7.1 Why Passwords Fail and How Attackers Attack Them
Storage Is Where the Failure Begins
Hashing and encryption are not the same operation. Encryption is reversible with a key, so an encrypted password store is one stolen key away from plaintext. A hash is one-way, but — and this is the part sites get wrong — a fast unsalted hash such as MD5 or NTLM is trivially reversed by brute force on consumer GPUs that try on the order of ten billion guesses per second. Correct storage uses a salted, memory-hard key derivation function like Argon2id, bcrypt, or scrypt, tuned so one guess costs hundreds of milliseconds and tens of megabytes. Every downstream attack on this page becomes dramatically harder or dramatically easier depending only on that server-side choice.
Offline Cracking: Wordlists Plus Rules
When a hash database leaks, the attacker downloads it and works offline, unconstrained by lockouts or rate limits. The starting point is a corpus like rockyou — hundreds of millions of real leaked passwords — expanded by a rule engine: capitalize, append the year, substitute a->@, double the word. One base word with a typical rule set yields tens of thousands of candidates. At GPU speeds, an entire 8-character lowercase keyspace (2^40) falls in hours, which is why composition rules and 8-character minimums are theater against an offline cracker.
Online Attacks: Spraying and Stuffing
Against live login endpoints, attackers switch shape. Password spraying takes a handful of likely passwords — Companyname2026!, seasonal strings, top-100 leaks — and tries one password against every account, one attempt per user per day, staying permanently below the five-strikes lockout threshold. Credential stuffing flips it: billions of (email, password) pairs from past breaches are replayed against each service, one attempt per pair, throttled to roughly one try per hour per account behind rotating residential proxies. Neither attack ever “guesses” in the movie sense; both simply look up what humans already typed somewhere else.
The Reuse Multiplier
All of this converges because one email address and one password sit behind dozens of accounts. A breached hobby forum hands the attacker the key to the mailbox, and the mailbox is the password-reset vault for everything else — a cascade called account takeover. The defenses are mechanical, not clever: a unique credential per site, a strong server-side hash, and a second factor that is bound to the service rather than to the phone number.
Architecture Diagram
Key Takeaways
- Hashing is not encryption: only salted, memory-hard hashes (Argon2id, bcrypt) survive a database leak.
- Offline cracking ignores lockouts entirely; GPUs test billions of rule-mutated guesses per second.
- Spraying tries a few common passwords against many accounts, one try per account, to evade lockout thresholds.
- Credential stuffing replays known leaked pairs once per account — it only works because humans reuse.
- Email is the pivot: it controls resets for everything else, so breach alerts on it deserve the fastest response.