A municipal app stores unsalted legacy password hashes. Why does that matter for offline attacks?
Select an answer to reveal the explanation.
Short Explanation
Unsalted legacy hashes are like using the same cheap padlock on every locker—crack one pattern and the rest fall faster. Good storage slows thieves; weak storage hands them a head start. That’s why hash hygiene shows up in real assessments.
Full Explanation
Password storage quality directly influences offline attack cost. Legacy algorithms and absent per-user salts enable precomputation and accelerate recovery of plaintext candidates from a stolen hash set. Modern salted, memory-hard constructions raise attacker effort and reduce bulk compromise impact. Findings should explain this mechanism so developers prioritize migration rather than treating any stored hash as equivalent protection.