Password Storage Without KDF
Password storage without a Key Derivation Function (KDF) refers to the insecure practice of storing user passwords directly or with weak hashing algorithms like MD5 or SHA-1, which are vulnerable to brute-force and dictionary attacks. This approach lacks the computational cost and memory-hard properties that KDFs provide to slow down attackers, making it unsuitable for modern security standards. It is considered a critical security flaw that can lead to password breaches and data theft.
Developers should avoid this practice entirely, as it exposes systems to significant security risks, especially in applications handling sensitive user data like banking or healthcare. Instead, they must learn to use secure password storage techniques, such as bcrypt, Argon2, or PBKDF2, to protect against attacks and comply with regulations like GDPR or PCI DSS. Understanding this concept helps in identifying and fixing vulnerabilities during security audits or code reviews.