680,000 Plaintext Passwords: An Open Source Love Story in Three Acts

on YouTube ↗31m

" summary

A migration case study: a white‑hat extraction turns up 80,000 passwords captured in 87 seconds using off‑the‑shelf tools like hashcat and wordlists, revealing a flawed global‑salt SHA1 scheme. Response builds: per‑user salts, bcrypt (cost tuning) and an automated in‑place upgrade path that converts users as they log in; estimated brute‑force work jumps from seconds to 84,000 years. Also fixes a pain point by creating a rake-compiler devbox for building the C/JVM bcrypt extensions; production CPU usage doubles but authentication stays secure and usable.

AI-written summary · about

" chapters (11)

1. 0:00Open-source love story intro
2. 2:13Plaintext passwords danger
3. 5:22Hashing passwords securely
4. 10:20Cracking passwords with Hashcat
5. 14:30Bcrypt versus older hashing
6. 18:42Bcrypt adaptive cost
7. 20:30Converting passwords to bcrypt
8. 24:02Becoming bcrypt-ruby maintainer
9. 27:58Fat binary gems struggle
10. 28:39Open-source collaboration
11. 30:27Three key lessons

" related talks

• 29m80,000 Plaintext Passwords: An Open Source Love Story in 3 ActsT.J. Schuck · Red Dot Ruby Conference 2014
• 25m80,000 Plaintext Passwords: An Open Source Love Story in Three ActsT.J. Schuck · Cascadia Ruby 2014
• 34m80,00 Plaintext PasswordsT.J. Schuck · Rocky Mountain Ruby 2014
• 36mThe Slower the Stronger: A Story of Password Hash MigrationTomasz Borowiec · JDD 2018
• 40mLive autopsy of a password: lessons learnt cracking secretsNiclas Kjellin · Øredev 2023
• 30mhunter2: A Symphony of Password HorrorLilly Ryan · PyCon AU 2017
• 51mThe Slower the Stronger: A Story of Password Hash MigrationTomasz Borowiec · GeeCON 2019
• 43mPlease pass the salt: Serve up passwords with a side of entropyBrad Wood · Jfokus 2026