How passwords and logins work: why a website should not know your password
Password cracking: why a stolen list of hashes still gives passwords away
A thief copies the password list of a website. The list holds no passwords. It holds only hashes, and a hash cannot be turned back into a password. Yet many of the passwords will still be found.
-
1
On Rono's laptop, the stolen list shows nothing but hashes. He cannot run the grinder backwards, any more than Miva can.
-
2
But he can run it forwards. The hash function is no secret: it is the same one the website uses, free for anyone. He feeds it a guess, 123456, and gets its hash.
-
3
Then he looks for that hash in the list. It is there, 40 times over: every member who picked 123456 got the same hash. One guess, and 40 passwords are found.
-
4
So he does not guess at random. He takes millions of real passwords from older breaches, like the RockYou list, and grinds them all. Finding passwords this way is called cracking, and guessing from a list like this is a dictionary attack.
-
5
Your sunflower7 is on that list too. A few minutes later, it sits next to your email on Rono's laptop.
-
6
He does not even need to grind. Ready-made tables of millions of common passwords and their hashes already exist, because a password has the same hash in every list in the world.
-
Quick check
Quick check.
Show the answer
That no member of the gym uses letmein. The same password always gives the same hash, so a hash that is on no row means no member picked it.