18

This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this poses no problem in this case (as you would have to be logged in to see this table), but what if this data was made public?

To rephrase more clearly: does revealing part of your password hash (including the hash length) make password cracking (via bruteforce or any other method) any simpler or more efficient than before?

  • 11
    Just give your password a +2 shield and that should just about cancel out the advan- oh sorry wrong stack... – Nacht Jan 5 at 21:51
  • The benefit of showing the hash part is it lets the user know that their password is very likely stored securely. – Qwertie Jan 6 at 6:08
  • 1
    Related concept: k-anonymity. – forest Jan 6 at 7:33
  • 2
    Isn't the whole point of hashing + salt that it is hard to create a matching password, even knowing this information? – kutschkem Jan 6 at 9:21
  • @Qwertie not understanding. Say I am a "bad engineer" and store your password in plain text. I can calculate the hash on the fly - giving you the "security" you desire. – emory Jan 6 at 16:22
27

TL;DR: The answer depends on the hash algorithm, what part of the hash is revealed and the strength of the password.

Assuming that the hash algorithm is known the knowledge of a specific part of the hash might make brute force attacks easier: The attacker might now run most brute force tests offline and also in parallel and is thus not restricted by rate limiting or even account locking after failed attempts which is (hopefully) in place to deter massive brute forcing.

How much easier the attack gets depends on the hash and on the strength of the password though. If the hash algorithm is slow (as recommended) then brute forcing will be slow too. If the password is weak enough such offline brute forcing will still likely be successful too. In contrast: if the site implements a wait time after each failed login attempt or maybe even locks the account then online brute force attacks will often fail even for weaker passwords.

How much easier it gets depends also a lot on the type of hash and which parts are revealed. If the attacker does not know the salt which was used in hashing (and which is commonly stored as part of the hash) then brute forcing is nearly impossible - provided that the salt is chosen from a large enough random pool.

| improve this answer | |
  • not only brute force attacks, it could make dictionary attacks also much easier, for the same reason: can easily rule out any password whose hash does not match the known part of the hash. (still, with a good unknown salt, it shouldn't help any, as you pointed out) – user1067003 Jan 5 at 14:42
  • 1
    @user1067003: A dictionary attack is a form of brute force attack - see en.wikipedia.org/wiki/Dictionary_attack. And of course the attacker will be trying the more common (and thus weak) passwords first. – Steffen Ullrich Jan 5 at 15:03
3

There is quite no case when it's not easier for the adversary. The only case is if the password is salted (with large random) and the salt is not displayed.

The main concern is to know how much easier it is for the adversary.

In the worst case, he can perform offline dictionary/bruteforce attack and due to the dispersion of the hashing function, he will have few false positives.
For example, if the website display 6 hex characters, you can assume that a bruteforce attack will statistically match a hash with the same heading 6 characters every 16^6 attempt (so one false positive every 16 millions attempt). It's a big advantage.

As previously mentioned, if the hash algorithm is bcrypt, scrypt, and so one, the speed of an offline attack will not be very interesting comparing to the online attack.
BUT !!!
With abilities to perform an offline attack you can avoid account lockout due to passwords attempt threshold. So there is some cases where displaying part of the hash will permit to bypass an account lockout functionnality even if the offline attack speed is not huge (10 attemps per sec is still better than 10 attemps and then blocked).
It is also a way to stay quiet relatively to the SIEM and other intrusion detection mechanisms.

Note that having a huge randomly generated password will not be enough to ignore the risk. If the password is not salted and the hash algorithm is weak, a collide could occur with a shorter password attempt.

| improve this answer | |
1

There is no problem if you have a good password created by diceware or Bip39 with good entropy then a polynomial-time adversary even with the knowledge of the hash and salt cannot do anything. If your password is already 123456, we already assumed that can be broken, part of it leaked or not. What about the salt is not available to the attacker, good luck for them.

  • The Bitcoin Bip-39 dictionary with 2048 words can create ≈2263-entropy by tossing the coin 256 times to choose the words randomly.

  • The Diceware passphrases has an entropy around

    • a five-word has 64.6 bits
    • six words have 77.5 bits
    • seven words 90.4 bits
    • eight words 103 bits
    • nine words 116 bits
    • ten words 129 bits.

We consider that the polynomial-time attackers can access the salt and the hash value. And the security of your passwords must be satisfied with this case. The motivation for this approach is easy; the attacker can always reach/access the database and download the hashes and salts. Simply;

  • There is no security with obscurity. We consider the security of the passwords even the hash and salt are totally leaked. Therefore a partial recovery must not create a difference.

Passwords, actually, are not simply hashed, they are processed with good password hashing functions like PBKDF2, Scrypt, Bcrypt, and Argon2 which is the winner of the Password Hashing Competition in July 2015.

If you are not using a good password hashing mechanism and if you don't have a password with good entropy then you have already insecure.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.