Heads up! To view this whole video, sign in with your Courses account or enroll in your free 7-day trial. Sign In Enroll
Preview
Start a free Courses trial
to watch this video
Passwords are one of the most common pieces of data that we have to store for users and one of the most dangerous to lose control of.
While a salt, as I suggested in the video, is definitely your first step, there's much, much more to safely storing passwords. This article outlines a lot of those steps and many of the libraries below facilitate them, too.
I've included links to some popular hashing libraries, divided up by language. This is not an exhaustive list.
Python
Ruby
Node.js
.NET
Related Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign upRelated Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign up
[MUSIC]
0:00
We've covered a lot of theory and
places to be concerned with.
0:04
So we should start to
look at some solutions or
0:07
approaches to better security.
0:09
Before we get into that though let
me make one thing absolutely clear,
0:11
you should use established measures,
tools, libraries, and services.
0:14
It's really fun to play around with
making your own algorithms and
0:18
security techniques.
0:20
But these, especially when kept secret and
0:21
internal, are often much more vulnerable
than the current industry standard ones.
0:23
We want you to be as safe and
secure as possible.
0:27
So please stick to industry
recommended tools, okay, cool.
0:29
Let's start with one of the things that
almost every security system uses,
0:33
passwords.
0:36
We need to hash passwords because despite
our best warnings, users will come up with
0:37
one decent password and use it at site
after site, application after application.
0:41
And then,
when bobsfishingspots.com gets hacked,
0:46
now the attackers can target your site or
my site and hope for password overlaps.
0:48
We however, don't want to provide hackers
with a fresh supply of passwords and
0:53
account details.
0:56
So we'll hash all
the passwords that we store.
0:57
Just a note before we
dive into a screen cast.
1:00
I'll be using languages that
I am comfortable with, but
1:02
these are only illustrations.
1:04
Anything I'm doing in Python or
JavaScript or
1:05
any other language can be done in
your language or framework of choice.
1:07
Don't think that you have to use exactly
the language and code that I'm using.
1:11
All right, let's get started.
1:14
Python has a handy built-in
tool named hashlib,
1:17
I'll use that to explore
a couple of hashing algorithms.
1:20
Then we'll looking at salting our hashes,
and finally, argon two,
1:23
which won the password
hashing competition in 2015.
1:27
Hashing algorithms come in all shapes and
sizes though, so
1:30
be sure to find the one that's best for
your use case.
1:32
First, let's take a look at
a bad algorithm to use, MD5.
1:36
Hashes return a bunch of bytes, which we
can view as either straight bytes, or
1:39
that we can turn into hexadecimal.
1:43
Hexadecimal is a little easier to read and
1:45
it's more likely what you'd store in
a database so I'll be focusing on them.
1:47
But I wanna show you both of these for
the first couple of hashes.
1:50
So let's do hashlib.md5 and
we have to send it bytes.
1:54
So, we're gonna send it bytes for
the word Treehouse and
1:58
then let's looks at the digest.
2:02
And these are just the bytes
that come back out of it.
2:04
So, bunch of bytes.
2:06
If we do the same code and
we use hexdigest, then we will get
2:08
the hexadecimal output which you can
see here is the 65492 and so on string.
2:12
There's not a lot to see here.
2:18
But it was definitely fast to execute,
right?
2:19
That was one of the things that
md5 was very well known for.
2:21
Let's try a stronger one.
2:24
Must do hashlib.sha256,
2:25
again we gonna send it some bytes,
we'll send Treehouse.
2:29
Now look at the digest, print along
digest and looks like a be hex.
2:34
So there's the head.
You could see it's much longer, right?
2:40
It's a much bigger hash output.
2:43
This was actually once considered a very
strong algorithm, but it's compromised
2:45
now to collisions being possible
within a practical amount of time.
2:49
That's how security goes.
2:53
Let's look at a currently
secure algorithm.
2:54
And this one is also from
the shar s-h-a family, and
2:56
is could by the National Institute
of Standards and Technology or NITH.
2:59
This algorithm's output is a little
different though in that it has a variable
3:04
amount of it.
3:07
We can control the amount of overall
security that goes into creating the hash
3:08
and the amount of hash
data that comes out.
3:11
So lets do hashlib.shake_128
we're gonna again send it
3:13
Treehouse and let's ask for
a hexdigest that is 20 bytes long.
3:20
There we go.
3:27
The 128 there is gonna
be overall security and
3:28
this affects how the algorithm
manipulates the data that's fed into it.
3:30
In the hexdigest, you can see that
I ask for 20 bytes of data back.
3:34
Now, regardless of the hash that you use,
it's very important to salt them.
3:38
Result is a little bit of extra
random data that your task to
3:41
the thing that you're salting.
3:44
Some people use the time stamp of
when you signed up, your username or
3:46
some other bit of known data.
3:49
I'm going to use a randomly generated
string from Python UUID library,
3:51
which means I need to import that.
3:54
And this can generate
universally unique identifiers.
3:59
So let's create a couple
of variables here first.
4:03
So we'll create a variable
of the string Treehouse.
4:05
We'll make a salt.
4:10
And then we'll do hashlib.shake_128.
4:13
And then we will put in
our ( salt+password.
4:20
And the we will call
hexdigest (40) on that.
4:25
And we get this nice big long harsh.
4:30
So, there's a thing I can save in my data,
it's a good thing to save.
4:34
Except, wait a minute, I wouldn't have
any way of finding what the salt was.
4:37
So I can never verify this harsh.
4:42
So to fix that, I'm going to append
the salt on to the end of the hash.
4:44
So I do exactly like we did before, and
4:49
then I would add a : and
then I would + the salt.
4:52
So now we get a big long hash,
we get a : right over here,
4:57
and then we get our salt at the end here.
5:02
Excellent.
5:05
Now, I need to decode it,
I'll just reverse that process.
5:06
Since hexidecimal doesn't include the :,
5:09
we know that it can be part of
the hash password, or the salt.
5:11
That means that we can chop
off the bit after the :.
5:14
Add that to the password
that the user gives us,
5:17
hash the whole thing with shake eight,
and then see if the two match.
5:19
So why do we want to salt things?
5:23
Aren't we making it easier to break the
hash by including the salt in plain text?
5:25
Adding a salt makes it much
harder to use precomputed attacks
5:29
like lists of prehashed words and
phrases against your hashes.
5:33
You should always salt your hashes.
5:37
If you're worried about attackers
being able to see your salt you
5:39
could always use another piece of data
that are calculated like sign up date.
5:42
Where users applied,
like an email address as the salt.
5:45
Before we wrap up,
5:48
I wanna look at Argon2, which one
the last password hashing competition.
5:49
Argon2 does something,
5:53
too, that many of the password
focused hashing algorithms do.
5:54
Let me use it, and
I'll show you what this is.
5:57
So I'll say from argon2
import PasswordHasher.
6:01
And then I will hash ("Treehouse").
6:10
And we get back a big long string.
6:15
See how it has the $argon2i,
here at the beginning.
6:19
That tells us that it was hashed
using the argon2i algorithm.
6:24
The other dollar sign separated
values that are in here,
6:28
tell us more about how
the hash was generated.
6:31
And finally, after this last dollar sign,
is the hash itself.
6:34
You might think that this is less secure,
6:37
since then a tag would be able
to simulate your hashing set up.
6:39
But due to how Argon2 works, where it
stresses the process and fills up memory,
6:42
this was what matters much.
6:46
All of this things here like the m and the
t and the p, those are settings you can
6:47
tweak to determine how much memory and
processor time we're hashing uses.
6:52
This has a major benefit because when
you save your user's password into your
6:57
database, you know how you half them.
7:01
You can use that to
hash them next time and
7:04
you can use that to upgrade hashes in
the future, pretty clever Argon2 too.
7:07
So remember use a hashing mechanism
that protects the infotax from GP use.
7:12
Uses of time and memory against
an attacker and avoid collisions.
7:17
It's also a good idea to be sure and keep
track of the algorithm that you used for
7:20
hashing, so you can upgrade stored
hashes as a tax and algorithms change.
7:23
I've talked about it before but
it's important so
7:28
I'm gonna talk about it again.
7:29
Systems like Argon2 are great to use for
specific use cases like passwords.
7:31
For other hashing situations though there
are usually existing tools in place
7:35
that are more specialized and
appropriate for the situation.
7:39
Things like checking
the contents of a file,
7:42
validating the origin of a message,
or fingerprinting a user or
7:44
a machine have existing solutions
that you should investigate.
7:46
Okay, now that we have things safely
stored in an unreadable format,
7:49
what would be some of our weak courses for
encrypting data to get it back?
7:52
You need to sign up for Treehouse in order to download course files.
Sign upYou need to sign up for Treehouse in order to set up Workspace
Sign up