Knowing when a hacked password is correct

Question

I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now be used to guess passwords thousands of time per second, even salted password have become vulnerable. So how does a hacker or his/her computer know when the guess is correct? Surely a website would not allow thousands of incorrect tries.

Answer 1

There are two types of password cracking attacks: online and offline.

In an online attack, an attacker repeatedly tries logging in to the website, just like you would do when entering your username and password. The website can block the account after a certain number of incorrect attacks. The speed at which this happens is typically limited by the speed of the web application, so this is tens to hundreds of attempts per second.

In an offline attack, the attacker has somehow downloaded the database with password hashes to his own computer. To recover the plaintext password, they brute-forces the hash. They hash passwords and checks whether these matches the one in the database. This runs on the attacker's computer and the website is not involved in this process. This is the process in which a GPU may make things faster. However, this needs a vulnerability or leak that exposed the database with password hashes.