[BreachExchange] How Do Websites Keep Your Passwords Secure?

[Audrey McNeil]

http://www.makeuseof.com/tag/websites-keep-passwords-secure/

We now rarely go a month without hearing about some sort of data breach; it
might be an up-to-date service like Gmail or something most of us have
forgotten about, like MySpace.

Factor in our increasing awareness of the ways our private information is
vacuumed up by Google, social media (notably Facebook), and even our very
own smartphones, and nobody can blame you for being a bit paranoid about
how websites look after something as important as your password.

In fact, for peace of mind, this is something everyone needs to know…

The Worst Case Scenario: Plain Text

Consider this: A major website has been hacked. Cybercriminals have broken
through any basic security measures it takes, maybe taking advantage of a
flaw in their architecture. You’re a customer. That site has stored your
details. Thankfully, you’ve been assured your password is secure.

Except that site stores your password as plain text.

It was always a ticking bomb. Plain text passwords are just waiting to be
plundered. They use no algorithm to make them unreadable. Hackers can read
it as simply as you’re reading this sentence.

It’s a scary thought, isn’t it? It doesn’t matter how complex your password
is, even if it’s pi to 30 digits: a plain text database is a list of
everyone’s passwords, spelled out clearly, including whatever additional
numbers and characters you use. Even if hackers don’t crack the site, would
you really want admin to be able to see your confidential login details?

You might think this is a very rare problem, but an estimated 30% of
eCommerce websites use this method to “secure” your data — in fact, there’s
a whole blog dedicated to highlighting these offenders! Until last year,
even the NHL stored passwords this way, as did Adobe before a major breach.

Shockingly, virus protection firm, McAfee also uses plain text.

An easy way of finding out if a site uses this is if, just after signing
up, you receive an email from them listing your login details. Very dodgy.
In that case, you might want to change any sites with that same password
and contact the company to alert them that their security is worrying.

It doesn’t necessarily mean they do store them as plain text, but it’s a
good indicator — and they really shouldn’t be sending that sort of thing in
emails anyway. They may argue that they have firewalls et al. to protect
against cybercriminals, but remind them that no system is flawless and
dangle the prospect of losing customers in front of them.

They’ll soon change their mind. Hopefully…

Not as Good as It Sounds: Encryption

So what these sites do?

Many will turn to encryption. We’ve all heard about it: a
seemingly-impervious way of scrambling your information, rendering it
unreadable until two keys — one held by you (that’s your login details),
and the other by the company in question — are presented. It’s a great
idea, one that you should even implement on your smartphone and other
devices.

The internet runs on encryption: when you see HTTPS in the URL, that means
the site you’re on is using either the Secure Sockets Layer (SSL) or
Transport Layer Security (TLS) Protocols to verify connections and jumble
up data.

But despite what you may have heard, encryption isn’t perfect.

It should be safe, but it’s only as secure as where the keys are stored. If
a website is protecting your key (i.e. password) using their own, a hacker
could expose the latter in order to find the former and decrypt it. It
would require comparatively little effort from a thief to find your
password; that’s why key databases are a massive target.

Basically, if their key is stored on the same server as yours, your
password might as well be in plain text. That’s why the aforementioned
PlainTextOffenders site also lists services that use reversible encryption.

Surprisingly Simple (but Not Always Effective): Hashing

Now we’re getting somewhere. Hashing passwords sounds like nonsense jargon,
but it’s simply a more secure form of encryption.

Instead of storing your password as plain text, a site runs it through a
hash function, like MD5, Secure Hashing Algorithm (SHA)-1, or SHA-256,
which transforms it into an entirely different set of digits; these can be
numbers, letters, or any other characters. Your password could be
IH3artMU0. That might turn into 7dVq$@ihT, and if a hacker broke into a
database, that’s all they can see. And it works only one way. You can’t
decode it back.

Unfortunately, it’s not that secure. It’s better than plain text, but it’s
still fairly standard for cybercriminals. The key is that a specific
password produces a specific hash. There’s a good reason for that: each
time you log in with the password IH3artMU0, it automatically passes
through that hash function and the website allows you access if that hash
and the one in the site’s database match.

It also means that hackers have developed rainbow tables, a list of hashes,
already used by others as passwords, that a sophisticated system can
quickly run through as a brute-force attack. If you’ve picked a shockingly
bad password, that’ll be high on the rainbow tables and could be easily
cracked; more obscure ones — particularly extensive combinations — will
take longer.

How bad can it be? Back in 2012, LinkedIn was hacked. Email addresses and
their corresponding hashes were leaked. That’s 177.5 million hashes,
affecting 164.6 million users. You might figure that’s not too much of a
concern: they’re just a load of random digits. Pretty indecipherable,
right? Two professional crackers decided to take a sample of 6.4 million
hashes and see what they could do.

They cracked 90% of them in just under a week.

As Good as It Gets: Salting and Slow Hashes

No system is impregnable — hackers will naturally work to crack any new
security systems — but the stronger techniques implemented by the most
secure sites are smarter hashes.

Salted hashes are based on the practice of a cryptographic nonce, a random
data set generated for each individual password, typically very long and
very complex. These additional digits are added to the beginning or end of
a password (or email-password combinations) before it passes through the
hash function, in order to combat attempts made using rainbow tables.

It generally doesn’t matter if the salts are stored on the same servers as
hashes; cracking a set of passwords can be hugely time consuming for
hackers, made even tougher if your password itself is excessive and
complicated. That’s why you should always use a strong password, no matter
how much you trust a site’s security.

Websites that take their, and by extension your, security particularly
seriously are increasingly turning to slow hashes as an added measure. The
best-known hash functions (MD5, SHA-1, and SHA-256) have been around a
while, and are widely-used because they’re relatively easy to implement,
and apply hashes very fast.

While still applying salts, slow hashes are even better at combating any
attacks that rely on speed; by limiting hackers to substantially fewer
attempts per second, it takes them longer to crack, thereby making attempts
less worth it, considering also the lowered success rate. Cybercriminals
have to weigh up whether it’s worth attacking time-consuming slow hash
systems over comparatively “quick fixes”:medical institutions typically
have less security, for instance, so data that could be obtained from there
can still be sold on for surprising sums.

It’s also very adaptive: if a system is under particular strain, it can
slow down even further. Coda Hale, Microsoft’s former Principle Software
Developer, compares MD5 to perhaps the most notable slow hash function,
bcrypt (others include PBKDF-2, and scrypt):

“Instead of cracking a password every 40 seconds [as with MD5], I’d be
cracking them every 12 years or so [when a system uses bcrypt]. Your
passwords might not need that kind of security and you might need a faster
comparison algorithm, but bcrypt allows you to choose your balance of speed
and security.”

And because a slow hash can still be implemented in less than a second,
users shouldn’t be affected.

Why Does It Matter?

When we use an online service, we enter into a contract of trust. You
should be safe in the knowledge that your personal information is being
kept secure.

Storing your password safely is especially important. Despite numerous
warnings, many of us use the same one for different sites, so if there’s,
for example, a Facebook breach, your login details for any other sites that
you frequent using the same password might also be an open book for
cybercriminals.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20160823/075331a7/attachment.html>