Factor in our increasing awareness of the ways our private information is vacuumed up by Google, social media (notably Facebook), and even our very own smartphones, and nobody can blame you for being a bit paranoid about how websites look after something as important as your password.
In fact, for peace of mind, this is something everyone needs to know…
The Worst Case Scenario: Plain Text
Consider this: A major website has been hacked. Cybercriminals have broken through any basic security measures it takes, maybe taking advantage of a flaw in their architecture. You’re a customer. That site has stored your details. Thankfully, you’ve been assured your password is secure.
Except that site stores your password as plain text.
It was always a ticking bomb. Plain text passwords are just waiting to be plundered. They use no algorithm to make them unreadable. Hackers can read it as simply as you’re reading this sentence.
It’s a scary thought, isn’t it? It doesn’t matter how complex your password is, even if it’s pi to 30 digits: a plain text database is a list of everyone’s passwords, spelled out clearly, including whatever additional numbers and characters you use. Even if hackers don’t crack the site, would you really want admin to be able to see your confidential login details?
I always use a good, strong password, like Hercules or Titan and I've never had any problems…
— Don't bother (@emilbordon) August 16, 2016
You might think this is a very rare problem, but an estimated 30% of eCommerce websites use this method to “secure” your data — in fact, there’s a whole blog dedicated to highlighting these offenders! Until last year, even the NHL stored passwords this way, as did Adobe before a major breach.
Shockingly, virus protection firm, McAfee also uses plain text.
An easy way of finding out if a site uses this is if, just after signing up, you receive an email from them listing your login details. Very dodgy. In that case, you might want to change any sites with that same password and contact the company to alert them that their security is worrying.
It doesn’t necessarily mean they do store them as plain text, but it’s a good indicator — and they really shouldn’t be sending that sort of thing in emails anyway. They may argue that they have firewalls et al. to protect against cybercriminals, but remind them that no system is flawless and dangle the prospect of losing customers in front of them.
They’ll soon change their mind. Hopefully…
Not as Good as It Sounds: Encryption
So what these sites do?
Many will turn to encryption. We’ve all heard about it: a seemingly-impervious way of scrambling your information, rendering it unreadable until two keys — one held by you (that’s your login details), and the other by the company in question — are presented. It’s a great idea, one that you should even implement on your smartphone and other devices.
The internet runs on encryption: when you see HTTPS in the URL, that means the site you’re on is using either the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) Protocols to verify connections and jumble up data.
But despite what you may have heard, encryption isn’t perfect.
Whaddya mean my password can't contain backspaces ???
— Derek Klein (@rogue_analyst) August 11, 2016
It should be safe, but it’s only as secure as where the keys are stored. If a website is protecting your key (i.e. password) using their own, a hacker could expose the latter in order to find the former and decrypt it. It would require comparatively little effort from a thief to find your password; that’s why key databases are a massive target.
Basically, if their key is stored on the same server as yours, your password might as well be in plain text. That’s why the aforementioned PlainTextOffenders site also lists services that use reversible encryption.
Surprisingly Simple (but Not Always Effective): Hashing
Now we’re getting somewhere. Hashing passwords sounds like nonsense jargon, but it’s simply a more secure form of encryption.
Instead of storing your password as plain text, a site runs it through a hash function, like MD5, Secure Hashing Algorithm (SHA)-1, or SHA-256, which transforms it into an entirely different set of digits; these can be numbers, letters, or any other characters. Your password could be IH3artMU0. That might turn into 7dVq$@ihT, and if a hacker broke into a database, that’s all they can see. And it works only one way. You can’t decode it back.
Unfortunately, it’s not that secure. It’s better than plain text, but it’s still fairly standard for cybercriminals. The key is that a specific password produces a specific hash. There’s a good reason for that: each time you log in with the password IH3artMU0, it automatically passes through that hash function and the website allows you access if that hash and the one in the site’s database match.
It also means that hackers have developed rainbow tables, a list of hashes, already used by others as passwords, that a sophisticated system can quickly run through as a brute-force attack. If you’ve picked a shockingly bad password, that’ll be high on the rainbow tables and could be easily cracked; more obscure ones — particularly extensive combinations — will take longer.
How bad can it be? Back in 2012, LinkedIn was hacked. Email addresses and their corresponding hashes were leaked. That’s 177.5 million hashes, affecting 164.6 million users. You might figure that’s not too much of a concern: they’re just a load of random digits. Pretty indecipherable, right? Two professional crackers decided to take a sample of 6.4 million hashes and see what they could do.
They cracked 90% of them in just under a week.
As Good as It Gets: Salting and Slow Hashes
Salted hashes are based on the practice of a cryptographic nonce, a random data set generated for each individual password, typically very long and very complex. These additional digits are added to the beginning or end of a password (or email-password combinations) before it passes through the hash function, in order to combat attempts made using rainbow tables.
It generally doesn’t matter if the salts are stored on the same servers as hashes; cracking a set of passwords can be hugely time consuming for hackers, made even tougher if your password itself is excessive and complicated. That’s why you should always use a strong password, no matter how much you trust a site’s security.
Websites that take their, and by extension your, security particularly seriously are increasingly turning to slow hashes as an added measure. The best-known hash functions (MD5, SHA-1, and SHA-256) have been around a while, and are widely-used because they’re relatively easy to implement, and apply hashes very fast.
Treat your password like your toothbrush, change it regularly and don't share it!
— Anti-Bullying Pro (from charity The Diana Award) (@AntiBullyingPro) August 13, 2016
While still applying salts, slow hashes are even better at combating any attacks that rely on speed; by limiting hackers to substantially fewer attempts per second, it takes them longer to crack, thereby making attempts less worth it, considering also the lowered success rate. Cybercriminals have to weigh up whether it’s worth attacking time-consuming slow hash systems over comparatively “quick fixes”: medical institutions typically have less security, for instance, so data that could be obtained from there can still be sold on for surprising sums.
It’s also very adaptive: if a system is under particular strain, it can slow down even further. Coda Hale, Microsoft’s former Principle Software Developer, compares MD5 to perhaps the most notable slow hash function, bcrypt (others include PBKDF-2, and scrypt):
“Instead of cracking a password every 40 seconds [as with MD5], I’d be cracking them every 12 years or so [when a system uses bcrypt]. Your passwords might not need that kind of security and you might need a faster comparison algorithm, but bcrypt allows you to choose your balance of speed and security.”
And because a slow hash can still be implemented in less than a second, users shouldn’t be affected.
Why Does It Matter?
When we use an online service, we enter into a contract of trust. You should be safe in the knowledge that your personal information is being kept secure.
"My laptop is set up to take a picture after three incorrect password attempts" pic.twitter.com/yBNzPjnMA2
— Cats in space (@CatsLoveSpace) August 16, 2016
Storing your password safely is especially important. Despite numerous warnings, many of us use the same one for different sites, so if there’s, for example, a Facebook breach, your login details for any other sites that you frequent using the same password might also be an open book for cybercriminals.
Have you discovered any Plain Text Offenders? Which sites do you trust implicitly? What do you think is the next step for secure password storage?