Cryptographic Failures
Sensitive data isn't protected because cryptography is weak, misused, or missing altogether.
What are Cryptographic Failures?
This category is about failing to protect sensitive data with proper cryptography. It includes data left unencrypted, outdated algorithms like MD5 or SHA1, weak keys, and data sent over insecure channels. One of the most common mistakes, with the most visible consequences, is how passwords are stored. Try it yourself in the demo tabs.
Why MD5 & fast hashes are dangerous
MD5 and SHA1 are built to be fast, and without a salt, the same input always produces the same hash. An attacker can build a rainbow table (a huge hash-to-password table) once, then crack millions of leaked passwords with a lookup and no guessing. Common passwords like '123456' fall in a fraction of a second.
The fix: salted, slow hashes
For passwords, use purpose-built functions like bcrypt, scrypt, or Argon2. Each adds a random salt (so every hash is unique even for identical passwords) and is deliberately slow (so guessing becomes very expensive). Rainbow tables become useless. For non-password data, encrypt it at rest and in transit (TLS).
Impact
When a database leaks (and a leak is a matter of when, not if), weak storage turns a single incident into millions of instantly exposed accounts. Because many people reuse passwords, the impact spreads to other services through credential stuffing.