4.2 Authentication

Authentication is how a system answers one simple question: "Are you actually who you say you are?" Every time you log into Instagram, unlock your phone with your face, or type a PIN at an ATM, you're going through some kind of authentication. This topic digs into how passwords are stored securely (spoiler: not as plain text), how attackers try to crack them, the different types of "proof" you can use to identify yourself, and the settings admins tweak to make logins way harder to break.

Why Passwords Are Stored as Hashes

Imagine a company saves every user's password in a giant spreadsheet that just says username: password. If a hacker steals that file, game over. Every single account is exposed instantly. That's why no decent system stores passwords in plaintext. Instead, they store hashes.

What a Hash Actually Is

A cryptographic hash function (also called a message digest function) is a math algorithm that takes any input (a word, a file, a whole movie) and spits out a fixed-length string of bits called the hash, checksum, or message digest. The input can be any size. The output is always the same length for a given function.

Some well-known hash functions you should recognize:

• MD5
• SHA-1, SHA-256, SHA-512 (SHA stands for Secure Hash Algorithm)
• NTHash
• RIPEMD-160

For example, running the word password through SHA-256 always gives you the same 256-bit output. Run Password (capital P) and you get something totally different. Even one tiny change flips the whole hash.

The Four Properties of a Good Hash

A solid cryptographic hash has four key properties:

• Collision resistant: It's hard to find two different inputs that produce the same hash.
• Pre-image resistant: Given a hash, you can't reasonably figure out the original input. Hashes are one way.
• Repeatable: The same input always produces the same hash. (This is what makes password checks work.)
• Fixed length: No matter how big the input, the hash is always the same length for that function. SHA-256 always gives you 256 bits.

Collisions and Why MD5 Got Killed

An n-bit hash has $2^n$ possible outputs. Since there are infinite possible inputs but a limited number of outputs, two different inputs will eventually produce the same hash. That's called a collision.

A good hash function makes collisions super hard to find on purpose. But if researchers figure out an efficient way to force collisions, that hash function is deprecated, meaning it's no longer considered safe. MD5 and SHA-1 are both deprecated for this reason. You'll still see them around, but nobody should be using them to protect new systems.

How Hashed Password Login Works

Here's the flow when you log in:

1. You type your password into the login box.
2. The system runs your password through the hash function.
3. It compares the new hash to the hash stored in the user database.
4. If the hashes match, you're authenticated. If not, access denied.

The system never has to store your actual password. Even an admin looking at the database just sees a string of random-looking characters.

Salt: Why Two Users with the Same Password Get Different Hashes

There's still a problem. If two users both pick password123, their stored hashes would be identical. An attacker who sees matching hashes in the database knows those users share a password. They could also pre-compute hashes for common passwords and instantly spot matches.

The fix is salt: a few random bits added to each user's password before hashing. Every user has their own unique salt, so even if two people pick the exact same password, their stored hashes look completely different. Salt also makes pre-computed attack tables (we'll get to those in a sec) way less useful.

How Password Attacks Work

If an attacker steals a legitimate user's password, and that account doesn't have MFA or other protections, the attacker gets to act with all the same access and rights as the real user. That could mean reading emails, transferring money, or pivoting deeper into a network. So how do attackers actually get passwords?

Online vs Offline Attacks

Password attacks split into two big categories:

• Online password attacks: The attacker tries username and password combos against a live login portal (like the actual login page of a website). These are slower and noisier because the system can detect failed logins, lock accounts, or rate-limit.
• Offline password attacks: The attacker has already stolen a user:password database (the hashes) and runs attacks against it on their own computer. No lockout protections apply here because they're not touching the real login system anymore.

Common Online Attacks

Credential reuse attacks are super common. People reuse passwords across sites all the time, even though they shouldn't. When one company gets breached and their user database leaks online, attackers grab those leaked credentials and try them on other sites. If you used the same password on a random forum and your bank, you're in trouble.

Password spraying is when an attacker takes one common password (like Summer2024!) and tries it against tons of different accounts. Because they only try one or two passwords per account, they avoid triggering lockouts.

Credential stuffing is when an attacker uses default credentials or stolen credentials to try to break into services or devices. This works scary well on things like switches, routers, and IoT devices that ship with default admin passwords like admin:admin that people never change.

Offline Attacks: Cracking Stolen Hashes

Once an attacker has a captured hash, they can't reverse it (remember, hashes are pre-image resistant). But they can guess. Automated hash-cracking tools hash tons of potential passwords and compare each output to the target hash. If they find a match, they know the password that generated it.

• Brute force attack: The tool tries every possible password combo: aaaa, aaab, aaac, and so on. Guaranteed to work eventually, but takes forever for long, complex passwords.
• Dictionary attack: The tool tries a list of common passwords (password, qwerty, letmein, iloveyou) plus variations. Way faster than brute force if the user picked something predictable.

Rainbow Tables

A rainbow table attack uses a precomputed rainbow table, which is basically a giant lookup table. Each row contains a potential password and its hash, sorted by hash value. The attacker takes the captured hash and searches the table for a match. If they find one, they instantly know a password that produces that hash.

Rainbow tables save time because the attacker doesn't have to recompute hashes during the attack. They did all that work ahead of time. This is exactly why salt matters so much: salted hashes break rainbow tables, because the attacker would need a separate rainbow table for every possible salt value.

Types of Authentication Factors

Authentication mechanisms are the technical controls that verify a user's identity. The actual proof a user provides is called a factor. There are four main types.

Knowledge Factor (Something You Know)

A knowledge factor is information only the user should know: passwords, PINs, or answers to challenge questions like "What was the name of your first pet?"

The tradeoff here is annoying: a password that's hard for an attacker to guess is often hard for the user to remember. Tr0ub4dor&3 is way more secure than fluffy, but you're more likely to forget it.

Possession Factor (Something You Have)

A possession factor is a physical object unique to the user. Examples:

• An access card to enter a building
• A debit/credit card
• A cell phone (used to receive a text code or run an authenticator app)
• A hardware authentication token like a YubiKey

The harder it is to steal or copy the object, the better. A hardware token that can't be cloned is more secure than a text message code (which can be intercepted via SIM swapping).

Biometric Factor (Something You Are)

A biometric factor measures part of your body. Common examples:

• Fingerprints
• Palm prints
• Facial recognition (like Face ID)
• Iris or retina scans
• Voice identification

These are tough to duplicate because they're unique to you. Downside: if your fingerprint data gets leaked, you can't exactly change your fingerprints.

Location Factor (Somewhere You Are)

A location factor uses things like Wi-Fi signals, GPS data, time zone settings, or IP address info to figure out where you are. A bank might block a login attempt from a country you've never visited, or a company might only allow logins from inside the office network.

Multifactor Authentication

Multifactor authentication (MFA) means using more than one factor type to authenticate. Logging into your school account with a password (knowledge) and then approving a push notification on your phone (possession) is MFA.

This is way more secure than single-factor authentication because an attacker would need to compromise two different things at once. Stealing your password isn't enough if they also need your physical phone.

Quick clarification: two passwords is not MFA. That's just two knowledge factors. Real MFA combines different types of factors.

Configuring Secure Login Settings

Admins can configure login policies to make systems way harder to crack. Here are the main settings you should know.

Password Complexity

Requiring complexity means new passwords must include characters from multiple character sets:

• Uppercase letters (A through Z)
• Lowercase letters (a through z)
• Numeric digits (0 through 9)
• Special characters like !, @, #, $, %, &, *

A password drawn from all four sets is dramatically harder to crack than one using only lowercase letters. password is trivial. P@ssw0rd! is still bad but at least takes longer.

Minimum Password Length

Setting a minimum password length forces users to pick passwords of at least a certain number of characters. Length matters a lot for cracking time. Each extra character multiplies the number of possible combinations an attacker would have to test. A 12-character password takes way longer to brute force than an 8-character one.

Maximum Password Age

A maximum password age policy makes users change their password every X days, usually 90 or 120. The idea is that if a password was secretly compromised, regular changes limit how long an attacker has access.

There's a catch though. Some modern standards actually recommend against forced rotation, because users tend to develop predictable patterns like PasswordFall2024, PasswordWinter2024, PasswordSpring2025. An attacker who knows the pattern can guess the new password easily.

Password History

Systems can also be configured to store a certain number of previous password hashes (commonly the last 5 to 10). This prevents users from just recycling the same password every time they're forced to change it. If you try to set your password back to one of your old ones, the system says no.

Lockout Period

Setting a lockout period locks an account after a certain number of failed login attempts, often 3 to 5. The account stays locked for some amount of time (a few minutes, an hour, or until an admin unlocks it).

This stops online brute force and password spraying cold. An attacker can't just sit there guessing forever because after a handful of wrong guesses, the door slams shut. Note that lockout doesn't help against offline attacks, since those don't touch the live login system at all. That's why hashing, salting, and strong passwords still matter even with good lockout policies in place.