(copy and pasting my answer from another thread, with minor edits)
I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it?
Good question, and I'm glad you asked it. I want people to find this thread when they Google it so they -- hopefully -- won't make the same mistakes that many other companies make.
You shouldn't just
hash passwords, you should
salt them, and add a
Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time.
For example, "
myDarnPassword" would end up being converted to "
aca6716b8b6e7f0afa47e283053e08d9" in md5. At this point, you could create a dictionary attack by yourself. You could automatically generate a database that converts as many random characters, plus dictionary attacks, into a usable database. You'd create a table looks like this:
| PASSWORD | UNSALTED_HASH |
| myDarnPassword | aca6716b8b6e7f0afa47e283053e08d9 |
| pleaseDontSueMe11 | 0dd395d0ec612905bed27020fb29f8d3 |
Then you would select from the database like this:
SELECT [PASSWORD] FROM [TABLE] WHERE [UNSALTED_HASH] = 'aca6716b8b6e7f0afa47e283053e08d9'
And it would return
With enough processing power and time, you could create trillions of combinations, and quite easily crack a large number of passwords. At that point, all you really have to do is look it up. And if you've stolen other people's passwords in the past from a database, you can add those, and convert them to md5 hashes.
Salting the hash defeats this attack.
When a user sends his or her login (name+password) to the server, the server loads the password of the given user name from database and then compares passwords. There is no way how the user could get password from the database.
Right. You compare the password to the stored hash, and if it matches the salted hash in the database, then it's considered a valid password. You may then allow the user to log in.
Below is something people can do with unhashed and unsalted plaintext passwords. It may not necessarily be used to target you directly, but let's say
Hacker wants to target
Person A. Let's deduce how you can target
- You are
Hacker. Your job is to hack websites and develop a database to aggregate this information.
Person A is a person of interest.
Person A shows up in one of your hacked sites database. You now know their email address, and the
password they're using for that website.
- Now you can try to log in to their
email address with
password you've stolen from that website. Sweet, it works!
- Now that you have access to their email, you download all of their emails through
IMAP, or through their web-mail. At this point, you find lots of interesting things. They're communicating with
- You can actually google some people's usernames and email addresses, and it could show websites they post on. This will bring up other websites that the user uses. Maybe you can try to hack those websites, or maybe you can just deduce what they're into. Now you can
pretend to be like them, or find additional information. Information/activities could include:
Person A posts online as
Mark Hulkalo. That's a relatively unique name, a combination of
Mark Ruffalo the actor, and the monster he portrays,
The Incredible Hulk. You can then google,
Mark Hulkalo, and look for websites that he posts on. Maybe he reveals more of his personality on other sites?
- Passwords. Maybe
Mark Hulkalo has the same password on that website. Maybe you can log in to that website and view his private communications with others?
- Personal Information. Because you know the identity of
Mark Hulkalo, what if he shares
personal information on a certain website? What if he posts on
craigslist searching for male or female escorts, and he's left his phone number there? You already found his phone information, so you can find a way to set him up and blackmail him for money/information/power. This doesn't have much to do with salting the passwords unless you don't include the phone number, but they find their phone number on another website thanks to your leak. It's one of the many very powerful ways that information can be collected and used against you. This is, after all, an
Information Security forum, so I want to use this example.
- Family Information. Now it's getting creepy. We've got
Mark Hulkalo's personal information. Let's look into his social networking. Oh, he has a
Facebook account. Can we access this with the same password? If
Mark Hulkalo is using the same
password/email combination, then probably. And you can probably deduce this from his email that you accessed earlier, where you found a lot of interesting things. We can now log in and read his
Facebook messages. Now we know who his family members are. We can then coordinate the blackmail attack more easily.
- Other Login Information. Since we got access to his email earlier, we see he also has a
Skype account. One of them is secret. We log in, and see he's flirting with his escorts on Skype. We now have more blackmail material.
- Impersonation. You can now log in and
Mark Hulkalo on a variety of websites. Maybe he's actually a
straight-shooter and never went after any escorts, or anything of the sort? Well, now you can turn him into an
escort-seeking reprobate by using his credentials to impersonate him online. Imagine the damage that could cause to a politician who was wrongly accused and forced to resign.
- Things that make it easier to hack other people. You can then send emails to
Person B with infected attachments, and pretend you know him. You've read enough emails, so you're able to imitate
Mark Hulkalo to the point where you seem just like him. You craft the email in a way that leaves
Person B unsuspecting of what's really going on, and now you can do the same thing to
Person B, or worse.
And those are just a few scenarios. There are a lot of different uses for someone else's credentials.
Salt and hash your
passwords, and prevent
SQL injection attacks.
Please don't turn me into an escort-seeking reprobate! Save Mark Hulkalo!
(I'm aware some websites can block your attempt to access their services when using a different IP, but there are many ways around this, and not all websites do this).
By the way, congratulations on your class action lawsuit if you get hacked.