Bcrypt & Password Security - An Introduction

[@nyzss]

nice video, and also hello fellow mangadex users.

[@dikshagoyal5021]

Hello, mangadex user here.

[@acubanwholosthiscar7693]

Grating cheese fellow mangadex user

[@lkafi]

Hello frens

[@daveseo2889]

Greetings, fellow mangadex users.

[@aliss_m]

Hello

[@swarnavopurkayastha4489]

Views are gonna go stonks, now that mangadex promoted it

[@Spiceymomo]

same i came from there 😂

[@DareV53]

Stonks

[@umaisali7094]

I also came from there 😂😂

[@shnoopachar9168]

Pretty sure we all came here because we were bored

[@idontwantbelieveiwantknow.3526]

STONKS

[@rierier1]

Came because of mangadex, stayed because of the easy to understand explanations. I can foresee myself coming to this channel a lot 😲

[@Ajay-ox1eo]

It's dead tho.

[@kandigloss6438]

It doesn't seem to be active tho and even when it was active it seemed to be a mix of conferences and someone's garbage bin, this seems like the most useful thing on it. Nice to have this though since clicking around all the other videos on this are needlessly complicated (one even turning "what is plain text?" into a drawn out and complicated explanation, wtf)

[@aminakay8]

This was actually really interesting. Thanks mangadex 😂

[@AndyThomasStaff]

no one cares

[@3411-r2e]

whew, im safe. my password is way too weeb to be in any dictionary.

[@senkuayano4937]

same

[@markjohnston6974]

Joke's on you, the hackers are weebs, too.

[@rickykurnia8940]

meaning?

[@oka1424]

Mine's too personal so it might as well be random

[@mqbaka]

problem is, if one of mangadex user uses a password that he has in his dictionnary, he would be able to find all the other passwords using their hash. He just has to find one match to get all the others (I guess, the video does'nt make that point very clear but, I assume that is the way it works)

[@man_lady8510]

i get none of this but i feel safer now thanks mangadex

[@lyrisio]

From what I understand: "abc123" + "salt" => [bcrypt] => "ab7qru.." Salt can be any string of characters and is protection against dictionary attacks (hackers generate a dictionary of common passwords and test it against the database). Generally, salt is unique for each user taking account their join-date, their age, etc. If we take that into account, it can turn into: [salt] = [join date] + [age] ^ 2 [password-digest] = bcrypt([password] + [salt]) TLDR = It takes a long time to decrypt a single password from a single account.

[@ashwanishahrawat4607]

Cartoon > Animation > Anime > OPM > Mangadex > Hack Reactor Great Journey so far, learned a lot.

[@kennethjor]

Nice explanation of password hashing and salts, but I have to admit I came here looking for an explanation of bcrypt specifically.

[@kurama4785]

Thanks for the video and i want to thank MangaDex team for introducing me to this channel

[@PantsStatusZero]

A dictionary attack is specifically a brute force attack using dictionary terms. A look up table of hashes is know as a rainbow table. Some rainbow tables are produced using a dictionary attack. A salt should be unique to each user. Salts make it hard to produce a rainbow tables because you would have to create a different rainbow table for every possible salt. So it's every possible password times every possible salt.

[@van2297]

Mangadex users👀

[@SirLightfire]

Something he didn't mention is that you typically generate a salt _per password_. That means that generating the hash dictionary (or "rainbow table" as they're typically called) is impossible to generate in the first place. This means that cracking each password is _even slower_ because two users who have the same password, will have different password digests, because they have different salts

[@daniel....]

Thanks for this video. I finally understood how bcrypt works, especially the part about salts. One of the main advantages of bcrypt is that it cannot go obsolete as computers become faster because you just have to increase the number of rounds of hashing. When first released in 1999, the recommended number of rounds was 2^6...not you should use 2^15 for increased security.

[@IsaacFoster..]

I just wanted a site to read some manga , how did I get here lmao

[@jaycela900]

I'm here bcoz of what happened to mangadex,..😭😭😭😭

[@crixavey9385]

The best explanation i have watch on Bcrypt functionality. Thanks

[@yogeesh93]

Please change the title to hashing and password security. "bcrypt" in title is misleading, I thought it explains about bcrypt working!

[@Abdulaziz_turki]

From mangadex✌🏻

[@betr8]

Thank god I read JOJO with no email in mangadex. Nice video btw.

[@fawazaljohani8447]

My 4 months security class in 7 minutes

[@23o8idlnqdolkqd]

A BCrypt hash includes salt and as a result this algorithm returns different hashes for the same input..

[@idontwannagetbanned]

dont feel as scared about the mangadex leak now

[@DZatheus]

Ok, so Mangadex is using an enigma machine. Got it.

[@ahmadromdani5085]

haha

[@anissefiani4453]

Subscribed. Very clear and simple explained!!!

[@AndyThomasStaff]

you were lied to. this video is garbage

[@AbhiKhatri]

Hats off to you man, I really liked your explanation. I am gonna share this to the dev community. :D

[@logtguy8822]

THANK GOD I USED A GOOGLE RECCOMENDED PASSWORD

[@belajarit-65]

ohh, the reason is really-really great and so funny for me 😂😂

[@AndyThomasStaff]

don't share your worthless thoughts

[@cleave4667]

this man must be confused with the mangadex comments

[@Melonno]

Thanks for a great explanation!

[@jocasteins4309]

The Last video is 5 years ago quite sad but it is good to know this channel thanks to mangadex

[@LBLE_]

Nice explanation.

[@Gheotic]

Awesome explanation, it all make sense for me now

[@fatimaharrie6446]

i feel so smart now thank you

[@fatimaharrie6446]

also stoked for the new mangadex!

[@mohammedishaan2099]

Nice Explaination. Thank You.

[@ondrejvainer1510]

Great video, thanks!

[@CunningAndGuile]

This answered my questions and then some, thank you!

[@samandarshoyimov5580]

nice, very informative

[@spookyy607]

Shit now i dont Remember what my password to mangadex was :/ Is three any way to show it now?

[@jasongandy3996]

if your on chrome go to settings then passwords

[@AJ-po6up]

it's 2021 use a password manager goddammit!

[@somiya968]

My overthinking saved me this time.

[@yuunayunohana9920]

This video makes it seem like you use a single salt for all users, which you must not do! Instead you should give each user their own random salt and store it with the user in the database. That way an attacker has to create a separate dictionary for each user. Additionally, same hashed passwords are different for different user. So even if Alice and Bob use the same password, this is then not apparent in the database because the hash still differ.

[@blogeek7039]

The difference is... never use MD5 ;)

[@FeliJz]

Awesome explanation!

[@DialecticalMaterialismRocks]

exceeded my expectations

[@limitless9483]

Very clear thanks

[@deboramei6413]

Estou saudade mangadex! 😢🤗❤

[@goggles_2025]

Slightly off topic but As a mangadex user, is there anything i should do??

[@That_One_Guy...]

Imagine suddenly getting views flood because manga website recommends your video :)))

[@re-blitz]

They made a api but I can’t use it cause I can only read on mobile at the time and idk if the website is going up anytime soon :(

[@tripsd5929]

Storing Hash (password + static salt) = HASHnew (lets say) in database is a bad idea. If the database is compromised, the attacker can use that static hash value (i.e.HASHnew) and pass it through MiTM to get authenticated.

[@Yo-yx8wo]

salt is not static but random

[@kueapel911]

haha jokes on the mangadex hackers, my password was already leaked along with my username on compromised password list.

[@AJ-po6up]

Exactly, mine has been leaked and in the wild since 2010, so it's old news! there's nothing of value behind that password.

[@kueapel911]

@@AJ-po6up even if they try to use it on other website, the most they'd get out of it would be some edgy comment list I made years ago. Nothing of value was lost. That's why I always use my leaked password for non crucial websites lol.

[@JonyElektro]

Why didn't I know about this in my college days? Now I feel like an idiot using md5 to encrypt my projects...

[@SirLightfire]

Depending on how old you are, md5 would've been fine for the computing power of the day

[@leana339]

Nice video good that i used a dumpster mail for mangadex but not so good that i don't have access to the dumpster mail anymore after their hack.

[@paulinebunuan]

Where do you read your manga now?

[@Xavslip]

Mangasee ig

[@paulinebunuan]

I used to read from the scanlators' respective websites, but I recently found Manganeko.net and it has no ads so its pretty good.

[@NoobWardenSpammer]

Hello just a thought to my self, what will happen if we encrypt both email and password before storing it in the database?

[@theswedishdude1]

so if you use an uncommon password then they wouldn't have it in their dictionary and you'd be safe?

[@smokingrailgun4584]

No, it should be unique. Like a project/operation name, with numbers (birthday date, or other for you meaningful dates).

[@ginicholas4322]

I'm pretty sure it's slow because it probably uses multiple Salts before and after the hash and is unique for every user other than that if one found out about the Salt well then wouldn't the entire Bcrypt database be comprised?

[@UndeadFleshgod]

BCrypt uses a single per-user salt. You just hash it over and over again to slow the hashing process. The salt is actually embedded in the hash itself with the work factor (Format looks like $bcryptVersion$workFactor$saltHash) so you do have the salt for everyone. But that means you can't bruteforce all your database with that salt, only a single user.

[@90OiNoTnA]

So should I change the pwsord? So I enter the mangadex?

[@vampante]

what do you mean?

[@90OiNoTnA]

@@vampante that is, I did not understand well.

[@ChaceBonanno]

So bcrypt uses a pepper to slow down the hashing process?

[@JohnySilverhand]

What is the difference between hashing algorithms and functions?

[@draggador]

mangadex is way more responsible with their security than most corporations are

[@xaviermerinogomez2398]

But if I didn't sign up to the website and the website got hacked then am I safe or not?

[@cadeheinberg3047]

How are you writing so good with a mouse. WTH

[@dacree0216]

in 6:00, why hacker compromise the password will compromise the salt? And how can hacker compromise the password??

[@CombatArmsPro100]

Brute force, rainbow, dictionary

[@Nasa1423]

I feel personally attacked... Thanks for the explanation tho.

[@kazunyaaa]

turn on 2FA, it's a pain to use it every time but it works

[@OneSaltyBruh]

yes hello from mangadex

[@yam4040]

It means that the mangadex uses good program to store our database

[@sarfaraza2419]

Does bcrypt uses salt to hash password ?

[@Greenleaf_]

Isn't that a rainbow table? I thought a dictionary attack was when you bruteforce using common words instead of individual characters.

[@markmiller8080]

This is an awesome explanation!

[@riyan_prof]

I think he will promote l@st pas😆 for storing password but I'm wrong when look at the videos upload times.... 😄 I'm glad...

[@уват]

amazing!

[@darrenjones1671]

So if your password isn't a horrible password in the list of the hackers' dictionary attack does the dictionary attack not work? The dictionary attack only works for passwords that they would test against?

[@markjohnston6974]

Yes...ish. Their list of 'common passwords' likely approximates 'every leaked password ever'. It's just text, the space and power to store it and run through it is negligible. If your password is literally unique in the universe, then yes, a dictionary attack would not work against it. If your password is an 8-letter English word, it almost definitely is on the dictionary. So anyone thinking 'my password is secure because it's not on the Top 10 Most Used Passwords List' is kidding themselves.

[@Jmaasy]

Nice and clear explanation

[@doosnobs8214]

I want to know how a website or app that has the hashed passwords let someone in. For example, the pw abc123 is hashed into jibberish, how does the database recognize the hash? I feel like I can guess that the pw you sign in with gets hashed the same way, so that when the hashed pw gets compared to the database one it lets you in. I would appreciate someone letting me know how it actually works.

[@TheOcmer]

That is basically it. When you log in the app will encrypt the entered password and compares it with the stored password hash. If they match, the user entered the correct password. In the case the salt gets somehow changed, users will not be able to log in anymore as it will produce different hashes as the stored password hashes did not change.

[@ahmadalmoustafa]

Thanks , great explanation

[@Anvilshock]

Okay, so it's "designed" to be slow, but how does one do that? Surely it's not as easy as inserting a ton of WAIT clauses or somesuch that someone else compiling the algorithm for themselves could just take out and/or something easily alleviated by throwing ever more computation power at it thanks to Moore's, right?

[@jellyrabbits375]

The hashing algorithm takes computational work, which takes time. It's designed to be slow by just doing more and more computational work, the attacker knows the exact computations he needs to do to get the same hash, but he needs to do it on every password he tries to guess. So if the computation takes 10 seconds, then each guess of his will cost him 10 seconds which he will have to go through for each of his guesses.

[@Anvilshock]

@@jellyrabbits375 Appreciate the response, but it didn't actually explain anything. Just said the same things with different words.

[@zenky4989]

lets be real we are all bob (im coming from mangadex btw)

[@SystemBot]

what if you hash the hash and the salt?

[@megumugi8620]

So, This means that i dont have to be too scared about my password on mangadex?

[@kanoccino]

A simple password change should be safe, unless you use the same password in other websites, i suggest you change them all if ever the breacher decides to expose the info.

[@lyrisio]

@@kanoccino or 2FA; if the website does not have that then just do what Kael H is saying.

[@letsgodevs]

Thank you sir

[@IsaacFoster..]

My name isn't bob. I am bob.

[@senkuayano4937]

i came here from mangadex

[@JonWoo]

Very nice.

[@GabeFromUtah]

Very impressed with this presentation. You are quick with the tablet?

[@martacronk6563]

I WANT THIS OFF OF MY KZbin. It won't let me delete it!!!!

[@Sohendar]

but, why is it slow? what makes it slow? and how by being slow makes it good?

[@VinTJ]

I think he means the hashes are more complex and longer, therefore slower to generate. imagine if md5 takes the original string and turns it into a hash after 10 steps. Bcrypt turns it into a hash after like 50 steps. therefore for a list of the Dictionary Hash (assuming the hacker tries to make one that has a list of top 10,000 common passwords for example) it becomes like 50,000 times LONGER to generate the whole dictionary hash. imagine if the md5 dictionary hash it takes 1 minute to create and for bcrypt dictionary hash takes 50,000 minutes or a whole month. That's an insane difference. take this with a grain of salt ( _haha_ ) since I'm not a code-person but I think that's pretty much it

[@oceanmeme5475]

i just wanted to read part 7

[@vampante]

I was panicking because i thought I couldn't read the new part 8 chapter

[@dzah04]

thank god i read it on mangadex a year ago

[@tl1326]

im sad to say i am a bob but im also happy to say that now i am an alice

[@martinmohammed4087]

How can the hacker take the salt from an hash? That should be not possible? At 6:00 in video...

[@FalcoGer]

this is in fact not how bcrypt works. it works as a general idea on securing passwords, bcrypt uses a chained key generator accessing pseudorandom memory addresses to set up for generating the hash. the salt is not appended or prepended to the password string but instead used to set up the key generation.

[@VinTJ]

so the part he got wrong is just how the salt works then?

[@stray5188]

Video: but bob is not so smart Me: oh that's me

[@Syxtori]

Is my Crunchyroll safe😭😭

[@IYIrOWN]

Basically this video has a wrong title, because you don't explain any factors as to why bcrypt is slow, so any algorithm could have been used and therefore this video shoulda been called: how hashing passwords work integrated with salt (loosely explained). - I came here to find info on bcrypt, and there was none cept "it's slow".

[@lahirupc]

Why BCrypt is better 6:02

[@dcg819]

I am Bob.

[@xiaoyangmu6439]

Awesome !

[@EVVENN]

I did not plan to do this but my mangadex gmail acc is the same as my facebook gmail lol and someone tried to change my password, jokes on you hacker, for every site I use a different password even I forget about them

[@VinTJ]

lmao tbh relate, I've lost like 30% of accounts I've made as a kid on kiddie flash game websites

[@rellatheday6156]

Yahhhhhhhhhhh so I'm ah go and start to change all my password

[@moaazbhnas886]

thanks a lot ❤️❤️