Weak Cryptography (Hashing)

When your "encryption" is actually just a speed bump.

The idea

A cryptographic hash function takes an input (like a password) and turns it into a fixed-length string of gibberish. Good hashing algorithms are designed to be irreversible and slow. Weak hashing algorithms (like MD5 or SHA1) are fast and have known cryptographic vulnerabilities, making them trivial for modern hardware to crack.

If your database is breached, the difference between using MD5 and using Argon2 is the difference between attackers instantly knowing everyone's password versus needing millions of years to crack them.

How it works (Key Derivation Functions)

Never use general-purpose hash functions (like MD5, SHA-1, or even SHA-256) for passwords. You must use a Key Derivation Function (KDF) that is explicitly designed for passwords. KDFs like `bcrypt`, `Argon2`, or `scrypt` incorporate a random "salt" and an adjustable "work factor" to intentionally slow down the hashing process.

# VULNERABLE: MD5 is broken and incredibly fast.
import hashlib

def hash_password(password):
    # DANGER: A single modern GPU can guess 100 billion MD5 hashes per second.
    return hashlib.md5(password.encode()).hexdigest()


# SECURE: Bcrypt (with salt and work factor)
import bcrypt

def hash_password(password):
    # Secure: Generates a random salt and applies 2^12 rounds of hashing.
    # A GPU can only guess a few hundred of these per second.
    salt = bcrypt.gensalt(rounds=12)
    return bcrypt.hashpw(password.encode(), salt)

Watch out for

• Rainbow Tables: If you don't use a unique "salt" for every single user, attackers can pre-compute the hashes for every dictionary word. If two users have the password "password123", their hashes will look identical, instantly giving away the secret.
• Custom Cryptography: Never try to invent your own hashing algorithm by combining multiple hashes (e.g., `md5(sha1(password + salt))`). Always use standard, vetted libraries like `bcrypt`.
• Lack of Iterations: Even a good KDF like PBKDF2 is useless if you set the iterations to `1`. The standard is usually 300,000+ iterations.

Worked example

In 2012, LinkedIn was breached, and 6.5 million password hashes were stolen. Because LinkedIn was using raw SHA-1 without any salt, hackers were able to run the hashes against massive lists of common passwords. Within a few days, over 90% of the passwords were cracked and published online, forcing a massive password reset.

Check yourself

Why is it considered a security feature for a password hashing algorithm (like bcrypt) to be intentionally slow?