Topic 4.2 · Unit 4: Securing Devices · 30 minute session
4.2 Authentication
Passwords should be stored as hashes, with a unique salt per user, never in plaintext. Adversaries attack passwords online through login portals (stolen credentials, password spraying, credential stuffing) or offline against a captured hash database (brute force, dictionary and rainbow table attacks). Authentication uses knowledge, possession, biometric and location factors; multifactor authentication (MFA) combines two or more, and login settings such as complexity, length, history and lockout make guessing harder.
Big idea Never store the password, store its salted fingerprint, so identical passwords look different and precomputed tables fail.
Course and exam description (CED) codes covered: 4.2.A.14.2.A.24.2.A.34.2.A.44.2.A.54.2.A.64.2.B.14.2.B.24.2.B.34.2.B.44.2.B.54.2.B.64.2.B.74.2.C.14.2.C.24.2.C.34.2.C.44.2.C.54.2.C.64.2.D.14.2.D.24.2.D.34.2.D.44.2.D.5
Last reviewed against the CED:
By the end of this session you can
- 4.2.A Explain why hashes (also called hash outputs, checksums, message digests, or digests) are used to store passwords.
- 4.2.B Explain how password attacks exploit vulnerabilities.
- 4.2.C Determine the type of authentication used to verify the identity of a user.
- 4.2.D Configure login settings to make a device more secure.
1. Why passwords are stored as hashes (4.2.A)
A cryptographic hash function (also called a message digest function) takes data of any length and outputs a fixed-length string called the hash (also a checksum, message digest or digest) 4.2.A.1. Well known ones: MD5; SHA-1, SHA-256 and SHA-512 (Secure Hash Algorithm); NTHash; RIPEMD-160.
An n-bit hash has 2n possible outputs but the inputs are infinite, so two inputs will eventually share a hash: a collision 4.2.A.2. Good hash functions have four properties 4.2.A.3:
| Property | Meaning |
|---|---|
| Collision resistant | It is hard to find two inputs with the same hash |
| Pre-image resistant | Given a hash, you cannot work out the input |
| Repeatable | The same input always gives the same hash |
| Fixed length | The hash length never depends on the input size |
If someone finds an efficient way to force collisions, the function is deprecated; MD5 and SHA-1 are examples 4.2.A.4.
Systems should never store passwords in plaintext. They store the hash; at login they hash what you typed and compare 4.2.A.5. To stop identical passwords producing identical hashes, a unique random salt is hashed with each password 4.2.A.6.
username salt hash
ana 9f2c b144...f5bb
ben 71d0 aed5...2f72 # same password as ana
chen c48a 993b...9be22. Password attacks (4.2.B)
If an adversary gets a legitimate user’s password and the organization has no MFA, they can act with all that user’s access 4.2.B.1.
| Online attack | Offline attack | |
|---|---|---|
| Where | Against a live login portal | On the adversary’s own computer, against a captured hash database 4.2.B.2 |
| Lockout | Slowed by account lockout (spraying stays under the threshold by trying each account once) | Bypasses lockout |
| Methods | Stolen or leaked credentials, often reused across services 4.2.B.3; password spraying, one common password against many accounts 4.2.B.4; credential stuffing, default credentials (switches, routers, IoT devices) or stolen pairs 4.2.B.5 | Hash-cracking tools hash guesses and compare 4.2.B.6: brute force (every possible password), dictionary (a list of common passwords), rainbow table (precomputed hashes sorted by hash, searched for the captured hash) 4.2.B.7 |
3. Authentication factors (4.2.C)
Authentication mechanisms are technical controls that verify identity; each piece of proof is a factor 4.2.C.1.
| Factor | Examples | Strength depends on |
|---|---|---|
| Knowledge (something you know) 4.2.C.2 | Password, personal identification number (PIN), challenge answers | Hard to guess, yet memorable |
| Possession (something you have) 4.2.C.3 | Access card, bank card, phone, authentication token | How hard the object is to obtain or copy |
| Biometric (something you are) 4.2.C.4 | Fingerprint, palm, face, iris or retina, voice | Unique to the person, hard to duplicate |
| Location (somewhere you are) 4.2.C.5 | Wi-Fi signals, global positioning system (GPS) data, time zone, internet protocol (IP) address | Rules allow or deny by location |
Multifactor authentication (MFA) uses more than one factor, so it is more secure than single-factor authentication 4.2.C.6.
4. Login settings that make a device more secure (4.2.D)
| Setting | What it does |
|---|---|
| Complexity 4.2.D.1 | At least one uppercase letter, lowercase letter, digit and special character |
| Minimum length 4.2.D.2 | Longer, more complex passwords take tools longer to crack |
| Maximum age 4.2.D.3 | Forces a change every so many days (often 90 or 120). Some national standards advise against forced changes, because they push users into predictable patterns such as Winter2027! then Spring2027! |
| Password history 4.2.D.4 | Stores previous hashes (often 5 to 10) so old passwords cannot be reused |
| Account lockout 4.2.D.5 | Locks the account after a few invalid attempts (often 3 to 5) |
Try the hashing lab below, then audit a computer’s login settings, like a junior system administrator setting up a shared desk.
Lock it in: memory hooks
One picture per idea. If you remember the hook, you can rebuild the details.
- Hash propertiesSame in, same out; any size in, same size out; can't go back; hard to collide.
- SaltSalt makes twins look different: the same password gets a different hash for every user.
- Spraying vs stuffingSpraying: one common password, many users. Stuffing: default or stolen pairs, tried one after another.
- FactorsKnow, have, are, where: knowledge, possession, biometric, location.
Common misconceptions
"A hash can be decrypted back into the password."
Not quite. Hashes have pre-image resistance: you cannot work backward. Offline attacks hash many guesses and compare the results to the captured hash.
"Account lockout stops every password attack."
Not quite. Lockout only slows online attacks. Offline attacks run on the adversary's own computer against a stolen hash database, so lockout never applies.
"Two passwords are multifactor authentication."
Not quite. MFA needs two different kinds of factor, such as something you know plus something you have.
Simulation · Hashing lab [4.2.A.1, 4.2.A.3, 4.2.A.6]
Hashing lab: what the server really stores
These are real SHA-256 hashes. Change one character and the whole hash changes; the same input always gives the same hash; the length never changes.
| Input | SHA-256 hash (64 hex characters) |
|---|---|
Falcon2024! | 78d620584d220d6e9f5e4f42b3c44d6b313f981db0b87f17c75dc467a16ac80b |
falcon2024! | f9ce6df32ca3cbfcc0d11985fcc56ecb024b83dfbf4ecb323a5548b83c340d59 |
Falcon2024!! | 20f6c23c5e45efad026877166b7aec2f01c56eb920086e4f88a80eb0593000a3 |
Falcon2024! | 78d620584d220d6e9f5e4f42b3c44d6b313f981db0b87f17c75dc467a16ac80b |
Rows 1 and 4 are identical inputs, so their hashes match (repeatable). Row 2 changes one letter's case and row 3 adds one character, yet neither hash looks like row 1's.
| User | Salt | Hash of salt + "Falcon2024!" |
|---|---|---|
| ana | 9f2c | b1449d960d8090b4b01948d9f0489c2c6164048579e0ec2b9ae5c9dc8007f5bb |
| ben | 71d0 | aed5eb90031ad877bf338be3c8f10175f690816c0d79c8e3480d44258df32f72 |
Both users chose the same password, but their unique salts make the stored hashes different, so a precomputed rainbow table is useless.
Waiting for input...
Simulation · [4.2.D.1, 4.2.D.2, 4.2.D.3, 4.2.D.4, 4.2.D.5]
Configure it: which login settings are too weak?
A shared drop-in computer must meet the company policy: complex passwords of at least 12 characters, the last 5 passwords remembered, and lockout after 5 failed attempts. Tap every setting that breaks the policy. Tap each part you think is a red flag. There are 4.
-
Red flag. Complexity should be enabled so every password mixes uppercase, lowercase, digits and special characters.
-
Red flag. The policy needs at least 12. Short passwords are cracked much faster.
-
Fine. The policy sets no maximum age, and some national standards advise against forced changes. Not a violation here.
-
Red flag. With no history, users can reuse old passwords. The policy needs 5.
-
Red flag. Never locking lets an adversary guess forever. The policy says lock after 5.
-
Fine. A reasonable lockout period once the threshold is set.
Exam traps
- Offline password attacks cannot be detected and bypass account lockout, because they run on the adversary's computer.
- MD5 and SHA-1 are deprecated: efficient ways to force collisions exist. Do not pick them as secure choices.
- A rainbow table is precomputed hashes of common passwords sorted by hash. Salt defeats it because the table would need every salt.
- A PIN and a password are both knowledge factors; using both is not MFA.
By the numbers
Say each list out loud, then tap to check.
4 hash properties Say them, then tap
- collision resistant
- pre-image resistant
- repeatable
- fixed length
2 kinds of password attack Say them, then tap
- stolen or leaked credentials
- password spraying
- credential stuffing
- brute force
- dictionary
- rainbow table
4 authentication factors Say them, then tap
- knowledge
- possession
- biometric
- location
5 login settings Say them, then tap
- complexity
- minimum length
- maximum age
- password history
- account lockout
In 30 seconds
- Hash functions turn any input into a fixed-length output; they are repeatable, collision resistant and pre-image resistant. MD5 and SHA-1 are deprecated.
- Store salted hashes, never plaintext; at login, hash what the user types and compare.
- Online attacks hit a login portal; offline attacks crack a stolen hash database and bypass lockout.
- Factors: know, have, are, where. MFA uses two or more different factors.
- Login settings: complexity, minimum length, maximum age, history, lockout after a few failed attempts.
Cover this list, say the points out loud, then take the checkpoint without scrolling back up.
Checkpoint · 9 questions
Checkpoint: Authentication
Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
-
A learning platform stores a SHA-256 hash for each password. When a student logs in, it hashes what they type and compares the result with the stored hash.
-
Two users chose the same password, but the database shows different stored hashes for them.
user:password database User Salt Stored hash (shortened) ana 9f2c b144...f5bb ben 71d0 aed5...2f72 -
An adversary steals a company's database of password hashes, then runs a hash-cracking tool for three days. The company's login page locks accounts after 5 failed attempts, but the adversary still recovers many passwords.
-
An adversary tries admin/admin, admin/1234 and root/root on hundreds of internet-connected cameras that were never reconfigured after installation.
-
A shared computer has these login settings.
Local security policy Setting Value Password complexity Enabled Minimum password length 12 characters Password history 5 remembered Account lockout threshold 0 (never lock) -
A company allows logins to its payroll system only when the device's IP address and Wi-Fi network show it is inside the head office. The same correct password is refused from anywhere else.
Key terms: flip the cards
Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.
-
Hashtap to flip
The fixed-length output of a cryptographic hash function; repeatable, collision resistant and pre-image resistant.
Example and CED codes -
Salttap to flip
A unique random value hashed with each user's password so identical passwords produce different hashes.
Example and CED codes -
Collisiontap to flip
When two different inputs produce the same hash; if collisions can be forced efficiently, the hash function is deprecated.
Example and CED codes -
Online password attacktap to flip
An attack where an adversary tries to log in to a device or service using common passwords, common patterns or stolen passwords.
Example and CED codes -
Offline password attacktap to flip
Cracking a captured user:password hash database on the adversary's own computer; it bypasses lockout and cannot be detected.
Example and CED codes -
Password sprayingtap to flip
An online attack that tries one common password against many different accounts.
Example and CED codes -
Credential stuffingtap to flip
An attack that tries common default credentials or stolen username and password pairs on services or devices.
Example and CED codes -
Brute force attacktap to flip
An offline attack that uses an automated tool to test every possible password against a captured hash.
Example and CED codes -
Dictionary attacktap to flip
An offline attack that hashes a list of common passwords and compares them with a captured hash.
Example and CED codes -
Rainbow tabletap to flip
A precomputed table of potential passwords and their hashes, sorted by hash, searched for a captured hash.
Example and CED codes -
Authentication factortap to flip
A piece of proof of identity: knowledge (know), possession (have), biometric (are) or location (where).
Example and CED codes -
Multifactor authentication (MFA)tap to flip
A login that requires extra proof of identity, such as a one-time code, in addition to a password.
Example and CED codes -
Account lockouttap to flip
A login setting that locks an account after a set number of invalid attempts, often 3 to 5.
Example and CED codes
Questions students ask
Why are passwords stored as hashes?
So that an adversary who steals the user:password database does not immediately know anyone's password. The system hashes what the user types and compares it with the stored hash.
What does salt do?
A unique random value is hashed with each user's password, so two users with the same password get different hashes and precomputed rainbow tables stop working.
What is the difference between password spraying and credential stuffing?
Password spraying tries one common password against many accounts. Credential stuffing tries default credentials or stolen username and password pairs on a service or device.