Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of medium strength passwords (ex:
sImple! pass_pHrase) and poor hashing algorithms (SHA1, MD5) specifically.
For example, let's pretend we have the following application (usability aside for now): It only allows three incorrect password attempts within a 120 minute window, with the account being locked after the fourth attempt. We can also guarantee that users will never reuse passwords (from this application or any other website), and they are always too complex to be guessed with only three attempts.
With these assumptions made, what is the main concern that extra strong passwords and hashing algorithms are addressing?
- If an attacker wants to do a brute force attack, don't they need direct access to the data, in which case they already have what they were after?
This post about hashing passwords makes this point:
There are ways attackers can get access to parts of your database without accessing all of it... Coding errors can leak data, as can sql vulnerabilities. An attacker could get a dump of your passwords and nothing else.
Maybe this answers my question, but I am still uncertain of the likelihood of this happening. I also don't know if brute-force is the only concern.
- If password hashes are only good for determining passwords for other sites, and the database only contains unique passwords, the hashes should be useless, right?