PagerDuty's Security Training for Engineers

Hashing

Hashing techniques are essential for password security, but they have limitations. Alan Underwood explains that while hashing is a good start, it is not enough due to the existence of rainbow tables, which can reverse-engineer hashes quickly 1. To combat this, salts and peppers are used. Salts are unique strings added to passwords before hashing, while peppers are site-wide salts stored separately from the data 2. This makes it harder for hackers to reverse-engineer passwords, even if they obtain the database.

The first thing, never, ever, ever, ever store passwords in plain text. Don't. There's no excuse.

--- Alan Underwood

Despite these measures, Joe Zack notes that if hackers have both the salt and pepper, they can still attempt brute force attacks 3.

   

Rainbow Tables

Rainbow tables pose a significant threat to password security by allowing hackers to reverse hashes. Alan Underwood highlights that even with long passwords, MD5 hashes can be cracked cheaply using these tables 3. Salts and peppers help mitigate this risk by ensuring that hashes are unique, but they are not foolproof. If a hacker obtains both, they can still perform brute force attacks using password dictionaries 4.

You cannot create the same hash with a different salt on there.

--- Alan Underwood

Joe Zack adds that adaptive hashing can further protect passwords by increasing the number of hashing rounds as hardware improves, making it more costly for hackers to crack passwords 5.

   

Key Stretching

Key stretching is a technique used to slow down brute-force attacks by increasing the time it takes to hash passwords. Alan Underwood explains that this involves hashing a password multiple times, making it more difficult for hackers to crack 6. This method is crucial because traditional hashing algorithms like MD5 are too fast, allowing hackers to attempt numerous password guesses quickly.

The solution is actually called key stretching.

--- Alan Underwood

Joe Zack notes that adaptive hashing can adjust the number of iterations as hardware becomes faster, ensuring that password security remains robust over time 5.