A credential is information a user supplies to gain access to an account. In common web logins, it means a username and password. Because an account can enable fraud, scams, identity theft, or access to private activity, credentials are valuable targets and must be protected as carefully as the account itself. section 8.0 section 8.1
An attacker can attempt to steal credentials by guessing username-and-password combinations until one succeeds. This brute-force approach becomes practical when it uses username and password lists leaked elsewhere, because people often reuse the same login details across sites. A username and password alone therefore provides a weak boundary against credential-guessing attacks. section 8.1
Handle credentials as security-sensitive data throughout their lifecycle:
- Never store passwords as plain text. Store a hash instead, so a database leak does not immediately reveal the original passwords. section 3.8
- Treat a database exposure as a credential risk, including exposures caused by insecure backups or database access details committed to source control. section 3.8
- When credentials may have been stolen, clearly tell users what was exposed, what an attacker might access, and what action users should take. section 15.5
- Force password rotation when there is even a small chance that credentials were stolen. section 15.5
Why password hashes change the breach scenario
If a leaked database contains usernames and plain-text passwords, an attacker can log in as users and try the same credentials on other sites. If it contains password hashes instead, the attacker cannot easily recover the original password; the application can verify a later login by hashing the entered password and comparing it with the stored hash. section 3.8
require 'bcrypt' include BCrypt::Engine password = "my_topsecretpassword" salt = generate_salt hash = hash_secret(password, salt) #1 password_to_check = "topsecretpassword" if hash_secret(password, salt) == hashed_password #2 puts "Password is correct!" else puts "Password is incorrect." end
The Ruby bcrypt listing illustrates generating a salt, hashing a password for storage, and checking a later password by hashing it again for comparison. section 3.8
