Cracking The Code: How Salt & Pepper Secure Passwords

Have you ever wondered how your favourite websites and “Apps” store your passwords? Sure, they all tell you that they handle your passwords “securely”. But what does this mean? And how secure are your passwords really?

These are the questions that I will be trying to answer in this essay, in addition to explaining the technicalities of handling passwords.

If you are wondering what set me on this journey, it has to do with a new web software application that I have been developing recently.

For this piece of software, I had to learn and implement user authentication and security from scratch. Naturally, I am no where near being an expert on this topic.

But I thought my level of knowledge would at least help the typical user understand what is going on beneath the curtain of password security.

Let me start by answering a very important question:

“How do websites and online services store your passwords?”

Well, the answer to that question is that they don’t! But how can these services verify that you entered your passwords correctly without storing them? Well, therein lies the cornerstone of password security: encryption. Let us begin there.

This essay is supported by Generatebg

How Does Password Encryption Work?

Think of password encryption as the process of transforming your text-based password input into a secret language, ideally known only to you and your local device.

The resulting output is known in the biz as ‘hash’ (no, not what you are thinking).

The ‘secret language’ that I just mentioned is nothing but a seemingly random output created by something known as a hashing algorithm.

Modern hashing algorithms are considered one-way operations. In other words, converting the password to the hash is relatively easy, but working out the hash from the password is nearly impossible.

This is simply the nature of these algorithms, given current computing capabilities.

Your device then sends this hash over to your service provider for storage/verification. Let us say that some bad actors get their hands on this hash. Won’t they be able to send that hash over to your service provider and impersonate you?

Well, that would not work. Here’s why. Your service provider does not check an incoming hash directly against their stored hash. Instead, they take the input you send them and run it through the same hashing algorithm to verify if they get the same stored hash.

This is another feature of the hashing algorithm. It produces the same output for the same input, even though the output seems random.

In other words, for bad actors to impersonate you, they would need to know your password. But your password never gets stored anywhere other than (ideally) your head.

But in reality, things are not so straight forward. Hackers are a clever bunch.

Passwords Are Not Always Unique

Human beings are more alike than they are different. This feature (not a bug) leads to statistical regularities. It just happens so, that many people, for some reason, think that some particular passwords are safe.

We are talking about many unrelated people using the same password here. For a hacker, this is a dream scenario.

All he or she has to do is to figure out what hashing algorithm your service provider is using, and that gives him or her the potential to impersonate.

There exist huge lists of these statistically regular passwords on the dark web. They are known in the biz are ‘Rainbow Tables’. Hackers typically run these lists through the hashing function to generate the corresponding hashes.

Good service providers are on top of these typical rainbow table (or dictionary) attacks though. They intentionally slow down their algorithms by imposing computational difficulty.

This would not bother a stand-alone user trying to log in. But when hackers try to generate hashes for a huge table, it would take decades.

But we cannot call that air-tight security, can we? There are more nuanced solutions we can implement with handling the passwords themselves. This is where Salt and Pepper come in.

---

A Dash of Salt to Secure Your Passwords

In the realm of password security, Salt is a random string of characters in combination with your password.

Your online service provider comes up with this random string and tags it along with your password before it is encrypted.

All of a sudden, not only does a potential hacker need to know your password to impersonate you, but he or she also needs to know the Salt.

There is an added benefit to Salting as well. The Salt ensures that even if two users have the same password, the stored encrypted versions will be completely different. This is another feature of the hashing function.

It typically outputs completely different strings for minor changes in input. So, in essence, the added Salt performs the following two functions:

1. It adds an extra layer of security to the encrypted password.

2. It ensures that even if two passwords are the same, their hashes are unique to the respective users.

A Pinch of Pepper to Spice Up Password Security

While Salt is a random string of characters, Pepper is a unique string of characters that acts like a master key. It is shared across all accounts, but (ideally) only one authority has access to it: your online service provider.

Typically, the Pepper is stored very securely as some encrypted environment variable at your service provider’s side.

Once you enter your password, the system adds the Salt, and then the Pepper to it before encryption (hash generation).

Each time you log in, this entire process is repeated to ensure that it is really you who is trying to log in. This is computationally intensive, but it is also the price of password security.

Current password security systems are indeed marvellous. But alas! They are not airtight. There are several ways in which hackers still gain access to your accounts.

---

Advanced Hacking Shatters Password Security

If you think about it, there is an easy access point for a password. This is when you type your password in.

Hackers develop scripts that run in the background on your device that record your key strokes, etc. This is known as client-side password interception.

And then there is social engineering, where bad actors try to coerce information from you by faking authority (pretending to be your service provider, for instance), and steal your password.

Another route that hackers take is to skip passwords completely, and go directly for the database at your service provider’s side. If your service provider uses weak security for the database’s side of things, this leaves them vulnerable.

All in all, there are several ways in which hackers can still get their hands your password/account information. So, what can we do about it? Before I get to that, let me summarise what we have covered thus far.

Summary and Optimal Security Practices

In short, password security revolves around these three concepts:

1. Encryption: This involves hashing algorithms that convert text input to encrypted hash output.

2. Salt: Your service provider adds a random string of characters (Salt) to your password input before encryption. This ensures that even if your password is the same as someone else’s password, your hashes are still unique.

3. Pepper: Your service provider adds a master key string (Pepper) to all passwords after Salting and before encryption. This just adds an extra layer of password security.

The harsh reality is that even beyond these measures, your passwords are not necessarily safe. Here are 3 steps you can take to minimise (unfortunately, not eliminate) the risk of password breach/compromise:

1. Use complex passwords and employ multi-factor authentication. It makes the task of logging in a pain, but improves security significantly.

2. Make sure that your device and software are updated (up to date). Hackers usually take advantage of people using outdated systems that lack security measures. This is what enables them to run scripts that track your keystrokes, etc.

3. Choose your online service provider wisely. I know. This is like a lucky draw; even the best of service providers can be hacked. But with the sheer number of ‘low-code’, ‘no-code’, and non-technical startups offering technical solutions these days, I suggest paying attention to technical reputation and experience.

Now, it is time to wrap up. I hope that you gained a finer understanding of how password security works from this essay, and wish you a safe and secure online experience!

---

If you’d like to get notified when interesting content gets published here, consider subscribing.

Further reading that might interest you: 

• How To Bear Responsibility For Artificial Intelligence?
• 5 Reasons Why Cookies Are Everywhere On The Internet.
• How To Understand Computational Irreducibility.

If you would like to support me as an author, consider contributing on Patreon.