Abstract or Summary:
Password storage is one of the major weaknesses of the last five years. Databases are dumped on a regular basis, and due to poor password storage algorithms, attackers have an incredibly easy time extracting the actual passwords from these dumps.

This talk dives into the techniques used by the open source Cryptohaze password cracking framework to dramatically reduce the work the attacker has to do to recover plains, even with salted algorithms. It discusses the most commonly-seen algorithms for password storage, and how the attacks against these are heavily optimized -- in some cases, only half the work the defender must do!

Proper password storage concepts are then discussed -- not from the perspective of "You should do this because it's better," but from the perspective of the hardware attackers use and how to neutralize their advantage and make their cost per password exceed the defenders cost.

PasswordResearch.com Note: Video of presentation: https://www.youtube.com/watch?v=bZnNz4arxLg