). However, all of the passwords on my site are hashed and salted. How can I check which passwords are in the top 100 most used in the most efficient and secure way? The only thing I can think of right now is storing just the hashes of every password and how many users registered with that password in a separate table. That way the attacker wouldn't be able to attach the password hash to the username and all they have is the unsalted hashes of the top 100 most used passwords. Is there a way to do this in a more secure or efficient manner?
-
1I'm trying to understand your reasoning for even doing this. If you want to prevent users from using the top 100 most used passwords, just test them at the time the user creates the password. If you want to make sure no one uses any of the top 100 most used password, test them at the time the user creates them AND expire everyone's current password.– NotMeMar 3, 2016 at 22:49
-
@NotMe I'm not actually doing this, it's only theoretical. How do I know what the top 100 most used passwords are? That's the problem. I'm not talking about the 100 most used passwords overall but for MY SITE specifically. My question is what is the most secure/efficient method of finding out what the top 100 passwords are.– trallgormMar 4, 2016 at 5:12
-
You will need to store the unsalted hashes of all passwords, and not just the top 100. Otherwise you won't know own if a new password hots the top 100.– Neil SmithlineMar 4, 2016 at 5:15
-
@NeilSmithline Yea that's exactly what I was thinking, is there a more secure way to do it?– trallgormMar 4, 2016 at 14:22
-
There's no secure way to do it. There is no doubt that you will be reducing security.– Neil SmithlineMar 4, 2016 at 15:02
1 Answer
Unsalted hashed passwords, especially hashes of common passwords, are trivial to reverse. For example, diamond is a top 100 password. A quick Google of its SHA1 hash of f872caad177d67bbe18c119d0505f2d3caa02af3 quickly reveals the unhashed password.
If a list you created a list that indicated that a set of users all shared the same password and that list was acquired by a hacker, then a password breach of one account would quickly lead to a breach of other the accounts.
This also opens up a new type of attack where an attacker can guess the top 100 passwords for your site by setting their account's password to likely choices. When it fails, they'll know they've found one. Then they can try logging into other user's accounts with that password.
Basically, storing passwords securely is difficult. The current technologies have been developed over decades. Any change you make to the current model will likely risk your user's accounts and passwords.
If you want, grab the list of the top 100, or top 1000, passwords and prevent them from being used. Just keep in mind that there is much controversy over the use of password requirements. Some feel they make things more secure, others that they just irritate users.
-
The table of the most common passwords would not be linked to the users, only how many of each password is used. The user passwords would still be hashed+salted. So in your case the attacker would only know that x amount of users use the password "diamond", not which ones. Since this is not a real world situation, just using the common top 100 does not suffice, I specifically need a way to get top 100 of MY site., while minimizing the risk. Whether or not I should do something else is not the question, it's what the most secure way to do it is. Mar 3, 2016 at 22:36
-
@trallgorm you need to keep a link to the user's account so you can decrement the counter on a password reset or account deletion. Mar 4, 2016 at 0:45
-
Before resetting a password, the user typically has to enter the old password anyways. Hash that password and decrement the table with the matching hash. No link required. Mar 4, 2016 at 5:10
-
That is to change a password, not resetting a lost one. They can't enter it if it's lost. That generally involves email or security questions. Mar 4, 2016 at 5:14
-
ah ok that's actually a fair point. So is there a better way to do it? Mar 4, 2016 at 14:24