Please pass the salt: Serve up passwords with a side of entropy
summary
Passwords must be hashed not encrypted, using bcrypt/argon2/scrypt with per-user salts and a tunable work factor so each hash takes about a half-second work factor to compute; that protects against rainbow tables and forces attackers to brute force each account. Historical breaches: Yahoo (MD5/unsalted, ~1B accounts), Adobe (unsalted encryption, 2013), Quora (100M, bcrypt, 2018). GPUs can reach 350 billion guesses/second, so require long random passwords (12+ chars) and TOTP or password managers.
AI-written summary · about
chapters (17)
- 0:00Password storage security
- 1:16Password storage importance
- 4:45Hashing vs encryption
- 10:20Password storage failures
- 13:27Password entropy
- 19:25Rainbow tables exploit
- 21:13Salt in password security
- 22:37Work factor explained
- 24:19Quora’s bcrypt case
- 26:49Password storage best practices
- 28:32Kerckhoffs’s principle
- 29:15Multifactor authentication
- 32:23Password managers
- 34:28Password policies
- 37:38Salt per user
- 39:42Q&A: Hashing alternatives
- 42:33Closing remarks
related talks
46mCryptography For Beginners
27mKeeping passwords safe in 2017
30mhunter2: A Symphony of Password Horror
25mEverything You Know About Passwords Is Wrong
14mPasswords. Are. Not. Hard!
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts
42mPassword Hashing
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts