Quantcast
Channel: What is a good analogy to explain to a layman why passwords should be hashed? - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 19

Answer by Malcolm for What is a good analogy to explain to a layman why passwords should be hashed?

$
0
0

Imagine you're Scrooge McDuck. You've been keeping your piles of money in one giant vault for a while now, but there's a problem with that: if a thief ever gains access to the vault, all your money will be lost in one go! That's no good. So, clever duck that you are, you decide to split your money up into lots of smaller piles and put each one in its own separate vault. Now, if the thief ever gains access to one vault, only a small amount of your money will be lost, and you can easily replace the compromised vault. Much better! Except now you have a new problem: how to remember the combinations to all those different vaults? You can't just use the same combination for each one, because if the thief ever got their hands on it they'd have access to all your money and you'd be no better off than if you'd left it in one giant pile!

You decide to just write down all the combinations (along with the vault that each one goes to) on a little slip of paper, and then put that paper in its own, separate vault. Now you only have to remember one combination, but your money is still kept separate. This is an improvement, but it's still problematic, because if a thief ever did manage to find and crack the safe with the paper in it they'd still be able to take all your money. You don't want that to ever happen!

So what do you do? Well, the ideal solution would be to write the combinations down in some kind of code. You'd want a code that a thief can't use to get back all the original combinations, but that you can still use to get access to your money. Unfortunately, there isn't really a way to do this for money in vaults. Fortunately, it is possible for password-protected user accounts, because we don't actually need to know our user's passwords--we only need to know that they know them.

Keeping your money in one giant safe is like having a single master password for your entire system. Keeping money in different safes and writing down all the combinations is like keeping your users' data separate in password-protected accounts, but then keeping all their passwords in plaintext at a single location: as long as an attacker knows or can guess where that location is, it's not really any different than having a single master password. You need a way to encode your list of passwords in such a way that you can still use it to verify that a user has the correct password, while ensuring that an attacker can't use the list to get back the passwords themselves. In a nutshell, this is what hashing does.


Viewing all articles
Browse latest Browse all 19

Trending Articles