Why are password database breaches bad if cryptographic hashes can't be reversed? If companies such as Facebook store our passwords as hashes, when they are leaked how can this be a threat to the users? I thought of it because nowadays we do not have computational power to break those hashes, so how can a criminal use those hashes against the users?
Users have a habit of choosing passwords badly so that they can be guessed much more easily than cryptographic keys, requiring (say) only a trillion ($10^{12} \approx 2^{40}$) guesses on average instead of a duodecillion ($10^{39} \approx 2^{128}$, or thousand sextillion in the long scale) guesses on average.  Users also have a habit of reusing passwords from site to site, like using the same password for Facebook and Gmail.

Suppose I'm trying to break into your Gmail.  There's only a limited rate at which I can test guesses for your password.  Even if I can narrow your likely passwords down to a trillion possibilities, I can't try more than a few passwords every second at Gmail—even if I had a colossal botnet around the world to avoid IP-based rate limits, and even if I did it in bulk to many targets to avoid account-based rate limits, I'd still be limited by network bandwidth.

But if Facebook's password database gets breached—even if they do everything right like using salts to thwart rainbow tables, using argon2id to raise the computational cost of testing a guess, using OPAQUE to thwart adversaries on the network—then I can try guesses without using the network.  No more rate limits to work around.  No more network bandwidth to worry about.  No more botnet to manage.  I can try guesses offline using my supercomputer cluster tucked away in my evil lair built into the simmering underbelly of a volcano powering my machinations with geothermal heat while sipping at my martini and cackling evilly.

And once I have confirmed a guess for your Facebook password I can try it at Gmail.



There are some mistakes that Facebook could do to make it worse:


Facebook could fail to salt their password hashes uniquely per user.

Then I can search for one of many passwords given their hashes even faster using multi-target attacks like rainbow tables[1] in parallel[2]; if the cost to find one password given its hash is $C$, the cost to find the first of $t$ passwords given their hashes is $C/t$, and the time to find them can be as little as $C/tp$, as long as my volcano supercomputer lair is parallelized $p \geq t^2$ ways.
Facebook could fail to use a costly password hash like argon2id, and instead use MD5.

Then the offline computational cost to test a single guess is as cheap as computing MD5, which costs a few hundred cycles on a typical CPU and negligible memory, in contrast to argon2id which can be scaled to cost billions of cycles and gigabytes of RAM and multiple CPUs in parallel according to the legitimate user's available resources.  This lowers the cost $C$ to find one password and the cost $C/t$ to find the first of $t$ passwords.

In practice, Facebook probably doesn't offload the password hash to the user's computer, so they probably won't use argon2id with billions of cycles of CPU time and gigabytes of RAM and multiple CPUs in parallel, but they will probably use something more expensive to compute than MD5.
Facebook could use a hash that fails to have preimage resistance.

This one is a stretch because essentially no major hash function with advertised preimage resistance has ever been broken[3] (archived).  But if Facebook—for some inexplicable reason—used 2-pass Snefru to hash passwords, then in principle there may be a shortcut to finding a password given its hash more cheaply than just trying passwords until one works[4].
Facebook could just accidentally log their passwords in cleartext.

Well, this one actually happened[5], but Facebook swears that the logs were visible only inside Facebook and that nobody breached Facebook and that nobody inside Facebook would ever dream of abusing insider information like that[6] (archived 2019-06-19), and disclosed it on a night of big news of a long-awaited drama in United States national politics[7].