Quantcast
Channel: What is a good analogy to explain to a layman why passwords should be hashed? - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 19

Answer by supercat for What is a good analogy to explain to a layman why passwords should be hashed?

$
0
0

The most fundamental answer, which I haven't seen anyone state directly yet, is that the actions of anyone who would be in a position to discover a password cannot be reliably distinguished from the actions of its rightful owner. If one wants to be able to prove that the rightful owner either performed an action or by his own action exposed the password to an unauthorized person, then one must ensure that the rightful owner is never required to do anything that would allow anyone else to determine the password.

If Fred's password is stored in a database in a fashion that is not scrambled beyond recovery, then Fred could counter any allegation of wrongdoing by claiming that his password may have been used or leaked by someone with access to the password database. Unless specialized hardware is used to store passwords, there would be no way to disprove Fred's counter-claim.

Note that for real security, Fred should never expose his password to anything other than tamper-resistant equipment which he has reason to trust. Otherwise, there would be a risk that the equipment into which Fred types his password might be tampered with in such fashion as to leak the unhashed password to some adversary.


Viewing all articles
Browse latest Browse all 19

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>