Password Storage: Math, Probability, and Complexity
Password cracking has become a storied element of information security testing, from the days of utilities such as Cain and Abel to more modern tools such as hashcat. While the tools and techniques have changed over the years, the principles behind password cracking remain largely unchanged.
Password cracking can involve many use cases, from recovering access to a system after the user has left a company to penetration testing and red team use cases, where we use password cracking to prove (or disprove) the security of our access control mechanisms.
In this chapter, we’re going to cover the following main topics:
- What is password cracking?
- How are passwords stored and used?
- Why are some passwords easier to crack than others?
