You followed all the rules — strong passwords, bcrypt hashing — yet someone still broke into your users' accounts. How? Because the password hash was never the weakest link: the attacker reset a password by guessing a single trivia answer.
A cryptographic failure is any defect in the way an application protects data in transit or at rest. The defect may live in the algorithm, in the key, in the randomness that seeds the algorithm, or in the operational practice that handles the secret. Password hashing is only one corner of this category, which sits at position A02:2021 in the OWASP Top 10.
Scope reminder: perform password-reset testing only against systems you own or are explicitly authorized to test. The bundled NovaCart application instance is the authorized lab target for this lesson.
In this lesson you will:
- Open NovaCart's password reset flow and inspect a security question.
- Recognise that the entropy of the reset answer is the effective credential, and that a strong password hash does not protect a weak reset path.
Entropy is a measure of unpredictability. A coin flip has high entropy — the outcome is genuinely uncertain. A security answer drawn from a small set of well-known facts has low entropy — only a handful of guesses are plausible.
- See how predictable randomness (the coupon code generator) and hard-coded secrets fall under the same category as the reset weakness.
Estimated time: 10 to 15 minutes.
Prerequisites: the Cryptography Fundamentals lesson (keys and randomness) and the Encoding, Encryption & Hashing lesson (the distinction between encoding and cryptographic protection) — both are in the Data, Cryptography & Database Foundations category. You also need a running NovaCart instance. You do not need to be logged in; the password reset flow is reachable without authentication, which is part of the point.
When you are ready, send the Continue signal.