Lesson 3.1: Storing and checking passwords
How a website should remember passwords without knowing them: hashing, salts and slow password hashes (bcrypt, Argon2) instead of fast hashes like MD5 or SHA-1, which leaked password lists turn back into passwords in seconds. And the attacks on login forms: brute force, credential stuffing and password spraying, with the defences rate limiting and multi-factor authentication. In the lab a support ticket says new customers can't log in. You find a login attack that succeeded in the access log, discover that the new sign-up page stores MD5 hashes and that a world-readable export reveals two customers with the same password, crack it with one line of PHP, fix the sign-up code with password_hash and lock down the export.
19 min
You will learn to
- Explain hashing, salting and why passwords need slow hashes
- Use password_hash and password_verify in PHP
- Recognise brute force and credential stuffing in a log
- Name defences: rate limiting, MFA, breached-password checks
- Fix MD5 password storage
Key terms
- Hash
- A one-way function: easy to compute from the input, practically impossible to reverse.
- Salt
- A random value stored with each password hash and mixed into it, so equal passwords get different hashes and precomputed lists are useless.
- Password hash (bcrypt, Argon2)
- A hash built to be slow and salted, with an adjustable cost, made for storing passwords.
- Brute force
- Trying many passwords against one account until one works.
- Credential stuffing
- Trying user name and password pairs leaked from other websites, betting that people reuse passwords.
- Multi-factor authentication (MFA)
- Requiring a second proof besides the password: a code from an app, a security key or a passkey.
← Subnets and CIDR: dividing a network · All lessons · Security controls: preventive, detective, corrective →