Passwords & hash functions (Simply Explained)

How can companies store passwords safely and keep them away from hackers? Well let's find out!
With all the data breaches lately, it's likely that the password of one of your accounts has been compromised. Hackers now might know the password you've used, but they also might not.. To understand why, we'll take a look at what methods a company can use to protect user passwords. We'll take a look at encryption, hash functions and a multilayer approach!
📚 Sources
Can be found on my website:
savjee.be/vide...
🌍 Social
Twitter: / savjee
Facebook: / savjee
Blog: savjee.be
💌 Newsletter: newsletter.savj... (no more than once a month)
❤️ Become a Simply Explained member: / @simplyexplained

[@tar509]

We were just shown this as a part of an information systems security lecture, I figured I'd actually go ahead and give it a like because it's simple and informative

[@simplyexplained]

Thanks! Really appreciate that!

[@Logical-Sense]

Keep up the good work mate, it was informative.

[@rahulbiswas9971]

the channel name is perfect thanks dude. 💖

[@siddharthgarg1985]

Brilliant video.. I love how you explain such complex concepts in a simple manner.. Please keep up the good work

[@vz7742]

good mornin sir!

[@Lukas-kh5gu]

amazing video. learnt a lot, going to share :-)

[@midhatbasit7306]

Best explanation

[@swapniljoshi1033]

Explained very simply thank you

[@osiris5449]

My encryption/decryption algorithms I have (for PHP) take in a string, add some salt, some hashing and then locks it with a key then encrypts or decrypts that with a very “quarantined” password that’s been... Treated. It’s strong asf.

[@monickverma9637]

Could u tell me how encryption works?

[@datag1199]

Great video - thank you

[@humayunnaveedkhan1281]

very well explained

[@quintonconoly]

nice!

[@lynnelenatorbay1450]

Great video! thanks

[@JamieWFilms]

Amazing video, thank you so much mate!

[@robertogarcia4637]

thank you very much for the instructional - learned a lot (specially w/the salt & cost things). Nice !!! Furthermore, your voice is very pleasant so double congrats!

[@seixasribeiro6715]

thank you so much.

[@abdullahsultan6024]

It's very nice video.. thanks for your efforts and keep it going

[@-_lIl_-]

4:00 then just join the length of the username, then the username, then the length of the password, then the password, and then hash it, and then boom! non-identical hashes

[@realdragon]

Me learning about password encryption so I can add possibility to log in on my website with 3 people per week visits

[@0_-]

what do they do with the salted hash?

[@kds-2049]

So you hash your plain text password using 'salt' and 'cost'. This means every password that's the same plain text is different. But when comparing the password that you use to login, should you use the exact same salt and cost to hash that same plain text password? This means you should keep the salt and hash (and cost if it isn't a constant) for every user. Am I correct in this? This isn't explained in the video sadly.

[@ChristianGrenier-ji7pm]

I don't understand something. Maybe someone could help! If we use sha-3 and salt to hide the real password, and a hacker monitors the traffic and capture this hashing password... He could use this information to access to the server and gather all confidential information? He doesn't need the plain text password. The server understands verifies only the sha-3 value?

[@HimanshuRana0015]

how can we get hash password?

[@dankelly]

Where/how do you store the salt and cost do you can use it when the user tries to log in?

[@simplyexplained]

You can store the salt in your database with the hashed password. And if you're using bcrypt, the hash, salt and cost are all in 1 string.

[@dankelly]

Simply Explained - Savjee Thanks. If I store the salt in the database (the same one that a hacker just got access to) how is that secure?

[@simplyexplained]

It just ensures that each hash is unique and that cracking attempts can't be speeded up with tricks like rainbow tables.

[@acidwave1576]

Most hackers don't want many people's data- if you do get hacked, either it's by someone you know, or you are just extremely unlucky.

[@natesh1]

Then its still easy to crack the password if they get both salt and hash r8? After cracking one password , I will apply the salted hash algorithm for all the hash and salt I have.

[@simplyexplained]

The salt is there to prevent you from cracking multiple passwords at once. Imagine 5 users have the same password. If you don't use a salt, the hashes of these passwords will be the same. So if you crack 1, you instantly know the others as well. With a salt however you have to crack each one individually. They also protect against rainbow tables and dictionary attacks. It's not perfect, but helps! (Also look at bcrypt: they generate 1 hash that contains the salt in plain text) You really can store them together.

[@HiImKyle]

But how do companies keep a salt value for a given user..? Just sounds like the same problem.

[@c0smo709]

There is no problem because even if you know the salt they don't know where you put it. Example : if my salt is "grape"( simplified for ease) and my password is "ilikeicecream" then my salted password can be "grapeilikeicecream" or "ilikeicecreamgrape" or even "ilikegrapeicecream", all of those have so different hashes that they can't be correlated

[@FdPros]

how would a unique salt hash make a bruteforce attack still very much possible? Wouldn't it take a long time for it to crack? Unless you somehow know the salt then probably you could bruteforce a string of commonly used passwords + the salt itself which may get you something or somehow cause a hash collision but that will take ages. Someone who sees this cares to enlighten me? xd

[@aianoelarguelles5277]

what is hash?

[@user-kx5es4kr4x]

idk

[@nehmenesr1609]

and when you use a quantum computer ? Lol

[@tsunningwah3471]

znia

[@uhozapsinje1145]

I dont understand that how i can crack password from facebook???

[@regarrzo]

Just call them and ask nicely!

[@graffitividraw399]

So can I know my hash of my gmail or fb password? Please reply

[@maxmenius1319]

They should make a hash system that resets every hour

[@MorphTW]

How would you check input password with the one you entered on registration? 😊

[@ForeverChip03]

I just changed my password cause I saw it ryt on the screen

[@BobbyBundlez]

AMAZING. really appreciated you goign through drop Box's encryption method. started coding 8-9 months ago, doing JS now and just started learning how to use the scrypt function as well as salting passwords etc... watching this video made me excited for all the deeper things you can do... maybe one day i shall make it a goal to recreate and code that level of password security like dropbox has! cool vid. thanks again anyone wanna share their experience with coding thus far? anyone think im doin ok learning this stuff after 8 months? or am i behind.... lol... sometimes i can't tell tbh i still love learning all this stuff regardless lol

[@md.riyasathossain590]

Thank you, Sir! It did helped me a lot in learning how hash functions actually work! And also Thank You for simplifying the concept!

[@RubeniAlimasi]

Learned a great deal of things thanks to this video. Thank you.

[@volodymyr9400]

Hi bro. it looks like someone stole your content kzbin.info/www/bejne/rJibioSjo6yNgbM and also he pointed that he made this video))) you should ban him for that w/o the link to your channel.

[@simplyexplained]

Thanks for notifying me!

[@kgreene104]

Good job. Studying for Security+ exam here and the cryptography has been one thing I've found it hard to get into. It helps to have different explanations of it.

[@drrider100]

Agree. Getting ready to take mine. The more I read the more confusing it is for me. But this video just explained it all. I am no. Longer confused.

[@julianvw3203]

Just write a dumb sentence like this: Ifind2eggsinmy4bedrooMHousetodaysoblueistheSKY!!

[@tomgi859]

Awesome video, very friendly and pleasant to watch! about dropbox- if they're not saving the keys in their db's, where do they save them? physical devices maybe?

[@walterlol]

Excellent video but I am not understanding something: You use salt to generate a unique hash from a password (string). When a user re-logins and you want to see the hash of his password you would also have to RE-ADD that same "unique salt" that was given when the user created the account. How do you know that "unique salt" if it was randomly generated?

[@ifqi.r]

Same I don't understand this

[@Maxxxxxxxxxxxxxxxxxxxxxxxxxxxx]

You store the hashed password with the salt When you login, it checks if your login user/email exists in the db, if yes, then it adds the salt to the password you typed, then hash the combination and check with the hash

[@walterlol]

@@Maxxxxxxxxxxxxxxxxxxxxxxxxxxxx What if I get access to the salt you used to store the password? Isn't that a single point of failure?

[@Maxxxxxxxxxxxxxxxxxxxxxxxxxxxx]

@@walterlol yes but for that to happen, they would've already got access to your database. I probably forgot to mention that the salt is usually 32byte or 64byte

[@chinonsoiwundu5782]

You mentioned something about encryption key being kept separately, how can it be queried to work on the web application? Kindly put more light

[@govindmenon2196]

Savjee next video should be about delegated proof of stake

[@jakub9640]

Cyber Security Dev: So which password protection do you want to use? Dropbox: y e s

[@nosuchthing8]

Yes, but it's a pain to have original passwords for all your services. It's possible to have hundreds of passwords these days..

[@iceman71true12]

so regardless of the fact that each of these different methods can be breached, best course of action is to have two forms of logging in to your account a text message to your phone that you have to input when logging in to an account.

[@theuberlord7402]

The Imgur incident is misrepresented in this video. They did not store the passwords in plaintext, the hashes were solved and leaked.

[@PaulinaJuba]

Is hashing possible for other things like live facial recognition or fingerprints?

[@abubakar.khawaja]

One thing I don't understand about hashing is that how does our login info is validated although hashing is irreversible.

[@danielmihajlovski]

Change the unique hash stored on the database for the same password the user uses, every time the user signs in?

[@8080VB]

I wish if they renamed cost to "pepper". It is more deserving one tbh.

[@LuigiCotocea]

I remember when i used *password* on a minecraft server and my acc was hacked!

[@davidsargsian4257]

I severely doubt anyone has the same password as me... because... goddamn

[@junelljabrica5954]

If there are numerous layers of protection around the passwords then how can the system check whether the password you've entered is correct?

[@alejandrod.2036]

In the Dropbox example, its Encryption => bcrypt => Hash => Password. Essentially, they work backwards. First, they receive your password in plaintext which you enter into whatever login screen. Then, they hash it, and then use bcrypt on it. They will then retrieve the stored password hash from their databases, and decrypt it. At this point, the password you sent to them has been hashed, and bcrypted, and the password they stored has been decrypted, so if they are the same password, it should be equal. If they are equal, then that means you entered the correct password.

[@junelljabrica5954]

Ohhh thank you

[@dev-bv5zg]

I use a extremely long custom hashing method for my server that uses many variables indented to that user only

[@SilentPixel]

[Hash + salt] Question: How can you compare passwords if the hash alters when entering the same password? ex. Bob and Vagene have the same passwords "sendNudes". Both will have different hash. Bob logs in. How would you compare Bob's inputted password to the one in storage? This has been eating at me! I NEED ANSWERS!!! pls

[@dhliu9687]

Thank you sir Nice explain !!! thumb up

[@LiEnby]

on 'TamaTown Rewrtten' ii do sha512 then xor the resulting hash with some random bytes then sha512 it again the original game however stored them in plaintext as there reset pass thing expects to just.. get the password back

[@Latajacaryba]

I don't get it. So what's the Bob's password now? qwertVNc4BdR20n? How will Bob log in if his password as well as Alice's password have been changed?

[@AbcVids]

Password not changed but hash is

[@Sergio0694]

Nice video! I have a question: what about saving each password with its encrypted version, using the password itself as encryption key? This way each stored password would have a unique encryption key, instead of a single AES key shared among all the saved passwords.

[@neoxr9655]

But how would you store the key? That kinda just adds an unnecessary step without gaining anything

[@eisnichversnich5338]

Why don't you explain how to get the HASHES!!

[@florisr9]

That was not the point of the video. If you want to know the algorithm of a hash function you can look it up.

[@c0smo709]

Ever heard of google?

[@MisterSkraetsch]

nice video and very well explalined - thanks a lot!!!! :)😁👍✌️

[@himanshu4807]

wow......thank you so much...keep it up plzzz

[@ziomanzo]

You really explain things simply ✌️

[@rosalyna_24]

thank you so much for this vid it is very informative

[@muhammedsiddeek4068]

Are you a hacking student?

[@virendravijay6699]

first of all how to get the password in hash form?

[@lucasguaru]

On 4:38 you said to use different salt but I can't see it happening. If I use different salt, when I have to check the password, I would not know the used hash. If I keep it on the database, I would have the same problem as leaking the password. What I'm missing?

[@joeldagatan5845]

and how i know my hash code??

[@Davegbuf]

Excellent video and explaining the technology. However, I have a situation where I don't know how I would adapt the concepts you explained because the scenario is slightly different. Your example works interactively by comparing user passwords with stored hash values. My scenario is for an automated process (no user interaction at all) and the credentials are self-contained in the program package. These must not be known to the user or anyone who can get a hold of the file(s) containing them. Here is a live example … We have a company application that requires administrative rights to execute but our users only have standard Windows user permissions. I repackaged the application into a single EXE executable script to conceal the admin credentials that are included in the script code. However, I discovered that compiling the script is not enough because the EXE file can be decompiled or someone can use other programs to see the contents. How can I adapt the concepts you explained in your video this my scenario? I need to be able to execute a self-contained application package locally (no network or internet resources) and with specific credentials while protecting said credentials from the local user or anyone who might get a hold of the EXE file containing the credentials. The application needs to use these credentials at run time to perform its tasks. Your insight is most appreciated.

[@Monkey31]

I don't have Twitter and don't use Facebook. I'm computer dumb. I would like to contact you with something. Do you have an email?

[@eswarprasad9773]

Not only to maintain unique hashes...salting also provides extra security for example you can either append or prepend salt data..that requires lot of effort from hacker to figure out

[@TuxHouseEdu]

Thank you

[@Lollipop2018]

Wow. perfect video!!

[@MiRaje8086]

This is awesome man, thanks for explaining.

[@ozzyfromspace]

When you put up that list of the top 10 passwords, I was like, “been there, done that” 😂. These days I let my Apple devices generate and store codes for me

[@saidkarimsaidmahmudov3048]

Well, it was really helpful video

[@ramanabalachandhran]

Thanks a lot for the succinct adumbration. And by the way. 04:11 ROFL 😂

[@jethrotancailles2292]

Who to hash the letter guys hahah

[@beholdandfearme]

How secure is smashing the keyboard at random while alternating the shift key?

[@mck9512]

Ok, so do qwerty i add a salt. But the next time the user logs using qwerty, i need to add the exact same salt. Where do i store it?

[@danielf.7151]

in the database like the password hash

[@mck9512]

@@danielf.7151 makes sense, thanks

[@apoorva5810]

How to get the hash text?

lol I love unicorns 😅

[@maliqattan]

Very nice descreption. Loved it. Thank you very much ❤❤❤

[@nevadalobelio5933]

How to get the hash please

[@xMAJxgames]

Thanks 👌👀

[@pcosgrove52]

thanks agfain...

[@parta_usti6219]

Well explained! Why don't companies put a limit on number of login trials a computer can have? For example, can't they just reject the user for a limited period of time if they enter totally wrong credentials?

[@simplyexplained]

Sure they can! But in this video I'm talking about a scenario in which an attacker has managed to breach the database and has all the (hashed) passwords in his possession.

[@jamesedwards3923]

Ahh , that is not what he is talking about. If somebody stole the database of passwords. That is what he is referring to. For example a keypass file. Is a store of encrypted passwords. If somebody stole my drive and got them. They can pound on it forever. Eventually I will be long dead and turned to dust. The reason 'Dropbox' does all this is not just for a website long in. It is in case somebody steals the hashed and encrypted storage. You still have a lack of understanding about how this works. As far as the end user logging into a website.

[@w0ttheh3ll]

great video

[@youssefAbdelMagid]

very good video , I learned the concepts in a very good way... can you kindly do a simple javascript project to make the 3 kind of protection (hashing + bcrypt + encryption) to show us how to do it practically as well

[@chriseaguilar7]

Great video!

[@rain_altman_009]

NICE VIDEO

[@Fluli]

How do they compare the hashes if there is random salt?

[@joyanfernandes]

Salt is stored seperately alongside the password..

[@basmamp4834]

Very informative one.. Liked it.. Well explained!! 💯

[@LuisFelipe-pq9lr]

This video was incredible, thank u so much

[@declanz5067]

Awesome video - very easy to understand and succinct, it flowed well too - very helpful thank you!

[@amicam5459]

brilliant

[@dimitrisfou6908]

u are best

[@tymothylim6550]

Thank you very much for this video! Certainly learnt a lot from this and would be learning more about it in detail :)

[@MikeHunt-rw4gf]

Algorithm.