We now rarely go a month without hearing about some sort of data breach. It might be a popular service like Gmail or something most of us have forgotten about, like MySpace.
One of the worst things a hacker can find out is your password. This is especially true if you go against standard advice and use the same login credentials on different platforms. But looking after your password isn’t solely your responsibility.
So how do websites store your passwords? How do they keep your login credentials safe? And what’s the most secure method they can employ to look after your password?
The Worst Case Scenario: Plain Text
Consider this: A major website has been hacked. Cybercriminals have broken through any basic security measures it takes, maybe taking advantage of a flaw in their architecture. You’re a customer. That site has stored your details. Thankfully, you’ve been assured your password is secure.
Except that site stores your password as plain text.
Plain text passwords are just waiting to be plundered. They use no algorithm to make them unreadable. Hackers can read it as simply as you’re reading this sentence.
It doesn’t matter how complex your password is: a plain text database is a list of everyone’s passwords, spelled out clearly, including whatever additional numbers and characters you use.
And even if hackers don’t crack the site, do you really want a faceless website administrator to be able to see your confidential login details?
You might think this is a very rare problem, but an estimated 30% of eCommerce websites use this method to “secure” your data—in fact, there’s a whole site dedicated to highlighting these offenders!
An easy way of finding out if a site uses this is if, just after signing up, you receive an email from them listing your login details. In that case, you might want to change any sites with that same password, and contact the company to alert them that their security is bad.
It doesn’t necessarily mean they do store them as plain text, but it’s a good indicator.
And they really shouldn’t be sending that sort of thing in emails anyway. They may argue that they have firewalls and other security precautions to protect against cybercriminals, but remind them that no system is flawless and dangle the prospect of losing customers in front of them. They’ll soon change their mind. Hopefully…
Not as Good as It Sounds: Encryption
Treat your password like your toothbrush, change it regularly and don’t share it!
— Anti-Bullying Pro (from charity The Diana Award) (@AntiBullyingPro) August 13, 2016
So what do many of these websites do to secure your passwords?
Many will turn to encryption. This scrambles your information, rendering it unreadable until two keys—one held by you (that’s your login details), and the other by the company in question—are presented.
You should be using encryption elsewhere too. Face ID on iPhones are a form of encryption. Any passcode is. The internet runs on encryption: the HTTPS you can see in URLs mean the site you’re on is using either SSL or TLS Protocols to verify connections and jumble up data.
But despite what you may have heard, encryption isn’t perfect.
It should be safe, but it’s only as secure as where the keys are stored. If a website is protecting your key (i.e. password) using their own, a hacker could expose the latter in order to find the former and decrypt it. It would require comparatively little effort from a thief to find your password; that’s why key databases are a massive target.
If their key is stored on the same server as yours, your password might as well be in plain text. That’s why the aforementioned PlainTextOffenders site also lists services that use reversible encryption.
Surprisingly Simple (but Not Always Effective): Hashing
Now we’re getting somewhere. Hashing passwords sounds like jargon, but it’s simply a more secure form of encryption.
Instead of storing your password as plain text, a site runs it through a hash function, like MD5, Secure Hashing Algorithm (SHA)-1, or SHA-256, which transforms it into an entirely different set of digits. These can be numbers, letters, or any other characters.
Your password could be IH3artMU0. That might turn into [email protected], and if a hacker broke into a database, that’s all they can see. And it works only one way. You can’t decode it back.
Unfortunately, it’s not that secure. It’s better than plain text, but it’s still fairly standard for cybercriminals.
The key is that a specific password produces a specific hash. There’s a good reason for that: each time you log in with the password IH3artMU0, it automatically passes through that hash function and the website allows you access if that hash and the one in the site’s database match.
It also means that hackers have developed rainbow tables. Think of them as cheat sheets: they’re lists of hashes, already used by others as passwords, that a sophisticated system can quickly run through as a brute-force attack.
If you’ve picked a really bad password, that’ll be high on the rainbow tables and could be easily cracked. More obscure ones (particularly extensive combinations) will take longer.
As Good as It Gets Right Now: Salting and Slow Hashes
Nothing is impregnable: hackers will work to crack any new security systems. But the stronger techniques implemented by the most secure sites are smarter hashes.
Salted hashes are based on the practice of a cryptographic nonce, a random data set generated for each individual password, typically very long and very complex.
These additional digits are added to the beginning or end of a password (or email-password combinations) before it passes through the hash function, in order to combat attempts made using rainbow tables.
It generally doesn’t matter if the salts are stored on the same servers as hashes; cracking a set of passwords can be hugely time consuming for hackers, made even tougher if your password is already complicated.
That’s why you should always use a strong password, no matter how much you trust a site’s security.
Websites that take their, and by extension your, security particularly seriously also use slow hashes as an added measure. The best-known hash functions (MD5, SHA-1, and SHA-256) have been around a while, and are widely-used because they’re relatively easy to implement, and apply hashes in next to no time.
While still applying salts, slow hashes are even better at combating any attacks that rely on speed. By limiting hackers to substantially fewer attempts per second, it takes them longer to crack, thereby making attempts less worth it, considering also the lowered success rate.
Cybercriminals have to weigh up whether it’s worth attacking time-consuming slow hash systems over comparatively “quick fixes”: medical institutions typically have lower security, for instance, so data obtained from there can still be sold on for surprising sums.
It’s also very adaptive: if a system is under particular strain, it can slow down even further. Coda Hale, Microsoft’s former Principle Software Developer, compares MD5 to perhaps the most notable slow hash function, bcrypt (others include PBKDF-2, and scrypt):
“Instead of cracking a password every 40 seconds [as with MD5], I’d be cracking them every 12 years or so [when a system uses bcrypt]. Your passwords might not need that kind of security and you might need a faster comparison algorithm, but bcrypt allows you to choose your balance of speed and security.”
And because a slow hash can still be implemented in less than a second, users shouldn’t be affected.
Why Does Password Storage Matter?
When we use an online service, we enter into a contract of trust. You should be safe in the knowledge that your personal information is being kept secure.
Storing your password safely is especially important. Despite numerous warnings, many still use the same password for different sites, so if, for example, your Facebook is breached, login details for any other sites using the same password might also be an open book for cybercriminals.
Want to know how to make up a secure password? These creative password ideas will help you create strong, memorable passwords.
About The Author