How NOT to Store Passwords! - Computerphile

"You might be watching this years in the future"

Just remember that nothing you can code is secure against the xkcd approach to password cracking - you find the user and beat it out of them.

Thanks for the advise! I changed my youtube password from 12345 to 54321!

Always put salt on your hashbrowns.

The first time a website emailed my password back to me with no security, I was astounded. Thanks for a glimpse behind the curtain, to understand the stupidity of people who design web systems.

Once I played a game years ago, forgot my password in about 2 months so I clicked Forgotten password? And it told me to put in my old password.

I am watching this years in the future, how did he know?

When aliens attack the Earth and we are all doomed, I want the world leaders to choose this guy to go on TV and explain to everyone why we are screwed.

Something else important: The vast majority of hashing algorithms are VERY FAST! They've been designed that way to make document signing easy. So in addition to salting, you also generally want to repeat the hash recursively, for a few thousand rounds, or generally whatever takes 1/10 - 1/4 of a second. The longer you can make it take, the longer it will take an attacker to crack as well.

Shit, my password is "my_dogs_name"... Now I need to change again...

i hate that sites wont let me make a password that has more than 20 caracters and say i cannot use symbols

man the time gap between comments when sorting by new is amazing

Wow I didnt know youtube hides when you type your password. mine is ******** haha

just have your password 'incorrect' so if you get it wrong it will say " your password is incorrect" and then you will remember

Shit, i just store my passwords in my HTML code!!

There's also 'pepper'. 'Salt' and 'Pepper'. Salt is a known random mutation string unique to the user, then the pepper is another unique mutation string unique to the database itself, but stored SEPARATE from that database, so that it is a secret to the database, with nothing linking the two together in any way.

safest place to store a password? a piece of paper under your pillow

Ah, a couple things here could have been clearer in the infographics. First, the database with the salted hash should have had four columns: user_number, user_name, salt, and salted_hash. Second, the process of hashing a salted password isn't a complicated black box where you input the salt and the password and get out a salted hash. It's actually quite simple: if your password is my_dogs_name and your salt is m8jz6psqYc, then your salted password is my_dogs_namem8jz6psqYc. Just throw that into your hashing algorithm to get your salted hash.

OK, please clarify that last method. You say at 7:45 about the salt "a new second password if you like that goes in the database". But if I understand this correctly, you're storing only the salt and the resulting hash, not the user's password, right? When a user logs back in, you take the password they provide and the stored salt and see if its hash matches the stored hash. Is that correct?

Websites that refuse to store their own passwords are actually a pet peeve of mine. I don't think you should do that. It forces people to  link their account to another identity. Nothing wrong with offering the option, but it shouldn't be required. Facebook is the worst, BTW, since the identity it links you to is usually your real life identity. And a major part of security online is being anonymous. So even if something does get cracked, it doesn't link directly to you in real life, allowing you the ability to create a new online identity.