Have you ever wondered how password cracking works? And why it causes so much of a furor when a web site is discovered to have had its password file hacked into and stolen? If so, then here's how it works.
When you choose a password to use on a web site, the site needs to store that password in a database so that it can recognize you when you subsequently log in. Although some sites have simply stored the password itself, this is clearly a security risk. Therefore, sites tend to store a hash instead. A hash is the result of putting the password through a special mathematical formula which only works in one direction. For example, put "TechSupportAlert" through the MD5 hash formula and it comes out as b7c1ecff69702b37278e9badcb386e30.
The clever bit is that hashing only works in one direction. There's no way to start with that hash and work out what password it corresponds to. So when you log into the web site, and type "TechSupportAlert" as your password, the site hashes it again, and checks whether the hashed version of what you just typed matches the hash in the database. If so, you are safe to enter.
So how does password cracking work? And why do experts advise you to never choose a password that appears in a dictionary?
Well, imagine that I hack into a website and steal its database of usernames and hashed passwords. And then imagine that I search that database of hashes for b7c1ecff69702b37278e9badcb386e30. If I find a match, then I know that this particular user has chosen TechSupportAlert as their password.
And so in the article that explains it all in more detail, and is a diary of one person's attempt to try cracking some passwords. You'll find it at http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/1/. Once you've read it, you'll realize why choosing a strong, long, non-dictionary password makes sense. Especially on important web sites such as online banks and PayPal. If you don't, you'll now understand the risks much more clearly.
Original link: http://www.techsupportalert.com/content/want-find-out-how-password-cracking-works.htm
When you choose a password to use on a web site, the site needs to store that password in a database so that it can recognize you when you subsequently log in. Although some sites have simply stored the password itself, this is clearly a security risk. Therefore, sites tend to store a hash instead. A hash is the result of putting the password through a special mathematical formula which only works in one direction. For example, put "TechSupportAlert" through the MD5 hash formula and it comes out as b7c1ecff69702b37278e9badcb386e30.
The clever bit is that hashing only works in one direction. There's no way to start with that hash and work out what password it corresponds to. So when you log into the web site, and type "TechSupportAlert" as your password, the site hashes it again, and checks whether the hashed version of what you just typed matches the hash in the database. If so, you are safe to enter.
So how does password cracking work? And why do experts advise you to never choose a password that appears in a dictionary?
Well, imagine that I hack into a website and steal its database of usernames and hashed passwords. And then imagine that I search that database of hashes for b7c1ecff69702b37278e9badcb386e30. If I find a match, then I know that this particular user has chosen TechSupportAlert as their password.
And so in the article that explains it all in more detail, and is a diary of one person's attempt to try cracking some passwords. You'll find it at http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/1/. Once you've read it, you'll realize why choosing a strong, long, non-dictionary password makes sense. Especially on important web sites such as online banks and PayPal. If you don't, you'll now understand the risks much more clearly.
Original link: http://www.techsupportalert.com/content/want-find-out-how-password-cracking-works.htm