All right guys. 1
So now that we've covered creating user passwords, encrypting our database as well as hashing passwords, 2
we've kind of reached a level of security that most websites are at. 3
Now there's a lot more security that we're going to learn about a little bit later on, but you're actually 4
at a point where you already know quite a lot about authentication and keeping user passwords secure, 5
and definitely a lot more than a lot of people who actually run websites. 6
And I know that some of you guys are keen to get a job, and if that is you, then I want you to go 7
on to a website called plaintextoffenders.com. 8
I'll link to it in the course resources. 9
But here, what you'll find is emails that come from various companies where the user has requested to 10
reset their password, and they're sending the user a plain text version of their password. 11
Now, at this point, we know to be able to even get the user's password in plain text, 12
it means that they're doing some horrible things with securing the passwords. 13
Either it's encrypted and there's an encryption key somewhere that they're storing, or it's simply 14
just stored on their database as plain text, which is the worst possible type of security. Given that 15
you already know a lot better than the people who run get getlinuxjobs.com or worldsim.com or Telecomegypt, 16
then you could actually just email these people and tell them that, "I'm a web developer, and I 17
know about authentication and securing user's passwords. 18
You obviously seem like you might need some help, 19
would you like me to work for you?" 20
I recommend giving that a go if you're keen on getting a job. 21
If you're not looking for a job, then have a look at these websites and if you're signed up to any 22
of them, be sure to delete your account because it's definitely not secure. 23
And this is why a lot of companies and a lot of websites get hacked, 24
because they don't continue beyond this point. 25
So that means it's a really good time to talk to you about how passwords are hacked. 26
So a sort of, "Hacking Passwords 101 Class," if you will. 27
Now, most of the time I use my programming powers for good, 28
but in this case, I want to talk to you about how passwords might be hacked so that once we understand 29
how the other side approaches this problem, then we can learn more about security and make our website 30
safer for users. 31
And by the way, I have no idea why hackers are always portrayed in a balaclava, 32
it's not like they're going to burgle anybody. 33
I mean, especially this guy, 34
he must be incredibly warm sitting next to all these computers wearing so much clothing on his face, 35
but I digress. 36
As a company, this is probably one of the things that you least look forward to, the day when you wake 37
up and you get a call and you've been hacked. 38
And this has happened really recently to a lot of big companies like Adobe Creative Cloud got hacked 39
in 2013, LinkedIn got hacked in 2012, and there's loads of accounts where their passwords get leaked, 40
lots of unhappy users who reuse their passwords and are feeling extremely vulnerable. 41
And you can see that even to this day, people can purchase these hacked accounts where people might 42
not have realized that their LinkedIn email and their passwords are linked, and people are potentially 43
buying that data up and using it to hack into their PayPal accounts or other similar payment portals. 44
So even if you don't learn anything from this lesson, I recommend just going to this website. 45
I'll link to it in the course resources just for educational purposes, but put in your email address 46
and make sure that if you do have any passwords that show up, change all the places where you use that 47
password. 48
But why is it that all of these big companies are getting hacked and leaking their users passwords? 49
Are they not at least encrypting or hashing their passwords? 50
Well, they are, but consider this. 51
So you're a hacker and you've managed to get into the LinkedIn user database. 52
And just for simplicity's sake, let's say it looks like this. 53
You've got a username and you've got a hash. 54
And thankfully they didn't store their users passwords in plain text, so you can't access their passwords 55
straight away. 56
However, if you look at this table a little bit more closely, you will realize that three of the hashes 57
are completely identical. 58
Now, why might that be? 59
Well, remember that the same password always turns into the same hash, no matter how often you try 60
it, 61
and that's a core part of the hash function that we rely on in order to validate our users as well. 62
So that means a hacker 63
would look at this table and realize that Angela, Tony, and Emily all have the same password, and 64
what they can do is they can start to construct what we call a hash table. 65
So you would take some of the most commonly used passwords, and you would use the same hash function 66
to create the hash value for each of those. 67
And these are some of the most common passwords that people love to use: 68
123456, querty, password, 111111. 69
And so you generate this hash table, 70
and then all you have to do is just look up the hash of the user and compare it against the hash you 71
have in your table. 72
So you search by the hash value and you land upon the password, which is qwerty. 73
So now you figured out that three out of four users in this table all have the same password, and it's 74
qwerty. 75
So what if they didn't use one of the most common passwords and instead they used something else, say, 76
their date of birth or their pet's name? 77
Well, let's see how we would make a hash table 78
if we were a hacker. 79
You would probably start with all the words from a dictionary. 80
And this is where the terms dictionary attack comes from. 81
You create hashes from all the possible words in a dictionary, and that will only be about 150,000 82
hashes that you would need to create. 83
And then you add to that hash table, or the numbers from a telephone book and all the combinations 84
of characters up to six places. 85
And then you add all of these together and you end up with something close to 19.8 billion combinations, 86
which admittedly sounds like a large number. 87
Right? 88
How long would it take your computer to calculate that many hashes? 89
So what do we do? 90
Well, let's go shopping. 91
Let's go and buy some of the latest GPUs or graphics cards, which are capable of parallel processing 92
and therefore are particularly suited to not only Bitcoin mining, but also generating hashes. 93
With one of the latest GPUs you can calculate about 20 billion MD5 hashes per second. 94
So that means with our hash table of 19.8 billion combinations, it'll only take one of these GPUs 0.9 95
seconds, which is nothing. 96
It's not a lot of time to invest in order to hash so many people's passwords. 97
And to make it even worse, large hash tables have been built for the most common passwords. 98
So because we've had so much data from previous hacks such as the Adobe one or the LinkedIn one or TalkTalk 99
or Equifax, we know what the most common passwords are that people use, and every year company like 100
SplashData will compile 101
what are the most common passwords, say, the top 25. 102
And this is where all of those values that went into our table came from. 103
But you can actually go one step further, 104
there are pre-built hash tables that people have created for the top 10,000 most common passwords, 105
and you can see that MD5 is one of the quickest hashes to calculate. 106
And this is why it's very, very common to find MD5 hash tables. 107
And you can even use Google as a basic hash table. 108
You can paste in the hash that you found from the hacked database, 109
you perform a simple Google search and you come up with the original password. 110
If at this point you're extremely scared and you're wondering, well, what exactly can you do about 111
this? 112
Well, consider that in our user table, there was one hash that was extremely difficult to find, and 113
it didn't match up with any of the hashes in this little simple hash table we built. 114
So what if we put that into Google to search on a larger scale and see if it matches any of the hashes 115
in the hash tables that people have generated? 116
And it doesn't, it doesn't match anything. 117
And the reason is because when John created his password, he had a very, very strong password with 118
uppercase letters, lowercase letters, numbers, symbols, but most importantly, a long password. 119
When you think about hashing as a mathematical formula, you'll realize that as the number of characters 120
of your password increases the computation time that it takes to crack it increases exponentially. 121
So it doesn't matter if your account on LinkedIn or Adobe Creative Cloud or Ashley Madison was cracked, 122
as long as you had a strong password, 123
they 124
wouldn't be able to work it out from a hash table. 125
As an example, there's a website called Password Checker and you can put in your password and it'll 126
tell you not only the strength, but also how long it will take various types of machines to be able 127
to crack that password. 128
So let's say that I create a six character password composed of a random set of characters, right? 129
One two, three, four, five, six. 130
And you can see that even for a standard desktop PC, it only takes about three seconds to perform a 131
brute force attack to crack that password. 132
But let's see what happens if I add another six more characters. 133
One, two, three, four, five, six. 134
Now it takes 31 years for a standard desktop PC to be able to crack it, and even a fast GPU takes two 135
years to crack my password. 136
So even though all of the websites encourage you to add a capital letter, a lowercase letter, some 137
numbers, and some random characters if you only have six characters in your password, so a short password, 138
it still doesn't take very long to crack. 139
So the most important thing of creating a strong password that is almost uncrackable is just to increase 140
the number of characters. And also to prevent yourself from being a victim of a dictionary attack, 141
just make sure that you don't use a dictionary word or a place name or something that is in a directory 142
somewhere, like a telephone number. 143
All right, so at least after this lesson, you'll know how to keep yourself more secure. 144
But in the next lesson we're going to address these vulnerabilities that occur because of weak hashing 145
algorithms 146
and we're going to learn how we can combat hackers who try to attack our database using a dictionary 147
attack or by creating a hash table. 148
So for all of that and more, I'll see you on the next lesson. 149
But as a quick bonus, if you ever want to trick your friends into thinking that you're some sort of 150
a hacker, at least according to Hollywood, I recommend checking out a website called, hackertyper.net, 151
where you can just mash the keyboard and you end up with something that looks extremely realistic. 152
But word of warning, try not to do this on an airplane or in a government building unless you want 153
to actually get investigated.