Passwords, Hashing, MFA and Passkeys: Getting Authentication Right

When security teams investigate breaches, the same starting point appears again and again: someone's username and password. Not a genius hacker breaking encryption — just a reused, guessed or phished password. Fixing authentication fixes a huge share of real-world attacks.

How attackers get passwords

• Credential stuffing — passwords leaked from one site are tried automatically on thousands of others. Reusing a password means one leak opens many doors.
• Phishing — a fake login page that looks exactly like the real one (next lesson).
• Guessing and brute force — common passwords (123456, password@123, your name plus birth year) are tried first.
• Malware — keyloggers and "info-stealers" that copy saved browser passwords, often from pirated software.
• Breached databases — if a website stored passwords badly, a database leak exposes them all.

For users: what actually protects you

1. A unique password for every important account — this alone defeats credential stuffing.
2. A password manager (built into your browser/phone, or a dedicated app) so unique passwords are practical.
3. Long passphrases beat short complex ones: monsoon-chai-hostel-cricket is far stronger than P@ss12 and easier to remember.
4. MFA everywhere it is offered — email, banking, social media, cloud and GitHub first.

For developers: never store passwords, store hashes

A website should never be able to tell you your password — it should not know it. Instead it stores a hash: the output of a one-way function. At login, it hashes what you typed and compares.

• Plain text — a disaster. One leak exposes everyone.
• Encryption — reversible with the key; if the key leaks, so do all passwords. Wrong tool.
• Fast hashes (MD5, SHA-1, plain SHA-256) — attackers can test billions of guesses per second on GPUs. Wrong tool for passwords.
• Slow, salted password hashes (bcrypt, scrypt, Argon2) — the right tool. A salt (random value per user) makes identical passwords produce different hashes and defeats precomputed tables; a work factor makes every guess deliberately slow.

# pip install bcrypt
import bcrypt

def hash_password(plain: str) -> bytes:
    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt(rounds=12))   # salt is generated and stored inside the hash

def check_password(plain: str, stored_hash: bytes) -> bool:
    return bcrypt.checkpw(plain.encode(), stored_hash)                 # constant-time comparison

stored = hash_password("monsoon-chai-hostel-cricket")
print(stored)                                               # b'$2b$12$...' — different every time you run it
print(check_password("monsoon-chai-hostel-cricket", stored)) # True
print(check_password("Monsoon-chai-hostel-cricket", stored)) # False

Other login defences you must build

• Rate limiting and lockouts — slow down repeated failed attempts per account and per IP.
• Generic error messages — "Invalid email or password", not "This email does not exist" (which helps attackers find accounts).
• Secure password reset — single-use, short-lived random tokens sent to the verified email; never email the password itself.
• Check against breached passwords — reject passwords known from leaks, as NIST guidance recommends, instead of forcing odd complexity rules.

Multi-factor authentication (MFA)

MFA requires two or more different kinds of proof:

• Something you know — password, PIN.
• Something you have — phone, security key.
• Something you are — fingerprint, face.

Not all second factors are equal. From weaker to stronger: SMS OTP (can be phished or redirected through SIM swap) → authenticator app codes (TOTP) → push approval with number matching → hardware security keys and passkeys (resistant to phishing). Any MFA is far better than none.

Passkeys: the future of login

Passkeys (built on the FIDO2/WebAuthn standard) replace passwords with a cryptographic key pair. The private key stays on your device and is unlocked with your fingerprint, face or screen lock; the website stores only the public key. There is nothing to type, nothing to reuse, and nothing a fake website can capture — a passkey only works on the real site it was created for. Google, Apple, Microsoft and many apps now support them.