Cryptographic hash function: Difference between revisions

Revision as of 01:20, 22 August 2024

Revision as of 01:22, 22 August 2024

Line 188:

==Attacks on hashed passwords==

{{main|Password cracking}}

Rather than store plain user passwords, controlled -access systemsystems frequently store the hash of each user's password in a file or database. When someone requests access, the password they submit is hashed and compared with the stored value. If the database is stolen (an all -too -frequent occurrence<ref name="jjUS1">{{cite news|url=https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html|title=The 15 biggest data breaches of the 21st century|first=Dan|last=Swinhoe|first2=Michael|last2=Hill|publisher=CSO Magazine|date=April 17, 2020|access-date=November 25, 2020|archive-date=November 24, 2020|archive-url=https://web.archive.org/web/20201124152328/https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html|url-status=live}}</ref>), the thief will only have the hash values, not the passwords.

Passwords may still be retrieved by an attacker from the hashes, because most people choose passwords in predictable ways. Lists of common passwords are widely circulated and many passwords are short enough that even all possible combinations may be tested if calculation of the hash does not take too much time.<ref name="2tECU">{{cite web | url=https://arstechnica.com/information-technology/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ | title=25-GPU cluster cracks every standard Windows password in <6 hours | date=2012-12-10 | first=Dan | last=Goodin | publisher=[[Ars Technica]] | access-date=2020-11-23 | archive-date=2020-11-21 | archive-url=https://web.archive.org/web/20201121132005/https://arstechnica.com/information-technology/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ | url-status=live }}</ref>