People are often the weakest link in any security system, and attackers exploit this through social engineering—the manipulation of human psychology to trick individuals into revealing confidential information or performing unsafe actions. Many variants target specific channels. Phishing uses fraudulent email or messages to steal credentials or install malware. Spear phishing narrows the focus to a specific individual or group, while whaling goes further by targeting senior executives, who are referred to as the "big fish." Voice phishing, called vishing, is conducted over the telephone or VoIP, and smishing delivers the same trick through SMS text messages. Pretexting fabricates a believable scenario, such as posing as IT support, to persuade victims to share data. Outside the digital realm, tailgating (also called piggybacking) occurs when an unauthorized person physically follows an authorized employee through a controlled door, and dumpster diving recovers sensitive information from discarded trash, such as printed documents or written-down credentials.
When social engineering fails or is unnecessary, attackers turn to technical password attacks. A brute-force attack tries every possible password combination until the correct one is found, while a dictionary attack narrows the search to a predefined list of common passwords. Credential stuffing uses username and password pairs leaked from one breach to attempt logins on unrelated services, exploiting password reuse across sites. Password spraying works in the opposite direction: rather than hammering one account with many passwords, it tries a small set of common passwords across many accounts to avoid triggering account lockouts. These attacks succeed because users often choose weak or reused passwords and because many organizations still rely solely on knowledge-based authentication.
Defending against these attacks requires strong password storage practices. Hashing is a one-way cryptographic function that maps data of any size to a fixed-size output called a digest. Unlike encryption, hashing is not reversible—given a hash, you cannot recover the original input. This one-way property is what makes hashing suitable for storing passwords. However, attackers can still recover weak passwords using precomputed rainbow tables, large databases of hashes for common passwords. The standard defense is salting: appending a unique random value to each password before hashing so that precomputed tables become ineffective. With proper salting and a modern, deliberately slow hash function, even leaked password databases resist practical cracking.