1
00:00:06,170 --> 00:00:07,990
Welcome back everyone in this lecture.

2
00:00:08,000 --> 00:00:10,690
We're going to talk up past word hashing.

3
00:00:10,910 --> 00:00:15,950
When you say has user authentication capabilities you're going to need to store their usernames and

4
00:00:15,950 --> 00:00:18,460
passwords for security purposes.

5
00:00:18,500 --> 00:00:23,540
You're never going to want to store the raw text of the actual password because if your servers ever

6
00:00:23,540 --> 00:00:28,820
become compromised that means whoever Perhaps you would have the ability to read a person's password

7
00:00:29,060 --> 00:00:30,660
in the raw text format.

8
00:00:30,760 --> 00:00:34,610
Instead you want to secure it using hashing.

9
00:00:34,660 --> 00:00:37,080
So we can use a hash function to help us with this.

10
00:00:37,210 --> 00:00:42,420
Basically in a very simple terms a hash function is an algorithm that can take in a document.

11
00:00:42,430 --> 00:00:46,020
In our case it's just going to be the password and return back a secure hash.

12
00:00:46,020 --> 00:00:53,210
Digest so it's secure because just given the hash a person cannot determine what the original password

13
00:00:53,210 --> 00:00:54,070
was.

14
00:00:54,080 --> 00:00:58,270
For example let's imagine a very simple and also insecure hash function.

15
00:00:58,460 --> 00:01:01,130
So this is just to get the idea of how a hash function works.

16
00:01:01,130 --> 00:01:05,700
This is a one way hash function ought to make it clear that this is a very simple hash function.

17
00:01:05,810 --> 00:01:08,440
And we're not going to use something this simple.

18
00:01:08,800 --> 00:01:13,220
For our example the hash function is just going to count the number of letters in a password and store

19
00:01:13,220 --> 00:01:14,490
that as the hash.

20
00:01:14,570 --> 00:01:20,120
For example if we provided the password my password as our string what we would do is pass through our

21
00:01:20,120 --> 00:01:21,150
hash function.

22
00:01:21,200 --> 00:01:24,310
In this case we just count the number of letters and that equals 10.

23
00:01:24,380 --> 00:01:26,120
So then we store that hash.

24
00:01:26,120 --> 00:01:32,480
Now if in some instance our systems became compromised the hacker would only see the number 10 stored

25
00:01:32,510 --> 00:01:33,640
on our servers.

26
00:01:33,980 --> 00:01:38,210
Given that number 10 you wouldn't be able to determine what the original password was.

27
00:01:38,210 --> 00:01:44,030
Now this hash function has issues because the same password could come out with the same hash cryptographically

28
00:01:44,030 --> 00:01:49,980
secure hash algorithms will give a unique hash code for any entry provided.

29
00:01:50,110 --> 00:01:54,550
So there's already cryptographically secure hashing algorithms and libraries for us to use.

30
00:01:54,550 --> 00:01:58,960
You should never really write your own unless you're a professor of mathematics and you already know

31
00:01:58,990 --> 00:02:00,220
about this stuff.

32
00:02:00,220 --> 00:02:05,140
So what we're going to do is when the user provides a password we can simply check it against this hash

33
00:02:05,140 --> 00:02:09,550
form for a match with our safe hash on our servers.

34
00:02:09,550 --> 00:02:11,400
So there's two useful libraries for this.

35
00:02:11,410 --> 00:02:13,630
One is the crypt and the other one.

36
00:02:13,660 --> 00:02:16,110
Excuse my pronunciation is Virk Zug.

37
00:02:16,480 --> 00:02:20,320
And what we're going to do is show you how to use both of these libraries since we're both pretty popular

38
00:02:20,440 --> 00:02:21,700
in the flask space.

39
00:02:21,760 --> 00:02:23,860
And then you can decide which would you prefer.

40
00:02:23,860 --> 00:02:25,960
Honestly they're both extremely similar.

41
00:02:25,960 --> 00:02:27,190
So let's get started.

42
00:02:27,190 --> 00:02:29,000
We're going to show you examples with both of them.

43
00:02:29,050 --> 00:02:29,320
All right.

44
00:02:29,320 --> 00:02:31,100
Here I am at my text editor.

45
00:02:31,300 --> 00:02:35,620
I'm going to run this just in a simple example that PI file before we get started.

46
00:02:35,650 --> 00:02:40,360
I'm going to show you how to use B Crit. And if you don't have it yet you can always install it by just

47
00:02:40,360 --> 00:02:43,720
running Pipp install flask.

48
00:02:43,780 --> 00:02:46,050
Dash B crypt.

49
00:02:46,090 --> 00:02:49,580
That's b c r y p t.

50
00:02:49,690 --> 00:02:52,970
Enter and let it install if it has an installer already.

51
00:02:53,020 --> 00:02:56,130
So mine is collecting because I didn't have my environment activated.

52
00:02:56,230 --> 00:02:59,650
If you have our environment activated it should already be there but you can run that just for good

53
00:02:59,650 --> 00:03:00,430
measure.

54
00:03:00,580 --> 00:03:08,800
And then we're going to say from flask underscore the crypt import secret.

55
00:03:08,830 --> 00:03:11,600
Notice how important a capital B.

56
00:03:11,650 --> 00:03:17,830
So the way this works is you create the hashing object so we can say lowercase b script is equal to

57
00:03:18,460 --> 00:03:21,990
be croupe of an uppercase to have the instance of the hasher.

58
00:03:22,300 --> 00:03:26,870
And then what we do is let's imagine I have a password so my password.

59
00:03:27,220 --> 00:03:34,630
I'll say password is equal to super secret password.

60
00:03:34,630 --> 00:03:37,570
So this is what the user is going to provide inside of the form.

61
00:03:37,570 --> 00:03:39,280
This isn't something we want to save.

62
00:03:39,280 --> 00:03:41,440
Instead we want to save the hash version.

63
00:03:41,440 --> 00:03:48,160
So what we can do is I can call my hashing object B script and then call the generate password hash

64
00:03:48,160 --> 00:03:52,060
function off of it and then just pass in my password.

65
00:03:52,060 --> 00:03:55,760
So in this case the password is actually equal to the pastorate here.

66
00:03:55,780 --> 00:04:00,880
So you can say password Zucco the password or we can actually just provide the string directly.

67
00:04:00,880 --> 00:04:05,070
And then this will be the hashed password.

68
00:04:05,380 --> 00:04:08,380
So then we can actually go ahead and print that.

69
00:04:08,380 --> 00:04:15,990
So let's do that and I say print the hashed password and let's check it out.

70
00:04:17,710 --> 00:04:24,400
So when I run this lips run my Python of my example up high there we go.

71
00:04:24,600 --> 00:04:27,560
So here is the hashed version of the password.

72
00:04:27,750 --> 00:04:32,690
You'll notice it's basically unreadable for a human which is exactly what we want.

73
00:04:32,700 --> 00:04:35,130
This is the hash that we're going to store on our servers.

74
00:04:35,130 --> 00:04:40,960
That means if we ever get hacked all the hackers are going to be able to see is this actual hash.

75
00:04:40,980 --> 00:04:43,800
Instead of the super secret password code.

76
00:04:44,280 --> 00:04:49,290
Now let's imagine that the user we already saved their hash version the password and now they're logging

77
00:04:49,290 --> 00:04:53,310
in again and we want to be able to check if their password matches the hash.

78
00:04:53,310 --> 00:05:00,160
Luckily the crypt can also do that for us all we need say is the crypt check password hash.

79
00:05:00,400 --> 00:05:03,650
And then you provide the hashed version of the password.

80
00:05:03,670 --> 00:05:08,680
So in this case the hash password and then whatever the news value is that you're trying to check it

81
00:05:08,680 --> 00:05:09,250
against.

82
00:05:09,430 --> 00:05:12,020
So let's say the user tries logging in of the wrong password.

83
00:05:12,100 --> 00:05:16,000
So in this case we'll just say wrong password.

84
00:05:16,060 --> 00:05:18,510
So let's go ahead and print the results of that check.

85
00:05:20,240 --> 00:05:25,760
So say print that check I'm going to comment out the other line.

86
00:05:25,910 --> 00:05:29,480
So again all I'm doing is check password hash hash password it goes in.

87
00:05:29,480 --> 00:05:35,270
And then whatever you're trying to compare it to when you run this notice I get back false because wrong

88
00:05:35,270 --> 00:05:37,920
password didn't match supersecret password.

89
00:05:37,940 --> 00:05:46,300
Now let's put in supersecret password There we go let's save this and run it and then we get back.

90
00:05:46,300 --> 00:05:46,820
True.

91
00:05:46,870 --> 00:05:51,330
So the hash version of super secret password matches the hash version of what we say.

92
00:05:51,610 --> 00:05:53,490
So that's how you use B crypt again.

93
00:05:53,530 --> 00:05:54,460
Pretty straightforward.

94
00:05:54,460 --> 00:05:57,480
There's really just two methods you need to know after importing it.

95
00:05:57,550 --> 00:06:03,540
You just create that object and then call generate password hash or check password hash and VERCO Zug

96
00:06:03,580 --> 00:06:05,610
is going to be extremely similar.

97
00:06:06,010 --> 00:06:07,480
So let's show you how you can use that.

98
00:06:07,780 --> 00:06:13,210
I'm going to delete all of this and you can always check the notes for the file in case you don't have

99
00:06:13,210 --> 00:06:13,540
it yet.

100
00:06:13,570 --> 00:06:24,400
You can always install Virk by saying Pipp install capital W E R K z e Yuji and in my case I've already

101
00:06:24,400 --> 00:06:26,320
have it installed and it already comes a flask.

102
00:06:26,330 --> 00:06:28,540
So you should already have it.

103
00:06:28,690 --> 00:06:33,200
Then we're gonna say from Vicksburg security.

104
00:06:33,380 --> 00:06:43,040
Whoops not that security that you were going to import generate password hash and check password hash.

105
00:06:43,100 --> 00:06:44,290
That feels super familiar.

106
00:06:44,290 --> 00:06:45,780
That's good because it should be.

107
00:06:45,780 --> 00:06:48,350
It's basically the exact same process we just did.

108
00:06:48,490 --> 00:06:52,920
So what we're going to say is hashed pass is equal to.

109
00:06:53,050 --> 00:06:58,000
And in this case we just call these functions themselves no longer needed to create an object we just

110
00:06:58,060 --> 00:06:59,980
import these functions directly.

111
00:06:59,980 --> 00:07:09,590
So we say hash pass is equal to generate password hash so I can say my password and then I could print

112
00:07:09,590 --> 00:07:20,360
out the hash pass and if ever I want to check it all I need to do is say check password hash and then

113
00:07:20,360 --> 00:07:26,140
you provide the actual hashed version and check it against whatever you're looking for.

114
00:07:26,140 --> 00:07:28,380
So go ahead and check it against the wrong password here.

115
00:07:29,540 --> 00:07:34,220
And then we'll print the check.

116
00:07:34,340 --> 00:07:38,960
So again extremely similar process except just your imports are different and you just import the functions

117
00:07:38,970 --> 00:07:39,930
directly.

118
00:07:39,930 --> 00:07:46,620
So now when I run this on my example the up-I I get back the hash and then I get to see that it's false.

119
00:07:46,620 --> 00:07:49,790
Now the changes to actually match the password I provided.

120
00:07:50,690 --> 00:07:51,690
So my password.

121
00:07:51,830 --> 00:07:53,060
Save that.

122
00:07:53,060 --> 00:07:54,440
Run it and now I get true.

123
00:07:54,460 --> 00:07:57,310
The hash version does match the hash version of my password.

124
00:07:57,590 --> 00:07:59,340
OK so that's basically it.

125
00:07:59,340 --> 00:08:04,070
And since you are going to do is when a person first registers the Web site will generate their password

126
00:08:04,070 --> 00:08:09,750
hash and save that generation on our server and then afterwards logging back in again.

127
00:08:09,890 --> 00:08:14,000
We no longer need to generate as said we'll just checked her password hash using one of these functions

128
00:08:14,270 --> 00:08:16,910
which in itself will generate it in the backend.

129
00:08:17,220 --> 00:08:18,450
OK that's it.

130
00:08:18,470 --> 00:08:20,230
Again it's just generation and checking.

131
00:08:20,230 --> 00:08:24,110
The only differences is how we actually import and use those two libraries.

132
00:08:24,110 --> 00:08:25,600
It's up to you which when you want to use.

133
00:08:25,730 --> 00:08:27,300
So keep that in mind.

134
00:08:27,350 --> 00:08:28,320
We'll see what the next lecture.