Password Security, Hashing Algorithms, and Credential Stuffing Defense
Why MD5 and SHA-256 are dangerous for passwords, how modern KDFs like Argon2 protect credentials, and how to stop automated stuffing.
1. The Fatal Flaw of Fast Hashes
A common developer mistake is storing passwords using SHA-256. SHA-256 is an excellent algorithm for file integrity verification, but it was specifically engineered to be computationally fast.
A consumer-grade modern GPU can compute billions of SHA-256 hashes per second. If an attacker gains read access to your database, a simple unsalted SHA-256 table can be cracked in minutes using precomputed Rainbow Tables and brute-force tools like Hashcat.
2. The Modern Standard: Argon2 and bcrypt
Secure password hashing requires algorithms that are intentionally slow and resource-intensive, forcing attackers to spend significant hardware time and RAM on every guess.
Argon2 (winner of the Password Hashing Competition) and bcrypt incorporate a 'work factor' that can be tuned higher as hardware evolves, alongside mandatory unique salts per user to defeat rainbow tables.
// SECURE: Hashing with Argon2 in Node.js
import argon2 from 'argon2';
const hash = await argon2.hash(userPassword, {
type: argon2.argon2id,
memoryCost: 65536, // 64 MB RAM
timeCost: 3,
});3. What is Credential Stuffing?
Credential stuffing does not exploit vulnerabilities in your application's code. Instead, it exploits human nature: over 65% of internet users reuse identical or slight variations of passwords across multiple accounts.
When a minor web service is breached and dumps username/password pairs online, botnets take those millions of credentials and automate login attempts against high-value targets (banks, retailers, email providers).
4. Multi-Layered Defense Against Stuffing
Enforce Multi-Factor Authentication (MFA): Even if an attacker has the correct password, they cannot bypass a time-based TOTP or hardware FIDO2 key.
Deploy intelligent rate limiting by IP address and username, monitor velocity spikes in failed logins, and cross-reference new passwords against known breached databases.