In the last lesson, we looked at the most basic level of authentication, which is simply through the 1
use of an email and password. 2
And as we saw, this is perhaps a little bit lacking in security when we can very easily go into our 3
database and see any user's password in plain text. 4
This is very, very bad practice. 5
Every so often you might hear in the news a website or a company is somehow hacked and all their users 6
information is leaked into the wild. 7
So you might have heard of the Ashley Madison hack or the Experian hack, but lots of these websites 8
end up being prosecuted, in fact, and may have to pay a fine for not storing their user's data in 9
a secure fashion. 10
So it's not just about angry users, 11
there are also legal implications, which is why we need to think about these things very carefully. 12
If storing a user's password as plain text is the worst possible way of securing it, 13
I mean, it's not to say that this is immediately going to lead to problems, because if you're a normal 14
user accessing the website and you try to View page source or look through the code on the front end, 15
you won't be able to find anything because those things are stored on our back end on our servers, 16
and the database isn't easily accessed. 17
But still, there is enough precedent where this has happened, and we need to think about securing 18
those passwords more carefully. 19
That leads us to the topic of Encryption, which is something you might have heard of already. 20
It's defined in the dictionary as, "The process of converting information or data into a code..." which 21
can also be called a cipher. 22
And the main reason is to prevent unauthorized access so that people can't view that sensitive information 23
easily. 24
A really simple example of encryption is something called the Caesar Cipher, which is named after 25
Julius Caesar. 26
This is an extremely simple form of cipher where we take the alphabet and we have an encryption key. 27
So let's say that the key is 4. 28
What this means is we shift the letters by 4, 29
so that means that A becomes 1, 2, 3, 4, it becomes E. 30
So then the alphabet looks something like this. 31
That means if a user tried to type the secret which they wanted to encrypt, and this equaled A, B, C, 32
when this is encrypted using the Caesar cipher, then it becomes E, F, G. 33
So then this part is transported or it is stored on a database, or it is in Caesar's case, put into 34
a letter and passed through enemy territory, 35
and once it reaches the other end, because the recipient knows what the encryption key is, they can 36
then go back through that process and take the each letter and reverse it through four steps in order 37
to end up with the original message, which is A, B, C. 38
You can try this out yourself on a website called cryptii, and you can see how you can take plain text 39
and write something like, "Hello". 40
And once you get the code or the cipher text, you can see it has been automatically shifted by 4 41
in this case. This is the encryption key 42
and this is the important part that hopefully the recipient already knows. 43
So you can change this as much as you like, 44
and you can see that just by somebody looking at the ciphertext, 45
they might think this is a foreign language. 46
They might not know what the actual answer is. 47
But of course, there is a very simple way of decoding it by simply taking that key, that shift amount, 48
and applying it to the ciphertext. 49
We've already looked at encryption, so taking the user's password and securing it using an encryption 50
key, and then using a particular Cipher method, be it a Caesar cipher, or the Enigma cipher, or a 51
modern cipher method like AES. 52
No matter which way we chose, we always had a password, a key, and we ended up with some ciphertext, 53
which will make it hard for people to be able to immediately guess what our user's password is. 54
So for example, if we took a password like qwerty and we used the Caesar cipher method and we decided 55
to shift it by 1, then our encryption key is the number 1 56
and that creates the ciphertext, where every single letter is shifted up by 1. 57
Now, in order to decrypt this, all you have to do, as long as you know what the key is, then you 58
can simply shift all of the ciphertext down by 1, and you end up with the original password. 59
The Caesar cipher is a very, very weak encryption method. 60
It's incredibly easy to figure out what the original text was, even if you didn't have a key. 61
And just to illustrate what bad things can happen when you have a weak encryption system, I'm going 62
to tell you a story from history that tells us why we should not be using a weak encryption system. 63
So back in the 1500s, on this Island that we now call the United Kingdom, there used to be two large 64
areas. 65
One was Scotland and the other was England, and they were ruled over by two Queens. 66
Scotland was ruled by Mary, Queen of Scots, who was a Catholic, and England was ruled over by Queen 67
Elizabeth I. 68
Now these two ladies between them controlled the land that we now call the UK. 69
But they each wanted to have more power and more land, 70
so what did they do? 71
Well, Mary, Queen of Scots, who ruled over Scotland, decided to plot with her friend Lord Babington 72
to try and assassinate Queen Elizabeth, 73
that way, she would be the legitimate heir to both the English and Scottish throne. 74
And it was kind of a Game of Thrones kind of situation going on back then. 75
But in order to mobilize their forces or try to come up with some sort of secret plan, they decided 76
to send letters to each other using ciphertext. 77
So they came up with a system to encrypt their letters to each other such that if it fell into the wrong 78
hands, the subject of the letter wouldn't be revealed and they wouldn't end up being tried for treason. 79
But the problem was that the encryption method that they used, which was a letter substitution method 80
similar to the Caesar cipher, was a very weak form of encryption, and Queen Elizabeth had a chief 81
decoder who ended up deciphering their letters and figuring out what their encryption key was. 82
So he decided to take this encryption key and write a letter back to Lord Babington to try and get him 83
to reveal all of the co-conspirators. 84
And what was the end result of having their weak encryption system? 85
Well, Queen Elizabeth decided to accuse Mary, Queen of Scots, of treason, and hence she ended up 86
having her head chopped off. 87
So this is not what you want to happen to you or your website. 88
So weak encryption systems can end up putting user passwords at risk, and your company might end up 89
metaphorically decapitated, such as in the case of companies like TalkTalk or Equifax, where they 90
ended up getting hacked and lost a lot of the trust of their users. 91
Now, if you're interested in more stories like this and to learn more about cryptography and encryption, 92
there's a really great book recommendation that I would make called The Code Book by Simon Singh. 93
It contains stories like the one that I just told you and more. 94
So if you're interested in this, go ahead and read more about it. 95
In modern days, we use something far more secure, which is called AES 256, 96
And this has a whole bunch of math applied, 97
but at the end of the day, the essential process is still the same. 98
We have some plain text and then we have an encryption key, which is something that you keep top-secret 99
and you don't pass along with your text. 100
And we can go ahead and encrypt the string using AES, you can see that the result is much, much longer. 101
It's very hard to work out how many letters the original text had, but if you were somebody who's meant 102
to receive this message and you receive it, and then you know that the encryption key is, for example, 103
in this case TOPSECRET, then you can easily decrypt it into the original message. 104
Now there is just one weakness to this situation if we're thinking about storing passwords, 105
and that is the fact that this type of encryption or this type of obfuscation is symmetrical. 106
So it means that if somebody happens to get hold of this super important encryption key and you encrypt 107
everything in your database using this particular method, AES 256, so no matter how strong 108
it is, if they get hold of this particular thing, then everything else collapses and they can work 109
out everybody's secret. 110
They can work out everyone's password by simply decrypting it using that same key, which is not what 111
you want. 112
How can we make our password more secure? 113
At the moment, the biggest flaw in our authentication method is the fact that we need an encryption 114
key to encrypt our passwords and decrypt our passwords. 115
And chances are that if somebody is motivated enough to spend time and hack into your database, then 116
it's probably not that difficult for them to also be able to get your encryption key, even if you've 117
saved it in an environment variable or somewhere secure on your server. 118
So how can we address this weakest link the need for that encryption key? 119
Well, here is where Hashing comes into play. 120
Whereas previously with encryption we needed that encryption 121
key, hashing takes it away and no longer requires the need for an encryption key. 122
Well then you might ask, well, if we don't have an encryption key, how can we decrypt our password 123
back into plain text? 124
Well, the secret is you don't. 125
Let's say a user registers on our website and they enter a password to register with. 126
We use something called a Hash function to turn that password into a hash, 127
and we store that hash in our database. 128
Now, the problem is that hash functions are mathematical equations that are designed to make it almost 129
impossible to go backwards, so it's almost impossible to turn a hash back into a password. 130
How is this possible, you might ask, how is it possible that you can turn a password into a hash very 131
quickly and easily, but make it almost impossible to turn that hash back into a password? 132
Well, here's a question. 133
Let me ask you, 134
what are the factors of 377 other than 1 and 377? 135
So basically I'm saying 377 is not a prime number. 136
Not only can you divide 377 by 1 and 377, but there's also two other numbers that you can divide 137
it by. 138
Now it's your job to figure out what those numbers are. 139
So what might you do. 140
Well you might divide it by 2, okay 141
so that becomes 188.5. 142
That's not a whole number. 143
So 2 is not a factor. 144
What if you divide it by 3? 145
Well, that becomes 113.3 recurring which is also not a whole number, 146
so 3 is not a factor either. 147
And you might go through this process for a long time tediously going through number by number. 148
Well, then you might arrive at the point where you divide 377 by 13 and you end up with 29. 149
So 13 and 29 are the answers to this question. 150
They are the only factors of 377 other than 1 and 377. 151
And as you can see, that process of getting to this point of finding those two factors took us a while, 152
right? 153
It wasn't that easy. 154
But consider if I asked you a different question, 155
if I said to you, can you multiply 13 by 29? 156
Well, you would be able to do that really quickly and easily. 157
It would take you almost no time at all to figure out that the answer is 377. 158
So here is a very, very simplified version of a hash function going forward, multiplying 13 by 29 159
is really quick and easy, but going backwards, trying to get back those numbers 13 and 29 starting 160
from 377 is very, very time consuming. 161
This is essentially how a hash function works. 162
Just add a little bit more complexity and you end up with a real hash function. 163
They're designed to be calculated very quickly going forwards, but almost impossible to go back. 164
And by almost impossible, I simply mean that using current levels of computing power, it would take 165
far too long to make it worthwhile for the hacker. 166
So let's say that to calculate the hash going forwards, it takes a millisecond, 167
but to go backwards it takes two years, 168
then that hacker probably has better things to do with his time. 169
So when a user tries to register on our website, then we ask them for the registration password, which 170
we turn into a hash using our hash function, 171
and then we store that hash on our database. 172
Now, at a later point, when the user tries to log in and they type in their password, then we again 173
hash that password that they typed in to produce a hash, and then we compare it against the hash that 174
we have stored in our database. 175
And if those two hashes match, then that must mean that the login password is the same as the registration 176
password as well. 177
And at no point in this process do we have to store their password in plain text, 178
or are we able to reverse the process to figure out their original password. 179
The only person who knows their password is the user themselves. 180
Now, hashing also comes along with its own problems though, because as soon as you come up with a 181
problem, then some motivated hacker will come up with a solution. 182
And in the next lesson, I'm going to show you how we can hack our users passwords. 183
So for all of that and more, I'll see you there.