Password Security Quiz: Hashing and Salting for High School Cybersecurity

🔐 Quick Study Guide: Hashing and Salting

• ➡️ Hashing Explained: Hashing is a one-way mathematical process that transforms any input data (like your password) into a fixed-size string of characters, called a 'hash' or 'digest'.
• 🛡️ Purpose of Hashing: Instead of storing your actual password, websites store its hash. If a database is breached, attackers only get the hashes, not the original passwords. Since hashing is one-way, it's extremely difficult to reverse a hash to find the original password.
• ✨ Key Properties of a Good Hash Function:
  • ⚡ One-Way: Irreversible.
  • 📏 Fixed Output Size: Always produces a hash of the same length, regardless of input size.
  • UNIQUE Deterministic: The same input always produces the same output.
  • 🔍 Collision Resistance: Extremely difficult to find two different inputs that produce the same hash output.
• 🧂 Salting Explained: A 'salt' is a unique, random string of data added to a password before it is hashed. Each user typically gets a unique salt.
• 🔑 Purpose of Salting: Salting prevents 'rainbow table attacks' and makes 'brute-force attacks' much harder. Without a salt, identical passwords would produce identical hashes, making them vulnerable. With a salt, even two users with the same password will have different hashes, as their unique salts are included in the hashing process.
• 🧠 How it Works Together: When you create an account, your password is combined with a unique salt (e.g., `password + salt`) and then hashed. The resulting hash and the salt (usually stored in plain text alongside the hash) are saved. When you log in, your entered password is combined with the stored salt, hashed, and compared to the stored hash.
• ✅ Enhanced Security: Hashing protects against direct password theft, while salting protects against pre-computed attacks (like rainbow tables) and makes individual password cracking more computationally intensive.

🧠 Practice Quiz

1. What is the primary purpose of 'hashing' a password before storing it in a database?
A. To encrypt the password so it can be decrypted later.
B. To make the password shorter and easier to store.
C. To transform the password into an irreversible, fixed-size string for security.
D. To allow users to recover their forgotten passwords easily.

2. Which of the following best describes a 'salt' in the context of password security?
A. A type of encryption algorithm used to hide passwords.
B. A unique, random string added to a password before hashing it.
C. A secret key known only to the user for password verification.
D. A method to compress password data for faster retrieval.

3. A major security threat that 'salting' helps to prevent is:
A. Phishing attacks.
B. Denial-of-Service (DoS) attacks.
C. Rainbow table attacks.
D. SQL injection attacks.

4. If two different users choose the exact same password, how does salting improve security?
A. It makes their passwords appear different to the users.
B. It ensures that their respective hashes will be different.
C. It encrypts the passwords before they are stored.
D. It prevents them from choosing common passwords.

5. Which property is crucial for a strong hash function used in password security?
A. It must be easily reversible to retrieve the original password.
B. It must produce a variable-length output based on the input.
C. It must be deterministic, always producing the same output for the same input.
D. It must allow for fast decryption of the hash.

6. When a user logs in, how does a system typically verify their password when hashing and salting are used?
A. It decrypts the stored hash and compares it to the entered password.
B. It hashes the entered password directly and compares it to the stored hash.
C. It combines the entered password with the stored salt, hashes it, and compares the result to the stored hash.
D. It asks the user for a secret question to confirm their identity.

7. What would be a potential vulnerability if a website only used hashing without salting for password storage?
A. It would be impossible to log in to the website.
B. The website would be prone to cross-site scripting (XSS) attacks.
C. Attackers could easily identify users with identical passwords by comparing hashes.
D. The hashing process would take too long, slowing down login times.