4.4 Password Security

Why Passwords Are Weak Points

Passwords are a common authentication method but are often the weakest link in security. Users pick weak, reused, or predictable passwords. Attackers exploit this through brute-force attacks (trying all combinations), dictionary attacks (trying common words), and social engineering to guess or steal credentials, gaining unauthorized access to systems.

Building Strong Passwords

A strong password has length, complexity, and unpredictability — mixing uppercase, lowercase, numbers, and symbols while avoiding personal info or dictionary words. Passphrases (multiple random words) are easier to remember yet hard to crack. Unique passwords per account prevent one breach from compromising multiple accounts.

Protecting Passwords in Storage & Use

Systems should never store passwords in plaintext. Instead, they use hashing (one-way transformation) often combined with salting (adding random data) to prevent attacks like rainbow table lookups. Multi-factor authentication (MFA) and password managers further reduce risk by adding extra verification and generating/storing strong unique passwords securely.

Key terms

Brute-force attack

Trying every possible character combination until the correct password is discovered.

Dictionary attack

Guessing passwords using a list of common words, phrases, or known leaked passwords.

Hashing

A one-way function converting a password into a fixed value, used for secure storage instead of plaintext.

Salting

Adding random data to a password before hashing so identical passwords produce different hashes, defeating rainbow tables.

Multi-factor authentication (MFA)

Requiring an extra verification step beyond a password, such as a code or biometric, to confirm identity.

Try an AP-style question

Which is harder to brute-force?

1. Password B
2. Password A
3. Neither can be cracked
4. They're equal