How to salt and pepper passwords?

[@maxechendu6693]

This channel is pure gold. Clear and concise information. Thank you for the great lessons.

[@lsaavedr]

I need like each video to no see them two times...

[@thedude3544]

garlic and napkin , that was funny at the end !

[@socorreitor]

I never comment on youtube, but you deserve it. It's amaznig, a very good explanation and really easy to understand.

[@sunnyclassroom24]

Thank you very much! I appreciate .

[@davidr.flores2043]

Thanks Sunny. Your videos are nicely put together. Pretty good material, delivery is clear and concise using nice animations, length is appropriate = Excellent job!!

[@sunnyclassroom24]

So nice of you

[@abdalsattarardati5203]

I wish that you never quit providing this high-quality material. This channel is really underrated.

[@billyffa]

Sunny, I am taking a course to become an IT support specialist. After I take my lessons, I always come to your channel to actually understand my teachers. hahaha. Thanks so much, you are the best!

[@sunnyclassroom24]

You rock!

[@User_2051]

Sunny you have the best explanations for topics on the internet

[@anson0714]

Clear illustrations and examples are given. Really a good video for new learners to know more about salted hash and peppered hash. Thanks!

[@tomaszhorczynski3170]

Monnsierur, that is a great channel! Clean, conscise - short but full of content. Great job - many thanks!

[@sefakpsz]

I think it was a perfect representation and explanation about hash, salt, and pepper. Thanx a lot.

[@zainbensaleh1762]

You are the best with this method of explanation :)

[@thecyrusj13]

Thanks for the graphical explanation. This makes so much more sense.

[@rajivraghu9857]

Loved the salt and mixer animation :D too good.. One of the best explanations. Binge watching all ur videos

[@sunnyclassroom24]

Thank you so much 😀

[@tubingforever]

LOL! Tomorrow we might need garlic and napkin :D

[@Dj_Alax909]

WOW! came to learn real quick what salting is... stayed for the animations 😎

[@bijaygurung2078]

Amazing lessons. Thank you so much Sunny.

[@sunnyclassroom24]

You are welcome ! I appreciate .

[@luvkashyap]

Where have you been or where I have been not able to find you.....................Your explanations are AMAZING.. Simple to understand. Critical for exams like CISSP where you are drilled on the concept !! Thanks for doing these

[@sunnyclassroom24]

Wow, thank you!

[@gdorlexa]

These are great videos! Very simple to understand...

[@sunnyclassroom24]

Many thanks for your nice comment.

[@malshamadushani5456]

A very good,very clear explanation.Thank you very much

[@lef1040]

Very concise explanations!

[@a.hemlata7521]

Visual explanation . Superb

[@anthonyholleran9378]

Fei chang hao! Xie xie ni, Sunny! Thank You! : ) ❤

[@VikasSequeira]

1. Who generates the 'salt'? The user or some system? 2. When the user enters their password to authenticate, which system is aware of the salt to add it to the password that the user entered to run it through the hash algorithm? 3. I am assuming that since the salt is stored in the same DB as the user details, would a compromise of the DB mean that the user account (provided the attacker already knows the user password) is now compromised? 4. Is there a reason why the salt is stored in the same DB? Stumbled upon this channel, ended up subscribing in the first minute :)

[@vinayk4061]

I am having the same doubt after listening to the video

[@rainron2664]

Thank you sir. God bless you.👍😊👏👏

[@meliodas.1108]

Thanks man . Helped a lot with the playlist ! :)

[@sunnyclassroom24]

Glad it helped!

[@themetalnoir2233]

Hi, Today's topic is Salt & Pepper. Would i like some Salt & Pepper on my Omelette? I don't know, but, passwords can surely use it!

[@josephselvaraj8359]

You are awesome , all videos are good and well explained

[@sunnyclassroom24]

Many thanks for your kind words.

[@walterwhite1186]

Thanks a lot great explanation 😀😀🎉

[@supriyatenny3744]

Great work 👍

[@sunnyclassroom24]

Thank you!

[@or251j]

Great class! loved it!

[@asoteico9528]

Greatly done Sunny...! 🥇🎖🏅

[@enjoysharingcaring]

It is extremely simple to understand

[@ravensmith5045]

Thank you soooooooo much. Could you please explain more about how putting pepper to a password

[@sunnyclassroom24]

Pepper is site-wide secret. for example, the programmer adds "sunny" to everyone's password. When Tom signs up for the first time, he chooses "abc123" as his password, as he submit his signup to the database, his password is abc123sunny.

[@sunnyclassroom24]

Like a salt, pepper is a random value. But it is different from salt, because salt is unique value for each user, and pepper is for everyone in the database. In other words, a pepper is a site-wide static value. Pepper is not stored in the database. It is a secret. for example, pepper is abcde password: sunny salt is: 12345 then my new password with salt and pepper would be a hash of "sunny12345abcde". the purpose is to make password more random.

[@mibrahim4245]

@@sunnyclassroom24 ok then don't store the salt in the database from the beginning and make it site-wide static then no need to pepper, why not ?

[@robinhood3841]

@@sunnyclassroom24 so how about if someone type sunny as password he wouldn't get the user ?? Because the salt and paper will added automatically in the password

[@BijouBakson]

Amazing content. Explained so well I would recommend this course to Einstein :) Thank you so much. This was so useful. Subscribed already and liked all the videos on this playlist.

[@giorgi23]

Good job Mr!

[@disasterromio]

@sunny Classroom 1. so when user1 choose "password123" the server will (password123 +salt(unique value per user) +pepper (same value for all) ) >> Hashing and save the hash ??? 2. the salt is saved in the DataBase, but the pepper isn't saved anywhere "hard coded" , and known for the server code only Am i right ? >>>> Ps 2:45 4:47 user name header should be changed to user password ?? Great Job sunny .. Miss new videos

[@tornoutlaw]

Very good explanation! So if I understood correctly, I can do this: Assign my users randomly generated passwords, don't use a salt, but should use a pepper to hash these passwords in my backend, so that insiders (to my db) cannot simply read the passwords there, correct?

[@marcosalameh8677]

Amazing Sunny!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[@leesubiramaniyam2704]

😂😂 future will be onion, tomato,rice also.. you're video explanation very very good

[@brierepooc8987]

This is a great explanation, but what, when or how does the salting take place?

[@dayumnson9769]

Really great content! But Ihave yet some open questions.. 1) Is it always password+salt+pepper (+ meaning concat of these values)? Or is the order implementation specific? 2) What are decent ways to figure out salt & pepper once you have access to the database? To me the most convenient way seems to be: create a new user with a simple password and try to crack the resulting hash that will be put into the database. Also, does the Pepper change? I think it would be really strong if we would choose different pepper according to the timestamp for example? Greetings, really enjoy your content! Hope you don't mind the questions.

[@jamesedwards3923]

If each password is randomized by the user. The salts and peppers are extra. The problem is too many users. Use the same password on every damned thing. With all the open source, free, and paid options for password database. It is just pointless.

[@danielrice5474]

Nice video. Good explanation of Salt/Pepper. Think next will be Ketchup and Mustard.

[@sunnyclassroom24]

Thank you very much for your comment. I will watch if new technologies are coming out :)

[@zainbensaleh1762]

I will save your chanel in my favorits

[@patryk2700]

Another satisfying video! :)

[@rk.x01]

Nice explaination dear.

[@sunnyclassroom24]

Thanks a lot RK.

[@rk.x01]

@@sunnyclassroom24 Sunny Classroom i have major queries that is, 1. If attacker had salter hashing database so he can do brute force attack and he can authenticated right ? 2.pepper if not stored in database than where it is stored ? 3. Salt and pepper=new hash value ? 4. pepper=new hash value ? 5. Some hackers hash value converts into plaintext is it possible ? 6. What is pre calculated hashs in rainbow table ? Because these question from my one interviewer asked me that's why asking you dear. Please give me reply.

[@sunnyclassroom24]

@@rk.x01 1. yes. 2. Only wed developer/owner knows the pepper 3. password + salt+pepper =hash value 4. pepper is not hash value. salt is not hash value either 5. the hash value is not reversible but they can check against the candidate table. 6. pre-generated candidate hash table; Please check my three videos: hash function, dictionary attack and brute force attack videos you would understand how hash function work.

[@rk.x01]

@@sunnyclassroom24 thank you.

[@sunnyclassroom24]

@@rk.x01 You are welcome!

[@malikadabare3719]

Thank you. Nicely done explanation.

[@sylvesterbello6434]

wow, I love you teaching. Thanks

[@angelobuenavente9926]

where did you get a salt? that consist of e54f2? thanks

[@sunnyclassroom24]

a random value for each user

[@vladislavkaras491]

Thanks for the video!

[@kirstenmeates8248]

Great Explanation!

[@sunnyclassroom24]

Many thanks for your kind words!

[@iiN1GH7M4R3ii]

thank you sir for the explanation

[@rahuls331]

Thank you Sunny !

[@ChetanRawattunein]

Is it okay to store the user salts along with the user details in the database. and should we encrypt user email id too or only the password? I'm using AES to encrypt the user credentials

[@mugume]

:) :) nice one Sunny!!

[@sunnyclassroom24]

Thanks! 😊

[@aashishgupta8547]

Sunny, I hope you read this. You are amazing, the detail and explanation are to the point and very clear. Kudos man !! However, there is one thing, in my opinion of course, which can be improved and that is - that terrible music. It's just a recommendation - please change it. Love your work. Thank you !!

[@sunnyclassroom24]

Yes, thanks a lot for your suggestion. The latest videos (last 50 videos) I try to cut the music or lower the volume. Thanks a lot for your advice. You are very welcome to point that out.

[@pt9606]

Nice explanation. i have one query. Salt+hash+pepper=total hash value stored in somewhere ? Salt+hash=salter value stored in database ? and (salter hash+pepper) =final hash value stored somewhere after three hashed ? Please reply me.

[@sunnyclassroom24]

salt +hash + pepper = total hash will not be stored anywhere. It is only in the process of login. Thus man-in-the the middle attack will be avoided. Storage in any database would compromise the technologies.

[@pt9606]

@@sunnyclassroom24 okay. I mean after hashing salt+password+pepper this hash value stored in some secret place or database ? Because in salter hashing case salt+password value stored in database only right ? I think now you understand my question.

[@sunnyclassroom24]

@@pt9606 Yes, they should be stored in the database with their user name.

[@alisonnunez9739]

Thank you so much!!🌈

[@muhammadrehmankhan6073]

sir you are saying that hash Algo is not reversible but in other video using crackstation u had get the pasword from multiple digest if it is not reversible then how this happen please reply.

[@sunnyclassroom24]

Great question. The method is like this. The crackstation or hackers generate millions of digests/hashes and then match your hash, once they are the same, they know the original text. You can check my video called "dictionary attack or brute force attack", and you will find hackers use this method to hack our hashed passwords. thanks you for your great question.

[@vaishakhmr5144]

Your videos are much informative and has got excellent content. Thanks ! I got a ques here. To avoid hacks, you had mentioned that hash is done on the whole set of (user pwd +salt+pepper), and hence the digest is created on a much complex data, which would be difficult to retrieve from lookups. May I know how would the same user be authenticated when next time he logs in..? Would the salt and pepper be stored along with the user identity?

[@sunnyclassroom24]

Good questions. 1) The more elements added, the more difficult to hack. 2) each user has a salt of his own 3) every user shares a pepper (secret only known but the system developer) 4) The same user still use his normal password in clear text, but it is hashed, then salted, and then pepper is added, then compare the result to the stored digest, if matched, the user is authenticated. The whole process is only used to hide the real plain text password.

[@vaishakhmr5144]

Thanks for the clarification Sunny :)

[@sunnyclassroom24]

@Sainath Sk the password remains the same as long as the user does not update her/his password.

[@sunnyclassroom24]

the user only login with his password. Salt is saved in his database and pepper is site-wide secret shared with all users in the database. To a user, all he knows is his password.

[@RSTao77432]

Are Salts stored on the local machine? As there not stored in the database??

[@sunnyclassroom24]

they are stored in the database of the server side.

[@RSTao77432]

I thought one was stored in the database & one was stored on the local machine? Doesn't storing All three, ie Salt/Password/Pepper in the database kind'ov defeat the object of having them

[@RSTao77432]

If a hacker compromises the database then they'd have all three parts

[@sunnyclassroom24]

passwords and salts are compromised but not pepper, which is site-wide random value.

[@sunnyclassroom24]

password is hashed and salt is random for each password in the database, but pepper is only known by the server, a secret not stored in the database.

[@chino9468]

With salting of passwords, wouldn’t there have to be a database that has the salt stored so when you sign in, it’ll will have to match it up to your inputed password and then hash it to compare it with that saved digest? If the salt is random, how does it know what salt to add every time you sign in?

[@C0ttageChees]

Thank you so much for this =]

[@landonrivers]

is the salt supposed to be stored in the database for each user? Is salt something that a hacker would see?

[@Kitulous]

yes, but it doesn't matter, since salt is not used to make a password more secret, it's used in order to not have a lot of identical passwords in a database, because in that case the attacker would find the most widely used password and try to crack it. if you salt your passwords, there will be no identical hashes, therefore a hacker would not know which passwords are actually identical also salt helps with eliminating rainbow table attacks, since the attacker would need to generate a rainbow table for each salt, and it would take ages. pepper, on the other hand, is not stored in a database, it's simply appended as a constant in the hashing function on your backend. thus, if only the database is leaked and the server sources stay intact, the passwords are basically uncrackable. the attacker would need to brute force the pepper, and if the pepper is long enough, it would not be feasible.

[@111michiel]

Thank you for the digestible and tasteful explanation, could have used a bit less salt in the end ;)

[@vivekprajapati7911]

You are awesome! thanks sir.....

[@vijaypandey1372]

Thanks god. you exist in the world !!

[@RishabhiVlogs]

Please can you provide an example in java for salt & pepper implementation

[@chetanvyas3479]

Superb

[@twishasahay3178]

I loved this video

[@KoepenickDrums]

Unfortunately you don't explain how the receiving server can validate a correct password if it is salted.. If it is random every time, how would the receiver know?

[@himbary]

Great video thanks, the effects are a bit loud tho

[@sunnyclassroom24]

Thanks a lot for your advice. I have lowered the volume for most recent videos.

[@danielnease2230]

I keep coming back for the jokes

[@aashishkumarrai]

Garlic & Napkin is the best!

[@TheGuroguro12]

thank you, Garlic and napkin :)

[@sunnyclassroom24]

Most welcome 😊

[@onosekewenu]

Garlic = SMS text-message two-factor authentication (2FA) Napkin = voice-based 2FA

[@armandocabrales7400]

You are awesome!

[@pastuh]

Now i think... what if i just invert user letters? Normal letters to caps-lock and reverse ?

[@mibrahim4245]

AWESOME !

[@FormationSecurite]

Thanks!!!

[@shubmakes]

You sound like Jian-Yang. Love the video tho!

[@thembadantye4212]

LOL, true.

[@mhmdtolba7625]

How i know hash without i know password?

[@dmytroshchotkin2939]

I've never heard of pepper, it makes sense though

[@bigdaddygfunk]

Wouldn't you know it, Trump used the word "salt" as his salt for Twitter

[@jimmatrix7244]

Is salt and pepper known as obfuscation?

[@sunnyclassroom24]

I think you are correct, in essence.

[@Anonymous-ed4id]

Who the hell thumbed down on the video?!

[@danteeep]

nice thx but pepper is not explained well

[@alejandroalzatesanchez]

kind of spicy though

[@sayslah]

Trump!