Quantcast
Channel: What is a good analogy to explain to a layman why passwords should be hashed? - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 19

Answer by Nzall for What is a good analogy to explain to a layman why passwords should be hashed?

$
0
0

To start off, I'll provide one to start with:

Imagine you manage a bank. You don't want to allow your customers direct access to the money. So you have a teller who has just a computer and a small amount of money to deal with everyday withdrawals and deposits. He cannot access everything, nor can he pass secrets to the customer, because he doesn't have access to these secrets.

A teller is all fine and dandy, but sometimes, you have a person who wants to rob the bank and he's not really going to get stopped by the teller. To counteract this, you have a really big safe in your basement that contains all the real money of your clients. this safe has a bunch of security, like a fingerprint scanner, voice recognition, pressure switches, triple-keyed locks and a timed lock. it's designed to keep out everyone who shouldn't be there and who doesn't know how to get past the security.

This safe will stop 99% of the robbers, but there is always that 1% that manages to get past all that security, either by bypassing it or by brutalizing it. In case that happens, a bank stores their money in boobytrapped containers, that turn the money unusable, through means like blowing it up or spraying paint all over it. That way, the robber either cannot use the money or needs to spend a long time to make the money somewhat usable again.

A software application has these systems as well: the program that the user uses is the teller: he cannot make it do whatever he wants it unless he finds a way to sweet talk it into cooperation. the hardware and software configuration that protects the program and the database is the bank vault: it keeps the people out who don't know what the weaknesses are of the used security configuration. Storing the password in cleartext means that if someone gets past the program and the security configuration, he has free access to the passwords. Just like a bank stores the money in a container that makes accessing the money far harder, hashing the password gives the person who compromises your passwords a giant hurdle he needs to climb. It also means that the employees (both the bank, the software and those of our own company) cannot be pressured, coerced or sweet talked into bypassing the security for a con man, because not even they can access the money/passwords directly. They can only access the containers/the hash.


Viewing all articles
Browse latest Browse all 19

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>