The Fundamental Password Authentication Problem

In traditional password authentication, the client sends the password (or a hash of it) to the server, which compares it against a stored value. This model is simple but concentrates enormous risk on the server: a database compromise exposes all user credentials simultaneously.

When an attacker breaches a server and steals the password database, they can conduct an offline dictionary attack at full GPU speed with no rate limiting. Modern GPUs can test billions of password guesses per second against bcrypt or SHA-256 hashes, making weak or common passwords trivially recoverable.

Studies consistently show that a majority of users reuse passwords across multiple sites. A single server compromise thus leaks credentials that work on other services. Credential stuffing attacks automate the testing of leaked username/password pairs against popular websites, turning one breach into many.

Server-side password hardening (strong hashing, salting, rate limiting) provides no protection against phishing. When a user enters their password on a fake site, the attacker directly obtains the plaintext password regardless of how well the legitimate server stores it. Phishing is the dominant credential theft vector today.

Databases of billions of leaked username/password pairs from historical breaches are publicly available on the dark web. Attackers use automated tools to test these credentials against financial institutions, e-commerce sites, and email providers at industrial scale, succeeding whenever users have reused a previously breached password.

In traditional password authentication, the server necessarily learns the user's plaintext password during the login process (even if only briefly, before hashing). This means every server operator must be fully trusted not to misuse, log, or accidentally expose credentials, which is rarely guaranteed in practice.

An ideal authentication protocol would allow a user to prove they know their password without ever revealing it to the server. The server would also prove it is the legitimate server (mutual authentication), preventing phishing. A compromised server database would reveal nothing useful to an attacker.

Zero-knowledge proofs provide a theoretical framework for this: a prover can convince a verifier of a secret's validity without revealing the secret itself. Password authentication protocols like SRP and OPAQUE apply these principles to achieve authentication without direct password transmission or server-side password storage.

Strong password authentication protocols should be resistant to offline dictionary attacks even if the server's stored data is fully compromised. This means the stored verifier must not be directly usable to impersonate the user, and must not allow efficient offline password guessing without the server's cooperation.

With hundreds of services requiring authentication, the traditional model requires trusting every service operator with a secret that may be reused elsewhere. The solution is to eliminate password transmission entirely, store only non-reusable verifiers, and bind authentication to the specific server identity to prevent phishing.

Modern solutions include SRP (Secure Remote Password), OPAQUE, and FIDO2/passkeys. Each addresses different aspects of the fundamental problem. SRP and OPAQUE eliminate server-side password knowledge. FIDO2/passkeys eliminate passwords entirely by using public-key cryptography bound to the specific origin.

Which attack is NOT prevented by strong server-side password hashing (e.g., bcrypt)?

Traditional password authentication requires servers to verify secrets they learn, enables offline cracking after breaches, and is defeated by phishing. Password reuse turns individual breaches into systemic failures. The ideal system provides mutual authentication without secret transmission, stores only non-crackable verifiers, and binds authentication to the server identity.