Which statement about password hashing is most critical for data breach mitigation?

Hashing is one-way; even if database leaks, plaintext passwords remain unknown. Encryption is reversible and not suitable for password storage.

Why is MD5 hashing (despite being cryptographically broken) worse than bcrypt for password storage?

MD5's speed (millions of hashes/sec on GPUs) enables brute-force attacks. Password hashes must be intentionally slow.

A company stores passwords using MD5 hashes. A database leak occurs with 10 million user records. Which consequence is most likely?

MD5 hashes can be cracked in hours/days via precomputed tables and GPU farms. Speed is the vulnerability, not one-wayness.

In PBKDF2, what does the iteration count parameter control?

PBKDF2 iterations control computational cost; NIST 2023 recommends 310,000+ for SHA-256 to defeat modern brute-force.

NIST recommends 310,000 PBKDF2 iterations (2023). Why does this number increase over time?

Moore's Law increases computational power. Recommendation increases to keep brute-force cost constant (e.g., 100ms per hash).

Which of the following is a limitation of bcrypt?

Bcrypt silently truncates passwords >72 bytes. Mitigation: SHA-256 prehash before bcrypt, or use Argon2id.

A bcrypt cost factor of 12 corresponds to approximately how many iterations?

Bcrypt cost is an exponent; cost 12 = 2^12 = 4,096 iterations, resulting in ~300ms per hash.

Why is Argon2id considered superior to PBKDF2 against modern attacks?

Argon2id is memory-hard; GPUs have limited bandwidth, making parallel attacks impractical. PBKDF2 is CPU-bound only.

OWASP recommends Argon2 memory cost m=65536 (64 MB). What is the primary security benefit?

Memory-hard design bottlenecks GPU/ASIC attacks. Attackers need proportional RAM, drastically increasing cost.

You're migrating from bcrypt (cost 12) to Argon2id. Which tuning matches security level?

OWASP recommends m=65536 minimum, t=3 for user passwords, p=4 for parallelism; balances security and latency.

The HIBP API is queried with hash prefix 'CBFDA'. What does the returned list contain?

HIBP returns all hashes with matching prefix (~1M results); client checks locally if their exact hash is present.

Why is HIBP's 5-character prefix approach better than sending the full 40-character SHA-1 hash?

k-Anonymity with 5-char prefix (16^5 = 1M combinations) makes individual password indistinguishable from millions.

A password's SHA-1 hash is '5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8'. What is sent to HIBP API?

First 5 characters '5BAA6' are sent; HIBP returns all hashes with that prefix for client-side matching.

HIBP API returns a list of hash suffixes (35 chars) and counts. What does the count represent?

Count indicates breach frequency; e.g., 'password' found 9.6M+ times across different leaks.

You implement local caching of HIBP data for 100K most common breached passwords. What risk increases?

Cached breach list is local attack surface; if exposed, reveals app's security assumptions. Mitigate via access controls.

Why can't you use HIBP data to recover plaintext passwords from leaked hashes?

HIBP provides hashes and breach counts. Without reversing SHA-1 (computationally infeasible), plaintext is unknown.

NIST 800-63B recommends against mandatory password complexity rules. What is the primary reason?

Research shows complexity rules lead to predictable patterns. Length-focused approach (8+ chars) is more effective.

What is NIST's stance on forcing password changes every 90 days?

Forced expiration causes weak incremental changes (Password1→Password2). Change only on compromise or user request.

NIST recommends checking new passwords against breached password lists. Which sources are recommended?

NIST recommends checking against common, context-specific, and breach databases. HIBP is de facto standard.

NIST says to allow all printable ASCII and Unicode characters, including spaces. Which password becomes possible?

NIST removes complexity rules and length limits (accepting 64+ chars), enabling passphrases and emoji.

Why does NIST recommend allowing paste in password fields?

Disabling paste prevents password manager integration, forcing users to weaker memorized passwords.

A company currently enforces 'Must contain: uppercase, digit, symbol, 90-day expiration.' Which NIST principle does this violate?

NIST explicitly advises against complexity rules and mandatory expiration as counterproductive to security.

After 5 failed login attempts, an account is locked for 15 minutes. What is the main security benefit?

Lockout limits brute-force attempts. Attacker trying millions of passwords is blocked after 5 attempts × 15 min.

What is a major drawback of account lockout as a brute-force defense?

Account lockout is vulnerable to DoS; attacker floods service with wrong password attempts for target accounts.

What is progressive delay (exponential backoff) for login attempts?

Progressive delay adds exponential wait between attempts (2^(n-2) capped at 32s) throttling without lockout.

Attack comparison: Account Lockout vs. Progressive Delay. Which statement is true?

Lockout = strong protection but DoS risk. Delay = good protection with lower DoS risk; often both are combined.

How many seconds should an attacker wait after 5 failed attempts with progressive delay (formula: 2^(n-2), max 32s)?

5 failed attempts: 2^(5-2) = 2^3 = 8 seconds. At attempt 6, 2^4 = 16s. At 7+, capped at 32s.

A user mistypes their password 5 times. With account lockout (15 min), they must wait to retry. What's the impact?

Lockout causes support tickets; progressive delay allows retry immediately with small wait, better UX.

In a password validation system, why is hashing assigned to a separate service rather than inline?

Argon2 with m=65536 takes 100s+ on modern hardware. Separate service + queue prevents blocking login flow.

A password validator checks against HIBP via API. Rate limit is 100 requests/hour. How to scale?

Local Redis cache of 100K common breaches + HIBP responses reduces API calls while maintaining security.

Multiple API servers call the same password validator service. Which synchronization issue could occur?

Lockout/delay state must be atomic across servers. Redis with INCR and Lua scripts prevent race conditions.

What is the primary bottleneck in a password validation pipeline (Argon2id with m=65536)?

Argon2id is CPU/memory-bound (~100s worst case). Network latency and database queries are secondary.

In a distributed system, failed password hashing requests queue for retry. How should this be handled?

Async queue with DLQ allows retry logic; failed validations go to DLQ for investigation without blocking user.

Password Security — System Design Concept

📚Password SecurityPro

8 sections

~29 min total

33 quick quizzes

3 SD challenges linked

0 of 8 done·~28 min left

Concepts›Password Security›What is Password Security?

0 / 8

8 sections~29 min

What is Password Security?

Comprehensive guide to secure password handling, hashing, breach detection, and system design

Read

~4 min

⋯

Why Password Hashing Matters

Plain-text passwords enable instant account compromise; intentionally slow hashes prevent brute-force attacks.

ReadQuiz

~4 min

⋯

PBKDF2, bcrypt, Argon2id: Work Factors and Hashing

Three modern algorithms with tunable computational cost; Argon2id memory-hard design resists GPU/ASIC attacks best.

ReadQuizCode

~4 min

⋯

HaveIBeenPwned k-Anonymity API

Check if passwords exist in breach databases by sending only 5-char SHA-1 prefix, preserving user privacy.

ReadQuizCode

~4 min

⋯

NIST 800-63B: Password Guidelines

Modern password policy rejecting complexity rules and expiration; emphasizing length, breach checking, and paste support.

ReadQuizCode

~4 min

⋯

Account Lockout and Progressive Delay

Two complementary defenses: temporary account disabling after N failures or exponential backoff delays on attempts.

ReadQuizCode

~4 min

⋯

Password Validation System — System Design

Multi-service architecture combining NIST validation, breach checking, hashing, and rate limiting at scale.

ReadQuiz

~4 min

⋯

Practice test

33 questions

~11 min

🔒

Pro content

Password Security is a Pro concept. Upgrade to access full content, practice questions, and design challenges.

Upgrade to Pro →

Notes

🔍

Loading…