In a perfect world, my password would be a long, unique code and have absolutely nothing
to do with my pets, birthdays, partners, hometowns, sports teams or whatever… but that's hard.
Hey there says-a-me's thanks for being open to DNews.
I'm Trace.
Having a slew of stupid passwords for all the websites we interact with or, *ahem* one
password for everything like some people…
Is just so taxing.
Passwords suck.
They suck bad.
But without security, there's no online shopping, true identity protection, or mobile banking…
basically, the way the web works now, you need passwords to be a fully functioning member
of internet society.
But how the heck do they work?
Firstly, passwords aren't exactly in a safe in the basement of your bank.
They're saved in a password database stored on a company's server or in the "cloud" (which
is really just another company's server, usually one of Amazon's).
These things can (and are) hacked.
So, companies have to encrypt your password!
This involves math and some tricks to keep the hackers busy, slow them down, or just
mess with hacking software.
When you create or change a password: let's say "Password123" // please do not tell me
that is your damn password // The first thing a smart company will do is "hash" it.
Hashing is a real term.
It means applying a one-way mathematical formula to the password text.
Hashing changes passwords of any length into a standard set of seemingly-random characters.
One hash standard, MD5, was created in 1992 by an MIT computer scientist and uses a 128-bit
encoding.
It's not important to understand, just know that it happens.
Hashing keeps just anyone from being able to read passwords.
No one wants a shady employee literally reading everyone's private information, so instead
MD5 turns "Password123" into this, and Password1234 into this.
See how these are completely different?
Hashing is sometimes referred to as a password "fingerprint."
At that point, the hash literally becomes your password!
It's saved in a database, waiting for you to log in next time.
When you (or a hacker) wants to access the account: you type your password, the site
hashes it, and then compares the new hash to the one on the server.
If they match, you're in!
The thing is, MD5 is pretty old standard now, so newer algorithms create more secure salted
hashes -- again, official terms!
Salted hashes add complexity by generating chunks of data and plopping it into the hash.
One encryption of 'Password123' with the salted hash algorithm bcrypt looks like this.
It adds dollar-sign, two, 'a', dollar-sign to the beginning -- that's simple salt!
Computers aren't great at problem solving, so even this little change can fumble automated
hacking programs; especially if the algorithm puts the salt in a different place for different
users!
Then, even if I hack Bob, I can't use the same salted hash formula to hack Jane.
Plus, it makes everything take longer for hackers.
And taking longer is often the name of the game.
Computer security is like a house of doors.
The more steps and layers of security companies can add between the outside and the information
on your account, the more secure the data will be!
More complexity means more time.
To add complexity, companies could do something called "slow hashing" or "key stretching"
which literally slows down the hash calculations by using super inefficient mathematical formulas!
I’m not kidding.
If I'm trying 350 billion different passwords and each takes a half-a-second (so slow!):
that's over 5500 years!
It seems dumb to be inefficient, but in computer security, sometimes, it can be smart.
They can also spread the security around!
"Tokens," are bits of data stored somewhere else on the company's server or even in a
whole other server.
Those are like the images your bank asks you to check before you log in.
If the token image of a cute dog doesn't match the roller-coaster you picked when you first
created the account: HACK ALERT!
Right now, the most secure password option is "two-factor authentication."
The correct password needs to be paired with input from you.
Sometimes this is a code they can text to your phone (which would require the hacker
to intercept the message or get your actual phone), or you can get the code from an app
like Facebook's Code Generator or Google's Authenticator.
They make new codes every 30 seconds to frustrate hackers further.
As more of the world comes online, we're going to have to fix passwords, because even with
all this -- anything can be hacked.
Because people often use the same (or really similar) passwords for a lot of different
websites, getting access to even one can compromise all a user's accounts.
Webmasters take this stuff seriously.
They want you to feel safe sending your credit card number over the open internet, but like
any heist movie, there are always ways to grab information, if you can find them…
For more on how to make the best passwords and how hackers can hold up the armored car
containing your password and hack into your account.
Watch the second part of this video in one week.
Thanks for tuning in to DNews.