TL;DR

• Never ever store plain text passwords
• Use hashing + salting; not only hashing
• Need to decide on an algorithm?
  Argon2 > Scrypt > BCrypt/PBKDF2 > SHA-3/SHA-2 > SHA1/MD5 > Plain Text

Why Hashing?

• People tend to reuse passwords
• Imagine:
• A person uses the same password on two websites (1)
• Website A stores passwords in plain text. (2)
• => An attacker gets access to database of Website A and gets to know all email/username/password combinations (3)
=> The Attacker can use these credentials to log into Website B (4), even though they use a really strong hashing mechanism (5).

What is Hashing?

• Hashing = one-way function; easy to compute in one direction but computationally infeasible to reverse.
• Same password results in same hash every time
• Important: Hashing != Encryption != Encoding
• Encryption + Encoding: Reversible
• Hashing: Not reversible

Lookup/Rainbow Tables

• Passwords can be precomputed and stored
• Imagine:
• An attacker gets access to hashed passwords
  => Uses the precomputed table to find corresponding password

Hash	Password
24dc65...	LoveMyDog
89ea61...	Hello
32fm88...	LetMeIn

=> Hashing on its own is only a tiny bit better than storing passwords in plain text (also depending on which hashing algorithm is used)

Solution: Salting

• Salt = Random string; added to password before hashing (Secure random, not username etc.)
• Unique salt for every user => Salt needs to be stored in database as well
• => Same passwords do not result in same hash anymore.
• => Precomputed tables would also need to consider all possible salts which would make the tables way too big.
• Already included in
• PBKDF2
• BCrypt
• Note: Salts should ..
• be of length >= 32 bits
• be random + unique
• not be the username/email/etc. of a user!

=> Hashing on its own is only a tiny bit better than storing passwords in plain text (also depending on which hashing algorithm is used)

Even better: Memory-hard hashing

• Most hashing algorithms need only small memory capacity
  => attacks can be parallelized, corresponding password for a hash can be found faster
• Memory-hard hashing algorithms: Use a lot of memory capacity => parallel attacks not possible anymore
• Examples:
• Argon2
• Bcrypt

Hashing algorithms compared

Algorithms	Security	Ease of use
Bcrypt	check_box check_box_outline_blank check_box_outline_blank	check_box check_box check_box
Scrypt	check_box check_box check_box_outline_blank	check_box check_box_outline_blank check_box_outline_blank
Argon2id	check_box check_box check_box	check_box check_box_outline_blank check_box_outline_blank

What is a Password Policy?

Password policies are sets of rules that users are encouraged to apply when they define strong passwords. Many companies require users to compose their passwords in a specific way to help secure them against attacks like bruteforce or dictionary attacks. Password policies can contain rules on the characters that passwords contain, their length, or the duration for which the password will be valid, among other things. Two of the most popular sources on which password policies are most secure and should be applied are NIST and OWASP.

NIST recommendations:
• The password should not repeat the same characters consecutively
• There should be no regular password change required
• The password should be at least 8 characters long, and the maximum length allowed should be no less than 64 characters
• ASCII, space, unicode should all be accepted
• There should be a password-strength meter to help the user create strong passwords




OWASP recommendations:
• The password should not repeat the same characters consecutively
• The password should be at least 8 characters long
• ASCII, space, unicode should all be accepted
• The password should not be a commonly used password, or one that is already present in any leaks
• It should not have any complexity requirements, instead it should be longer

What is Two/Multi Factor Authentication?

Multi factor / Two factor Authentication (MFA/2FA) is a user authentication method which will only grant access to the user if they can provide two (or more) correct authentication factors, for example a password (something they know) and a token (something they own) or a fingerprint (something they are).

Why Two Factor Authentication?

Passwords are very common, but not always the most secure solution. They are many ways for passwords to get compromised - they can be stolen, or forgotten. A second factor adds a second layer of security to protect sensible user data.

How to do Two Factor Authentication?

There are many ways of implementing 2FA. One of the most commonly methods is a software generated time-based one-time passcode, or software token, which the user can generate using for example an app like the Google Authenticator.