I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing.
Like how does memory-hard hashed passwords protect against brute force attacks? Let's assume I have a webapp which hashes passwords with Argon2i. To my understanding it's great because it takes up a lot of computational power and it's "slow". This is the part where I get lost. How does it work under the hood? Who's doing the computational work?
When I try to imagine the how it could work, this is what I come up with. Which still leaves my with a lot of questions and is, probably, dead wrong:
- User password is hashed and stored
- Hacker decides to brute force an account
- Server takes a long time to validate passwords due to the memory-hard hashing used therefore it takes up too much time to gain access to an account.
Based on the assumptions listed above, I'm left to conclude that the computational work happens on the server (validating passwords). This conclusion doesn't seem right to me. Shouldn't you have the computational work be on the hacker's side of the equation? Is my server not at risk running out of resources if my algorithms are heavy and one of these attacks hit? So when I read things like "This medium-hard algorithm is great because it costs a lot of computational work" I don't understand how hackers could care less since they can just send requests without having to do work.. unless they have had access to the db where the sensitive data was stored.