WEBVTT 0 00:00.190 --> 00:00.880 All right guys. 1 00:00.900 --> 00:08.310 So now that we've covered creating user passwords encrypting our database as well as hashing passwords, 2 00:08.760 --> 00:14.780 we've kind of reached a level of security that most websites are at. 3 00:14.820 --> 00:19.170 Now there's a lot more security that we're going to learn about a little bit later on. 4 00:19.710 --> 00:25.860 But you're actually at a point where you already know quite a lot about authentication and keeping user 5 00:25.860 --> 00:32.260 passwords secure and definitely a lot more than a lot of people who actually run websites. 6 00:32.310 --> 00:35.760 And I know that some of the guys are keen to get a job. 7 00:35.820 --> 00:41.730 And if that is you then I want you to go on to a website called plaintextoffenders.com. I'll link 8 00:41.730 --> 00:43.540 to it in the course resources. 9 00:43.560 --> 00:50.430 But here what you'll find is emails that come from various companies where the user's requested to 10 00:50.430 --> 00:57.720 reset their password and they're sending the user a plain text version of their password. 11 00:57.720 --> 01:03.300 Now at this point we know to be able to even get the user's password in plaintext 12 01:03.300 --> 01:08.130 it means that they're doing some horrible things with securing the passwords. 13 01:08.130 --> 01:13.890 Either it's encrypted and there's an encryption key somewhere that they're storing or it's simply just 14 01:13.890 --> 01:18.830 stored on their database as plain text which is the worst possible type of security. 15 01:18.840 --> 01:27.030 So given that you already know a lot better than the people who run getlinuxjobs.com or world 16 01:27.030 --> 01:34.880 sim.com or Telecomegypt, then you could actually just email these people and tell them that "I'm 17 01:34.890 --> 01:39.690 a web developer and I know about authentication and securing users passwords. 18 01:39.690 --> 01:42.210 You obviously seem like you might need some help. 19 01:42.240 --> 01:43.650 Would you like me to work for you?" 20 01:44.130 --> 01:47.600 I recommend giving that a go to if you're keen on getting a job. 21 01:47.730 --> 01:50.900 If you're not looking for a job then have a look at these websites. 22 01:51.000 --> 01:56.090 And if you're signed up to any of them be sure to delete your account because it's definitely not secure. 23 01:56.190 --> 02:03.090 And this is why a lot of companies and a lot of websites get hacked because they don't continue beyond 24 02:03.090 --> 02:03.730 this point. 25 02:04.060 --> 02:09.690 So that means it's a really good time to talk to you about how passwords are hacked. 26 02:09.750 --> 02:13.860 So a sort of hacking passwords 101 class if you will. 27 02:13.860 --> 02:16.960 Now most of time I use my programming powers for good 28 02:17.070 --> 02:23.100 but in this case I want to talk to you about how passwords might be hacked so that once we understand 29 02:23.220 --> 02:29.700 how the other side approaches this problem then we can learn more about security and make our website 30 02:29.700 --> 02:31.240 safer for users. 31 02:31.320 --> 02:32.880 And by the way, I have no idea 32 02:33.010 --> 02:33.430 why 33 02:33.450 --> 02:36.240 hackers are always portrayed in a balaclava. 34 02:36.240 --> 02:39.120 It's not like they're gonna burgle anybody. 35 02:39.120 --> 02:40.410 I mean especially this guy. 36 02:40.410 --> 02:46.500 He must be incredibly warm sitting next to all these computers wearing so much clothing on his face. 37 02:47.160 --> 02:48.250 But I digress. 38 02:48.600 --> 02:55.650 So, as a company, this is probably one of the things that you least look forward to the day when you wake 39 02:55.650 --> 02:59.360 up and you get a call and you've been hacked. 40 02:59.550 --> 03:06.300 And this has happened really recently to a lot of big companies like Adobe Creative Cloud got hacked 41 03:06.300 --> 03:15.060 in 2013, LinkedIn got hacked in 2012 and there's loads of accounts where their passwords get leaked. Lots 42 03:15.120 --> 03:21.330 of unhappy users who reuse their passwords and are feeling extremely vulnerable. 43 03:21.780 --> 03:27.510 And you can see that even to this day people can purchase these hacked accounts where people might not 44 03:27.510 --> 03:34.200 have realized that their LinkedIn email and their passwords are linked and people are potentially 45 03:34.200 --> 03:40.920 buying that data up and using it to hack into their PayPal accounts or other similar payment portals. 46 03:40.920 --> 03:48.450 So even if you don't learn anything from this lesson, I recommend just going to this website, I'll link 47 03:48.450 --> 03:54.210 to it in the course resources just for educational purposes. But put it in your email address and make 48 03:54.210 --> 03:59.550 sure that if you do have any passwords that show up, change all the places where you use that password. 49 03:59.550 --> 04:05.940 But why is it that all of these big companies are getting hacked and leaking their users passwords? Are 50 04:05.940 --> 04:09.690 they not at least encrypting or hashing their passwords? 51 04:09.690 --> 04:10.740 Well they are. 52 04:11.070 --> 04:12.190 But consider this. 53 04:12.210 --> 04:19.830 So you're a hacker and you've managed to get in to the LinkedIn user database. And just for simplicity's 54 04:19.830 --> 04:23.650 sake, let's say it looks like this. You've got a username and you've got a hash. 55 04:23.820 --> 04:28.170 And thankfully they didn't store their users passwords in plain text. 56 04:28.200 --> 04:30.370 You can't access their passwords straight away. 57 04:30.940 --> 04:39.450 However, if you look at this table a little bit more closely you will realize that three of the hashes 58 04:39.720 --> 04:42.480 are completely identical. 59 04:42.480 --> 04:44.430 Now why might that be? 60 04:44.820 --> 04:52.780 Well remember that the same password always turns into the same hash no matter how often you try it. 61 04:52.800 --> 05:00.000 And that's a core part of the hash function that we rely on in order to validate our users as well. So 62 05:00.060 --> 05:06.810 that means a hacker would look at this table and realize that Angela, Tony and Emily all have the same 63 05:06.870 --> 05:07.940 password. 64 05:08.040 --> 05:13.470 And what they can do is they can start to construct what we call a hash table. 65 05:13.530 --> 05:20.070 So you would take some of the most commonly used passwords and you would use the same hash function 66 05:20.400 --> 05:23.670 to create the hash value for each of those. 67 05:23.700 --> 05:27.840 And these are some of the most common passwords that people love to use. 68 05:27.840 --> 05:32.310 123456, qwerty, password, 111111. 69 05:32.400 --> 05:41.070 And so you generate this hash table and then all you have to do is just look up the hash of the user 70 05:41.430 --> 05:45.510 and compare it against the hash you have in your table. 71 05:45.510 --> 05:52.110 So you search by the hash value. And you land upon the password which is qwerty. 72 05:52.110 --> 05:58.510 So now you figured out that three out of four users in this table all have the same password 73 05:58.680 --> 06:00.180 and it's qwerty. 74 06:00.180 --> 06:06.600 So what if they didn't use one of the most common passwords and instead they use something else, say 75 06:06.810 --> 06:09.800 their date of birth or that pet's name? 76 06:09.810 --> 06:14.520 Well let's see how we would make a hash table if we were a hacker. 77 06:14.520 --> 06:18.520 You would probably start with all the words from a dictionary. 78 06:18.600 --> 06:21.960 And this is where the term dictionary attack comes from. 79 06:21.990 --> 06:25.860 You create hashes from all the possible words in a dictionary 80 06:26.040 --> 06:30.510 and that will only be about 150000 hashes that you would need to create. 81 06:30.570 --> 06:36.150 And then you add to that hash table all the numbers from a telephone book and all the combinations of 82 06:36.150 --> 06:42.660 characters up to six places. And then you add all of these together and you end up with something close 83 06:42.660 --> 06:50.330 to 19.8 billion combinations which admittedly sounds like a large number right? 84 06:50.340 --> 06:55.390 How long would it take your computer to calculate that many hashes? 85 06:55.410 --> 06:56.610 So what do we do? 86 06:56.610 --> 06:58.310 Well, let's go shopping. 87 06:58.530 --> 07:06.300 Let's go and buy some of the latest GPUs or graphics cards which are capable of parallel processing 88 07:06.720 --> 07:14.790 and therefore are particularly suited to not only bitcoin mining but also generating hashes. With one 89 07:14.790 --> 07:23.390 of the latest GPUs, you can calculate about 20 billion MD5 caches per second. 90 07:23.490 --> 07:31.230 So that means with our hash table of 19.8 billion combinations, it'll only take one of 91 07:31.230 --> 07:39.420 these GPUs 0.9 seconds which is nothing. It's not a lot of time to invest in order 92 07:39.420 --> 07:47.100 to hash so many people's passwords. And to make it even worse, large hash tables have been built for the 93 07:47.100 --> 07:49.000 most common passwords. 94 07:49.080 --> 07:55.920 So because we've had so much data from previous hacks such as the Adobe one or the LinkedIn one or TalkTalk 95 07:55.920 --> 08:00.720 or Equifax, we know what the most common passwords are that people use. 96 08:00.930 --> 08:08.070 And every year companies like Splash Data will compile what are the most common passwords say the top 97 08:08.070 --> 08:09.130 25. 98 08:09.300 --> 08:13.120 And this is where all of those values that went into our table came from. 99 08:13.230 --> 08:16.160 But you can actually go one step further. 100 08:16.200 --> 08:24.390 There are pre-built hash tables that people have created for the top 10,000 most common passwords. And 101 08:24.390 --> 08:31.290 you can see that MD5 is one of the quickest hashes to calculate and this is why it's very very 102 08:31.290 --> 08:39.210 common to find MD5 hash tables and you can even use Google as a basic hash table. You can paste 103 08:39.210 --> 08:42.240 in the hash that you found from the hacked database, 104 08:42.240 --> 08:48.270 you perform a simple google search and you come up with the original password. 105 08:48.270 --> 08:53.880 Now if at this point you're extremely scared and you're wondering well what exactly can you do about 106 08:53.880 --> 08:54.270 this? 107 08:54.390 --> 09:01.770 Well consider that in our user table there was one hash that was extremely difficult to find and it 108 09:01.770 --> 09:07.170 didn't match up with any of the hashes in this little simple hash table we built. 109 09:07.170 --> 09:14.460 So what if we put that into google to search on a larger scale and see if it matches any of the hashes 110 09:14.820 --> 09:17.880 in the hash tables that people have generated. 111 09:17.970 --> 09:20.580 And it doesn't. It doesn't match anything. 112 09:20.580 --> 09:28.290 And the reason is because when John created his password, he had a very very strong password with uppercase 113 09:28.290 --> 09:35.190 letters, lowercase letters, numbers, symbols but most importantly a long password. 114 09:35.250 --> 09:42.450 When you think about hashing as a mathematical formula, you'll realize that as the number of characters 115 09:42.630 --> 09:50.290 of your password increases, the computation time that it takes to crack it increases exponentially. 116 09:50.340 --> 09:57.330 So it doesn't matter if your account on LinkedIn or Adobe Creative Cloud or Ashley Manson was cracked, 117 09:57.690 --> 10:01.150 as long as you had a strong password, 118 10:01.260 --> 10:04.350 they wouldn't be able to work it out from a hash table. 119 10:04.350 --> 10:10.710 So, as an example, there's a website called Password checker and you can put in your password and it'll 120 10:10.710 --> 10:17.460 tell you not only the strength but also how long it will take various types of machines to be able to 121 10:17.460 --> 10:19.200 crack that password. 122 10:19.200 --> 10:24.880 So let's say that I create a 6-character password composed of a random set of characters right? 123 10:24.880 --> 10:28.140 one, two, three, four, five, six. 124 10:28.410 --> 10:35.430 And you can see that even for a standard desktop PC it only takes about three seconds to perform a 125 10:35.430 --> 10:39.090 brute force attack to crack that password. 126 10:39.090 --> 10:49.460 But let's see what happens if I add another six more characters, one, two, three, four, five, six. Now it takes 127 10:49.520 --> 10:58.430 31 years for a standard desktop PC to be to crack it and even a fast GPU takes two years to crack 128 10:58.430 --> 10:59.270 my password. 129 10:59.630 --> 11:07.340 So even though all of the websites encourage you to add a capital letter, a lowercase letter, some numbers 130 11:07.460 --> 11:13.340 and some random characters, if you only have six characters in your password, 131 11:13.370 --> 11:18.010 so a short password, it still doesn't take very long to crack. 132 11:18.050 --> 11:25.910 So the most important thing of creating a strong password that is almost uncrackable is just to increase 133 11:25.910 --> 11:32.740 the number of characters. And also to prevent yourself from being a victim of a dictionary attack 134 11:32.750 --> 11:39.710 just make sure that you don't use a dictionary word or a place name or something that is in a directory 135 11:39.710 --> 11:41.990 somewhere like a telephone number. 136 11:42.020 --> 11:42.290 All right. 137 11:42.320 --> 11:46.220 So at least after this lesson you'll know how to keep yourself more secure. 138 11:46.580 --> 11:52.130 But in the next lesson we're going to address these vulnerabilities that occur because of weak hashing 139 11:52.130 --> 11:52.900 algorithms 140 11:53.030 --> 11:58.760 and we're going to learn how we can combat hackers who try to attack our database using a dictionary 141 11:58.760 --> 12:01.250 attack or by creating a hash table. 142 12:01.280 --> 12:04.460 So for all of that and more, I'll see you on the next lesson. 143 12:04.490 --> 12:09.110 But as a quick bonus if you ever want to trick your friends into thinking that you're some sort of a 144 12:09.110 --> 12:14.690 hacker at least according to Hollywood, I recommend checking out a website called hackertyper. 145 12:14.690 --> 12:21.340 net where you can just mash the keyboard and you end up with something that looks extremely realistic. 146 12:21.350 --> 12:22.470 But word of warning, 147 12:22.490 --> 12:28.380 try not to do this on an airplane or in a government building unless you want to actually get investigated.