Das Video kommt von YouTube: erst beim Abspielen verbindet sich die Seite mit YouTube (Google).
Password Hashing, Salts, Peppers | Explained!
Das Wichtigste aus dem Video
Tipp auf eine Zeit – das Video springt genau dorthin.
Transkriptautomatisch erstellt · 33 Zeilen
- in recent videos I've been using the terms hash salt and pepper bit so I thought it would be a good idea to explain what they are a hashing
- algorithm is a complex mathematical function that transforms the string of data into a seemingly random output string of fixed length for example these
- words produce the following hashes the same input string will always produce the same output string but if the input string is changed even by Just A Single
- Character then output string will be entirely different usually encryption means to scramble data temporarily until a key is used to unscramble it hashing
- is often seen as a form of one-way encryption as you cannot go backwards from a hash to work out the original string you can only go forwards this is
- great for storing passwords instead of storing the actual password the hash of the password is stored when a user enters their password at login it is
- hashed and compared to the hash in the database if they're the same then the login is successful this way if an attacker gains access to the database
- they'll only have the hashed passwords which in theory will be of no use to them as they won't be able to go backwards to figure out the original
- password however in practice it's a bit more complicated there are a few ways an attack can go about decoding a hash firstly since a certain password will
- always produce the same hashed output the most commonly used password hashers are widely known this website will attempt to decode a given password hash
- by simply comparing it to their database of over 800 billion hashes so if you use a common password then you're screwed this website's database is an example of
- a rainbow table a rainbow table simply put is a database containing common passwords and their hashers secondly you can attempt to go through and just guess
- the original password hash it and compare it to the hash you're trying to decode if it's the same well then you found your password you can do this
- through addictionary attack guessing common passwords or a Brute Force attack guessing every possible combination of characters the latter is very
- computationally expensive and can take a long period of time so hashing by itself just isn't enough to protect passwords websites can further protect passwords
- by using salts salts are short random set of characters that are appended to the end of a uses passwords before they are hashed this will most likely thwart
- any rainbow table attack as well cats are cool maybe in a database cats are cool P # close bracket exclamation mark Zed probably isn't do remember salts are
- added automatically after a user enters their password the user won't even know assault is being used salts are generally stores in plain text along
- with a hashed output so the website knows what salt to use when it comes to verifying a login this may seem counterintuitive as you're telling an
- attacker half of the password and you're right brute force and dictionary attacks will still be an issue assuming the attacker takes into account the salt and
- knows whereabout to put it in his guesses however importantly rainbow tables will be of no use finally there are peppers a pepper is a very short
- random string or character for Simplicity let's say in this case a pepper is a single upper or lowercase letter for example uppercase M so the
- hash stored will be the product of hashing the users password plus the letter M so if the password is catar cool the hash stores will be the hashed
- product of catar cool M when a user comes to log in the password they'll give is just cats are Co like with the salt they won't know a pepet is being
- used at all the websites will then cycle through every possible combination of the pepper in this case of upper and lowercase letters there are 52
- combinations so the websites will try ing cat cirle a catle b and so on until it gets to cat cirle M if one of the hashes matches the stored hash then the
- user is allowed to log in the whole point of this is that the pepper is not stored so if an attacker wanted to crack the password by brute force it would
- take them 52 times longer than without the pepper this would be a bit tedious for them conversely it would take 52 times longer to log in for the user but
- this isn't going to be an issue for the genuine user as it only takes a fraction of a second to something so 52 fractions of a second really isn't too long to
- wait in conclusion there are many different hashing implementations many websites will use a combination of both salts and peppers in this video I've
- only used the md5 hashing algorithm but keep in mind there are many other hashing algorithms out there so thanks for watching guys this was a more
- educational video over my usual stuff but yeah if you liked it remember to hit that like button subscribe if you haven't already uh follow me on Twitter
- I'm @sonic and stay tuned for more hacking videos