Hashing is only as strong as the way it is used. A hash function that looks secure on paper can fail badly in practice when passwords are short, salts are missing, the algorithm is outdated, or the comparison code leaks information about how long it took to run. This topic surveys the attacks that exploit those weaknesses: brute-force and dictionary/wordlist guessing, precomputed rainbow tables, collision attacks against deprecated functions like MD5 and SHA-1, the consequences of unsalted hashing, and timing attacks on hash comparison.
In COP3530 you already think about cost in terms of time and space. These attacks are the security version of that same reasoning: an attacker is choosing between spending computation (guess every candidate) and spending storage (precompute a huge table of hashes), and defenses like salting, peppering, and key stretching exist to push that cost beyond what is practical. Understanding the tradeoff is what lets you argue why bcrypt, scrypt, or Argon2 belong in an authentication system instead of a bare call to SHA-256.
As you watch, keep a running list in two columns: the attack, and the specific countermeasure that defeats it. Pay attention to why a salt kills rainbow tables but does little against a targeted brute-force attack, why collision resistance matters for signatures and integrity checks more than for password storage, and why the birthday problem means collision resistance is roughly half the bit length of the digest.
A concise overview of how attackers go after passwords, covering the difference between online and offline guessing, brute-force attacks, and dictionary or wordlist approaches that exploit predictable human password choices. Based on the title and CompTIA Security+ objective 2.4, it should also address why stored password hashes are the real target and how salting changes the attacker's economics.
Professor Messer is a well-known, carefully-scripted certification trainer, and this video maps directly onto the brute-force, dictionary/wordlist, and unsalted-hashing subtopics in a compact seven minutes.
This video surveys attacks aimed at the cryptography itself rather than at the user, which for Security+ objective 2.4 typically includes birthday and collision attacks, downgrade attacks, and the problems with deprecated algorithms. Expect discussion of why older hash functions are retired once practical attacks appear.
It pairs with the password-attacks video to cover the other half of this topic — collision attacks and weak or deprecated hash functions — from the same clear, exam-focused producer.
A focused explanation of the birthday attack: why finding any two inputs that collide is far easier than finding a preimage for one specific hash, and how the birthday paradox makes the effort roughly the square root of the naive search space. The video contrasts this directly with straightforward brute force.
It gives the mathematical intuition behind collision resistance that the broader survey videos only mention, which is exactly what you need to explain why digest length matters when choosing a hash function.
Together these videos give you the attacker's perspective that MO3 asks you to evaluate: the Professor Messer pair maps the landscape of brute-force, dictionary, rainbow table, and cryptographic attacks along with their standard countermeasures, while the birthday attack video supplies the reasoning behind collision resistance that underpins MO1's comparison of MD5 and SHA-256. Seeing concretely how unsalted, fast, general-purpose hashes fall to precomputation and high-speed guessing is also the motivation for MO2 and MO5 — it is the reason a secure design you write later should use a salted, work-factor-tuned algorithm such as bcrypt, scrypt, or Argon2.
These videos were chosen from YouTube on October 2, 2026. Each has captions; the player turns them on. Videos on YouTube can be changed or removed — if one no longer plays, tell your instructor. If a player does not appear, use its Watch on YouTube link.