Ravi Sir's Cyber Security Cards › Revision Cards
Defending Against Password Attacks
Defending Against Password Attacks Simple controls that stop almost all password attacks. Strong, unique passwords. Slow hashing with salt. MFA (a second factor). Account lockout after failed tries. Most real breaches use a weak, reused or leaked password, not a clever exploit. These controls stop t
Read card text
What this card says
What it is
Simple controls that stop almost all password attacks.
Main defences
Strong, unique passwords. Slow hashing with salt. MFA (a second factor). Account lockout after failed tries.
Why it matters for security
Most real breaches use a weak, reused or leaked password, not a clever exploit.
These controls stop the attacks in this chapter at almost no cost.
| Defence | What it stops | How (from earlier chapters) |
|---|---|---|
| Slow, salted hashing (bcrypt/Argon2) | Offline cracking | password_hash() in PHP; never md5/sha1 |
| Strong password policy | Weak, guessable passwords | Length over complexity; check against leaked lists |
| Account lockout / rate limiting | Online guessing (Hydra) | Lock after N failures; fail2ban for SSH |
| Multi-factor authentication (MFA) | Stolen or cracked passwords | OTP/app on logins; AWS MFA (Chapter 25) |
| Key-only SSH | SSH password attacks | Disable PasswordAuthentication (Chapter 4, hardening in 28) |
Learn more in the lesson: 22.6 Defending Against Password Attacks