How NOT to Store Passwords! - Computerphile

TL;DR

Storing passwords in plain text or using basic encryption is insecure. Hashing and salting passwords is the recommended approach.

Transcript

the title this this video should be can we have this the turn this video should be how not to store passwords thank you um because you you really shouldn't store passwords yourself if you can all avoid it if you are running any kind of web service and and you are storing passwords it is so incredibly easy to get it wrong that basically you shouldn'... Read More

Key Insights

• 🏪 Storing passwords in plain text is highly insecure and should be avoided.
• 🔑 Encrypting passwords with a common key is a step up from plain text, but still has vulnerabilities.
• #️⃣ Hashing passwords without salting them can be cracked using common hashes and rainbow tables.
• 🔑 Hashing and salting passwords provides a more secure approach to password storage.
• 👤 Using a unique salt for each user makes it extremely difficult to retrieve the original password.
• 💱 Changing even one bit in the password file can completely change the hash, adding to the security.
• 💪 Implementing a strong hashing algorithm and a long random salt further enhances password security.

Questions & Answers

Q: What is the naive approach to storing passwords?

The naive approach is to store passwords in plain text, which is insecure because it exposes user passwords to potential breaches.

Q: How does encrypting passwords improve security?

Encrypting passwords with a common key adds a layer of security, but it is still risky as the key can be compromised and all passwords decrypted.

Q: What are the vulnerabilities of using hashing to store passwords?

Hashing passwords without salting them allows attackers to search common hashes and use rainbow tables to crack passwords more easily.

Q: How does hashing and salting improve password storage security?

Hashing and salting passwords make it difficult to retrieve the original password as the hash is a randomized string and each user has a unique salt.

Summary & Key Takeaways

• Storing passwords in plain text or with basic encryption leaves them vulnerable to hacking and insider attacks.

• Encrypting passwords with a common key still poses security risks, especially if multiple users have the same password.

• Hashing and salting passwords, using a random string for each user, provides a more secure approach to storing passwords.