How Hackers Crack Passwords (Part 1)

All Memorized Passwords Are Inherently Weak

If you can memorize your password, it is because it is most likely based upon a mnemonic (memory device).

If your password is based upon a memory device, it is most likely based upon a natural language (English, Spanish, etc.) word. Humans tend to memorize based upon words since it is how we communicate.

Word-based Passwords Are Inherently Weak

However, if your password is based upon a word, it is weak.

But, why is that true? To understand the reason that word-based passwords are weak, we must take a look at the methods that hackers use to crack passwords.

One Way Hackers Crack Passwords

Brute Force Attack

Here are the steps that the hacker uses to do that:

1. Obtain the site's database of passwords
2. Generate passwords from a natural language dictionary of words
3. Compare each generated word against the stolen database of passwords until successful

It's a little more difficult than this because most sites do not store their passwords in clear text but instead they also hash those passwords.

What's A Hash?

You can think of a hash as a one-way encryption technique.

That means the computer algorithm takes an input and will turn that exact input into one and only one output.

A simple diagram of this might look like the following:

In our example above, we use the ClearText (unencrypted) input of the letter a.

I've made the Hash Algorithm (in this case, we are using SHA256 - Secure Hashing Algorithm) a black box in the diagram because we do not need to know the implementation details of how it works.

Every time we input the value a into the SHA256 algorithm, we are guaranteed the output shown on the right.

That value becomes a unique identifier for the value a.

One-Way Encryption : Hash

We can think of this as a one-way encryption. But why do we call it a one-way encryption? That's because it is unfeasible that anyone can reverse the process to turn the hash value (ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb) back into the ClearText (the letter a in our case).

No Known Way To Reverse the Hash Value

Let me say that again. There is no known way to take the hash value and calculate what the original ClearText input was.

That's the power of a secure hashing algorithm.

For Every Input, There Is A Unique Output

Along with that, the hashing algorithm also guarantees that two different inputs will never produce the same hash output.

Even if the value is only changed by 1 bit of data (1/8^th of an ASCII character as it is stored on a computer).

That means if you hash the two long ClearText values shown below which differ by only one character, the output hash will not be similar at all:

Most Sites Hash Your ClearText Password

This is how most modern sites now store your password. They create a hash from the ClearText password that you've given them. They then store that hash in their database along with your userId so they know which one it is associated with.

This guarantees that no one can ever reverse the hash and discover your password.

Weak and Common Passwords

If you've been following along, you may have thought about how you could go about attempting to break this.

Since a specific ClearText message produces only one SHA256 hash, you could create hundreds of passwords, hash them and then compare those hashes to what is in the site's database of passwords.

But this only works for weak and common passwords.

Dictionary Attack

That's exactly what the hackers do. They generate hashes from every word in the natural language dictionary.

Let's look at an example table of how the hacker might do this (but of course, you'll have to imagine that I have every word from the English dictionary available to me as the hackers do).

Common Passwords

This is also why using a password that is commonly known to hackers, like password1, is so dangerous.

Modern Computing Power

Modern computing power means that hackers can generate hashes for millions of possible passwords and compare each one of those hashes to their stolen password databases in very little time.

Salting the Hash

There is another element of security that is generally applied to this also called salting the hash that would further scramble the hash, but I won't go into that here.

What Does This Mean?

This exposes the fact that passwords based upon natural language words are much weaker since the attacker can use all the words in the dictionary to generate passwords, hash them and check them.

Main Point

However, if your password was not based upon a word, it would be far less likely to be hacked.

This leads us to the fact that you really should create your passwords from some random list of characters and numbers.

For example, no hacker could guess your password is:

bdb7085c1cd90f6cc1f44856131a56535c0e493188dc6919b0ef8e3b7cffaf8d

The hacker is not even going to try that, because it would take her too long to even mess with creating an algorithm that checks an almost infinite list of hashes. There isn't enough computing power in the world to make this effective.

That is why your passwords should themselves be based upon a cryptographically strong hash.

That's what CYaPass does for you.

How Could You Remember Your Password?

It is unlikely that you could remember that hash above. Of course, there are people who can do it. But that would be more of a pain than just using the passwords you already use.

That's why you should use C'Ya Pass and forget all your passwords.

C'Ya Pass Generates Cryptographically Strong Hashes For You

All you have to do is

1. Supply a site/key (to help you remember what the password is used for)
2. Draw a pattern

C'Ya Pass will generate a password for you that is a SHA256 Hash. That long password will be your actual password which will then (most likely) be hashed again by the target site you are logging into.

Then, if the site you are logging into ever gets hacked, it is unfeasible the hacker would be able to generate your original long hash password and be able to hack you.

That's how C'Ya Pass makes your passwords stronger and makes it so you never have to memorize a password again.

CodeProject