Mechanism of Password Hiding in QuizGenerator(beta)
This article introduces how passwords are kept secret in learningBOX.
Password is commonly used for login authentication
Not only e-learning systems, but many other systems that require users to log in use passwords for login authentication. Some systems, such as those used by financial institutions, use authentication systems that do not rely on passwords, such as "one-time password generators" and "authentication by e-mail or SMS for each login," and some of the e-learning systems we provide include handwriting authentication. However, these authentication methods are still not that popular, and learningBOX also uses password-based login authentication.
Password protection is an important issue
There are three types of password leakage points: attacks on user terminals, interception of communications, and attacks on servers.
Attacks on user terminals
Attacks on user terminals include "infection with computer viruses" and "inducement to phishing sites. If a user is infected with a computer virus, there is a risk that his/her password will be stolen when he/she tries to log in to a legitimate site. Even if you are not infected with a computer virus, there is a danger that you will be led by e-mail or other means to a phishing site (fake site), where you will be forced to enter your ID and password.
Communication Interception
Communication interception means that a third party can intercept your password between your computer or smartphone and our server. learningBOX uses SSL technology to encrypt the communication between you and our server, preventing the leakage of your password due to communication interception. This is done through the use of SSL technology.
Attacks on our servers
There are various types of attacks on servers: SQL injection attacks, exploitation of server software vulnerabilities, intrusion of suspicious persons into data centers, fraud at data centers, and various other risks. Therefore, learningBOX makes passwords secret by "salt" and "hashing" them, and then "stretching" them. In this way, even the learningBOX management team cannot know what passwords have been set, let alone an attacker, and thus password leaks are strongly prevented.
Hash
A one-way function. When an input password is passed through a hash function, a seemingly random value is output. This is called the hash value. While it is easy to find the hash value from the original value, it is not possible to compute the original value from the hash value. Therefore, by storing only the hash value, the original password can be kept secret; there were a certain number of systems developed around 2000 that stored md5 or sha1 hashes, but as of 2017, hashing alone is not sufficient to keep passwords secret.
However, by obtaining hash values of all possible passwords in advance and creating a reverse dictionary, it may be possible to guess the original value from the hash value. In particular, passwords with up to 8 alphanumeric digits can be guessed at a realistic cost. In addition, using advanced attacks such as rainbow tables, the time required for guessing may be reduced by an order of magnitude.
Stretch.
Repeat hashing. For example, hashing 1024 times can stretch the time it takes to crack a password by a factor of 1024. Of course, if a computer that is 1024 times faster were built, the password would be cracked in the same amount of time, but by stretching the password appropriately, the time required to crack the password can be dramatically increased.
Salt
Even after hashing and stretching, the same password will have the same value. If multiple passwords are registered with the same hash value, it will be revealed that a "common password" is being used. By adding a salt (random string) before and after the password before hashing, the same password will have different hash values, making it harder to guess the original password. In addition, although not explained in detail, the addition of the salt makes the password longer, making it significantly more difficult to decipher using the rainbow table.
Conclusion
LearningBOX keeps passwords secret by not storing the password itself. In addition, we take all possible measures to prevent people from guessing the original password. However, if you set a "simple" password such as "12345678" or "password," the risk of unauthorized access increases, so please set your password appropriately.
Future Issues
We are considering restrictions that would prevent users from setting "simple" passwords such as "12345678" or "password. We will also incorporate the latest security technologies, such as thorough monitoring for "suspicious" access.
