Keeping passwords safe in 2017
summary
Shows concrete password-hashing choices and measurements: naive MD5 hashes let a common password be cracked in 1.3 seconds on an old laptop, fast hashes enable 2 million/sec attacks on rented cloud GPUs, PBKDF2 raises per-login cost to ~200 ms but still scales poorly, and memory-hard Argon2 uses ~500 MB so a 24 GB server only cracks ~48 in parallel. Provides a working Node library, secure-password npm package, with async defaults and forward-compatibility.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:57The problem with passwords
- 4:05Plain text storage dangers
- 5:34Understanding hash functions
- 7:55Rainbow tables and hashing
- 12:50Salting passwords
- 17:10Iterated and slow hashing
- 20:17Argon2 and memory hardness
- 24:22Modern implementation
related talks
42mPassword Hashing
46mCryptography For Beginners
36mThe Slower the Stronger: A Story of Password Hash Migration
43mPlease pass the salt: Serve up passwords with a side of entropy
51mThe Slower the Stronger: A Story of Password Hash Migration
25m80,000 Plaintext Passwords: An Open Source Love Story in Three Acts
30mhunter2: A Symphony of Password Horror
47mYour Password Complexity Requirements are Worthless