Have you ever wondered how password cracking works? And why it causes so much of a furore when a web site is discovered to have had its password file hacked into and stolen? If so, then here's how it work.
When you choose a password to use on a web site, the site needs to store that password in a database so that it can recognise you when you subsequently log in. Although some sites do simply store the password itself, this is clearly a security risk. Therefore, sites tend to store a hash instead. A hash is the result of putting the password through a special mathematical formula which only works in one direction. For example, put "kumarinfocity" through the MD5 hash formula and it comes out as akdr01gh20hyu8trfg5wscfr58hy3kli1hg7.
The clever bit is that hashing only works in one direction. There's no way to start with that hash and work out what password it corresponds to. So when you log into the web site, and type "TechSupportAlert" as your password, the site hashes it again, and checks whether the hashed version of what you just typed matches the hash in the database. If so, you are safe to enter.
So how does password cracking work? And why do experts advise you to never choose a password that appears in a dictionary?
Well, imagine that I hack into a website and steal its database of usernames and hashed passwords. And then imagine that I search that database of hashes for akdr01gh20hyu8trfg5wscfr58hy3kli1hg7. If I find a match, then I know that this particular user has chosen TechSupportAlert as their password.
And so to the article that explains it all in more detail, and is a diary of one person's attempt to try cracking some passwords. You'll find it at http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/1/. Once you've read it, you'll realise why choosing a strong, long, non-dictionary password makes sense. Especially on important web sites such as online banks and PayPal. If you don't, you'll now understand the risks much more clearly.
