Storing passwords safely

Cyber security Lesson 7 2:08 English narration · English + 中文 subtitles burned in

space play · ←/→ 5s · j/l 10s · f fullscreen · ,/. speed

Chapters

Transcript

Start with what must never happen. 先说绝对不能发生的事。

If a site stores passwords as plain text and is breached, every password is readable the moment the file leaves the building. 如果一个网站把密码存成明文，一旦被攻破，那份文件离开机房的那一刻，每一个密码都是可读的。

And because people reuse passwords, their other accounts fall too — one careless site takes down email, banking and everything else. 而因为人们会重复使用密码，他们别的账号也跟着倒—— 一个不上心的网站，能把邮箱、网银和其他一切一起拖下水。

So sites store a hash instead. 所以网站存的是哈希。

A hash function turns any input into a fixed-length string, and the same input always gives the same hash. 哈希函数把任意输入变成一个定长的字符串，而同样的输入永远给出同样的哈希。

Going forwards is easy and instant. 往前走是容易的、瞬间的。

Going the other way — from the hash back to the password — is not merely hard, it is impossible in practice. 往回走——从哈希倒推回密码——不只是难，在实践中是做不到的。

That is what one-way means, and it is why a stolen hash is not a stolen password. 这就是"单向"的意思，也是为什么被偷走的哈希不等于被偷走的密码。

Which raises the question students always ask: if it cannot be reversed, how does logging in work? 这就引出学生总会问的那个问题：既然倒推不回来，那登录是怎么成的？

Like this. 是这样的。

You type a password. 你敲进一个密码。

The site hashes what you typed. 网站把你敲的东西做哈希。

It compares that to the stored hash. 再把它和存着的那个哈希比对。

If they are equal, you are in. 相等，你就进去了。

Nothing was reversed — the site never learns your password, it only checks that two fingerprints match. 没有任何东西被倒推—— 网站从来不知道你的密码，它只是在检查两个指纹是否一致。

One more step, and it is not optional. 还有一步，而且它不是可选的。

If two users choose the same password, their hashes are identical — which tells an attacker something, and lets them crack two accounts for the price of one. 如果两个用户选了同样的密码，他们的哈希就一模一样—— 这既向攻击者透露了信息，也让他破一个等于破两个。

So add a random string, called a salt, before hashing. 所以在做哈希之前，先加上一个随机字符串，叫做"盐"。

Now the same password gives different hashes. 现在同样的密码会得到不同的哈希。

Salt also defeats rainbow tables: pre-computed hashes of common passwords. 加盐还能打败彩虹表：那是常见密码的哈希预计算表。

Four things to take with you. 带走四点。

One: never store a password as plain text. 第一：绝不把密码存成明文。

Two: store a hash — a fixed-length, one-way fingerprint. 第二：存哈希——一个定长的、单向的指纹。

Three: logging in hashes what you typed and compares. 第三：登录时把你敲的东西做哈希，然后比对。

Four: always salt, so identical passwords hash differently. 第四：一定加盐，这样相同的密码也会得到不同的哈希。

Now hash a salted password in the task below. 现在去下面的题里给一个加盐的密码做哈希。