They both mean to "confirm or verify," but "核对" has the specific meaning of taking information from someone, and matching that information digit by digit, or alphabet by alphabet against something else, presumably a master list of some sort.
Imagine that you are a recipient of a large number of packages. You have a list of all the tracking numbers on the boxes. When the packages come in, you check the number on each box against a number on your list. This gives you a very good sense of 核对。
On the other hand, 确认does not give you a specific sense of how you verify a given piece of information. The only requirement is that when you 确认something, you just have to be sure that the information is correct.
That is why you can say 确认/核对 a password (presumably, you are given a password, and you check it digit by digit against a list in the database - 核对. Or, you simply confirm the number without specifying how you confirm it - 确认). However, you just "confirm" someone's arrival time because the sense of matching a sequence of numbers (or information) digit by digit against a master list is not as strong as it is for matching passwords, ID numbers, tracking numbers, etc.
I hope this helps!