What two describe how attackers obtain access to password hashes? (Choose two.)