let's say you have a small brain like me and you forget things a lot and so you small
brain individual have trouble remembering things sometimes including important information like i
don't know your password you find yourself clicking on that oh no my password button
quite frequently and so one day you inevitably click on that button and you get a little email
saying here is your password and lo and behold there it is inside your inbox your password ah
now you remember there's an exclamation point at the end and so you go happily about your merry day
little do you know you just exposed the poor software engineers of this website and should now
be very skeptical of the security of your password this is a very big red flag chances are this is
how this account management system is designed step 1 ask user to make a username and password
step 2 put the username and password in a file step 3 nothing there are only two steps i mean
this seems reasonable what's the big deal what could possibly be wrong with this setup everything
everything is wrong with this setup what if some master class hacker gets their hands on this file
that sounds like a problem now this hooded human being has access to every single account that
exists on your system to do whatever they wish to do stealing credit cards selling data sending spam
emails asking for gift cards what a mess here's a security principle always assume that everything
you have all your code all your data all your user information will at one point be accessed
by someone who isn't supposed to have it stolen or otherwise if that seems overkill to you that this
is some absurdly rare worst case scenario fine but this kind of stuff happens all the time to the
best of the best if the security of your system is dependent on something like this never happening
you are already walking on very thin ice see computer security especially the security of
something on the internet is like defending a castle from unwanted attackers except this
attacker can be any one of the 7 billion people on the planet at any time of day people without
the physical limitations of traditional crime and also outside the bounds of federal jurisdiction
and the larger your castle gets the harder and harder it is to defend it doesn't matter
if you're the smartest security engineer in the world this is a difficult task and you're gonna
need all your tools at your disposal the kind of attacks you'll face are fast and unpredictable
attacks can be as sophisticated as finding a bug in a single line of code that allows you to take
control of a system to sending a suspicious email to an employee asking them nicely to provide their
login credentials for work and you young engineer have to defend against all of that so it stands to
reason from a certain point of view that this worst case scenario is what might actually be
considered to be a very likely scenario that you should be very wary of and work hard to mitigate
not to mention how important a password can be to a user in your system imagine if someone had
access to the password for your email address this would ultimately mean that they could also
have access to all of your other account passwords using the aforementioned forgot my password button
just go into some random website type in their username and click on that magic button and
then you get an email allowing you to log into their most important accounts
this also becomes relevant because people tend to use the same passwords across multiple accounts
so if one random flash game account from the early 2000s has had bad security practices in the past
and those passwords get stolen and you just happen to use that same password for your bank account
you're going to be pretty upset google should not know and should not store your google password
your website should not know the password your users use to log in right but that begs the
question if you don't store the passwords anywhere then how do you let people log in
right like you have to provide your password when you log in but then wouldn't you need to
check that it's the right password before you let them into their account and in order to do that
don't you need to have their password stored somewhere so you can check against it ah thus
enters the technology hashing hang on first let me establish the problem that we are trying to solve
so the flow is this when a user creates an account they give us a username and a password we can
store the username in our database that's fine no one cares if someone gets their hands on those
what we don't want to do is store their password that's requirement 1 don't store the password
if it is stored it can be stolen requirement 2 is that when they give us their username and password
we have to make sure that they've given us the right username and password combination
so to restate we need to not store their password but also know that their password is correct when
they give it to us again later down the line verify the password without storing the password
metanode okay i'm going to propose something here that will lead us to the correct answer
like many of our clever solutions to our difficult problems the answer might not be immediately
evident especially if you're new to the field if it was then we wouldn't really need to spend
a boatload of money on research every year and we certainly wouldn't need me walking you down this
path we just do the most common sense thing and you'd be able to figure this out all by yourself
but unfortunately that's not the case so bear with me for a moment
what if instead of storing the password directly we instead run it through a function to change it
into something else i'm thinking something simple like a reverse function like if your password is
password123 then instead of storing password123 we instead store this nonsense three 321 drow sap
i mean it's a bit of a loophole solution i'm not technically storing your password i'm storing this
other thing right so if hackers do get into our system then technically they don't have access to
any of your passwords right so how do i make sure you have the right password okay so when you're
logging in and you type in password123 in my database i have three two one drow sap stored so i
can just take the string you just gave me reverse it and if it matches the one i've got stored then
you're all good i know that the password you gave me before is the same one that you've given me now
problem solved right we didn't store your password and we were able to successfully verify that this
account belongs to you see of course the problem isn't solved it doesn't really take a big brain to
figure out exactly what's going on here hackers can look at this file and after like 10 seconds
realize they can just unreverse the password and then well now they have your password
that's the key here if we're going to store this after passing it through some function
that means that whatever that function is it's got to be basically impossible to reverse or at the
very least so difficult that it literally takes the lifetime of the universe to try to the point
where you might as well get a normal job instead of trying to steal people's passwords okay so we
need a function that cannot be undone the problem is most functions that you can think about can
also be undone even things that look pretty hard to undo if you try hard enough with the power of
modern computers most things you can figure out or at the very least you can give a good guess
even sophisticated and secure encryption functions can be undone with the decryption key
and like we said before let's assume the worst case scenario and that along with all of your
files the hackers have also stolen the keys to your secret magic encryption box and can therefore
decrypt everything you have encrypted so what's the solution well these cryptographers computer
scientists and mathematicians gathered their brain cells and came up with hashing or let's be precise
cryptographic hash functions a function that can take in any password and outputs a bunch of
nonsense notably in a way that cannot be reversed as in even if you get your hands on this nonsense
this hash there is no way you can figure out my password but it's not only that you don't know my
password you can't know anything about my password not the letter it starts with not the length of
the password not passwords it's similar to the hash of one looks completely different from the
hash of password two which is completely different from the hash of abc123 it's almost random keyword
being almost as in if you know the password the hash function will always yield the same result
but if you don't know it or even miss one single character that's basically useless information
so what does this mean just like before with the reverse function when you first create your
account instead of storing the password i first pass it through the hash function and store the
hash instead that way i never actually store your password and whoever is trying to get it
won't be able to no matter how hard they try because the hash function cannot be undone on
the other hand when you try to log in again i can pass the password you just gave me through the
hash function again if the two hashes match then you're good if you try and give the wrong password
the hash function won't give the same result only the person who knows the password you will be able
to get the hashes to match perfectly by giving the same input password as you did when you first
signed up conclusion is even if your hacker friends got their hands on this file with
all of these hashes they won't be able to find out any of your passwords the way this function
works is a bit outside the scope of this video i must admit explaining this intuitively is a
bit of a challenge this is a function that takes in an input and outputs something that is almost
completely random or at the very least looks random teaching concepts is about finding and
explaining patterns that humans can understand but in this case it seems like the only pattern here
is randomness fortunately for you if you're not interested in going down this rabbit hole some
other person on the internet spend a good amount of time making code libraries that does all this
stuff for you so you can use one of those instead of trying to write these functions yourself
congratulations you have officially finished your first day of being a security-minded expert
now this is not a perfect solution there are many many problems with this there are some
people hopefully not you who have had really bad really common passwords and so if you have
a website with a lot of users you will find that a lot of them will have the same password
these passwords when pushed through the hash function will all have the same result
so if you see a hash that appears many many times you can probably guess that this password appears
in the top 100 most common passwords list even without this you can just manually test each
of the top 100 most common passwords and pass them through the hashing function yourself and
if you find a match with the data you stole then you know what the user's password was there are
other security measures that can help with this problem that we won't get into the main one being
called assault you should probably subscribe if you want to see more videos on this topic
point is there are many many security practices that as a good software engineer you should take
to make sure that you're storing your sensitive user information safely i'd say that this is the
tip of the iceberg but it's more than that security is a never-ending battle between
attackers and defenders every new technique that attempts to break into a system must be defended
and every defense must be taken down this is one tiny lesson on how to store passwords
something that even the biggest most important companies failed to do at times and in times
like these you sigh you look up into the sky and promise that you will do better you