All right, so now that we've seen what some of the vulnerabilities might be for hashed passwords,
it's time to level up and learn about a way that we can prevent these types of dictionary attacks or
hash table cracks.
And in order to do that, we have to learn about salting.
Now, what exactly is salting?
Well, we already know what hashing is. It's
when we take a password, we run it through a hash function and we end up with a hash that we store
on our database.
And as we saw in the last lesson, passwords that are generated by humans are extremely insecure.
They tend to be very short and they tend to be dictionary words that are extremely easy to look up and
create a hash table
for. Now, salting takes hashing a little bit further.
In addition to the password, we also generate a random set of characters, and those characters along
with the user's password gets combined and then put through the hash function.
So the resulting hash is created from both the password as well as that random unique salt.
So that means no matter how simple the password of the user is, adding that salt increases its complexity,
increases the number of characters, and we make our user database a lot more secure.
So consider the previous problem that we saw in the last lesson when
we covered hacking 101.
Now we know that three of our users have the same password and we figured that out because they all
had the same hash.
Now, on the other hand, if we had generated a random set of characters, which is the salt, and combined
the password with the salt in order to generate the hash, then they won't have the same hash in our
user database.
So let's try and generate Emily's hash from her password. So we know that her password is qwerty and
we generate a random salt.
So then let's go ahead and put in her password,
qwerty, and then we append at the end that random salt that we generated and we end up with a hash.
Now this hash, however, is not the same as Tony's hash or Angela's hash because the salt is different
each time.
Now the salt is something that the user doesn't have to remember and instead, it's stored in the database
along with the hash.
So that means when the user types in their password, when they try to log in, you combine their password
with the salt and if you generate the same hash, then they must have had the same password.
It's kind of clever, isn't it?
And on our database, of course, we wouldn't be storing their passwords, but only the salt and the
hash.
Now consider our previous statistics.
You can generate about 20 billion MD5 hashes per second.
So even if we added a salt and we made it harder to generate a hash table, with some of the latest GPUs
you can still probably generate a hash table with all salt combinations relatively quickly.
So what else can we do to increase the security?
Well, we can use something other than MD5, right?
Another hashing algorithm that's valued because it's incredibly slow.
And this is where bscript comes in.
This is one of the industry-standard hashing algorithms that developers use to keep their users' passwords
safe, because while you can calculate 20 billion MD5 hashes per second, even the latest and
the greatest GPUs in 2019 can still calculate only about 17000 bcrypt hashes per second, which makes
it dramatically harder for a hacker to generate those pre-compiled hash tables. And a salted hash table
instead of taking something like three seconds
If it was hashed with MD5,
if it was hash using bcrypt, it would take you something like eight months, which is not really worth
the hacker's while.
They'll probably go and search out a company that has less security enabled. And to make our passwords
even more secure
when we're using bcrypt, it has a concept of what's called salt rounds, how many rounds you're going
to salt your password with.
And obviously the more rounds you do, the saltier your password and also the more secure it is from
hackers.
So, what exactly are salt rounds?
Well, let's say that our original user password was qwerty, and we generate a random set of characters
as the salt.
So now we have qwerty and a random set of salt.
We pass it through our hash function, bcrypt, and we end up with a
hash. Now that one round of salting, if we wanted to have two rounds of salting, then we take the hash
that was generated in round one and we add the same salt from before.
And now we run it through, bcrypt, the hash function again, and we end up with a different hash.
And the number of times you do this is the number of salt rounds.
Now, the reason why this is genius is because as computers get faster...
remember that Moore's Law says that every year the number of transistors in a computer chip almost doubles
and the cost of that faster computer halves.
So every year you can get more computing power for less money.
And this is where salt rounds comes in.
When you're hashing your passwords using bcrypt, you can set the number of rounds you want to salt
your password.
So that means maybe this year in 2019, you salted ten rounds, but maybe next year you can increase that
number to 12.
And for every increase in that number, the amount of time that it takes to hash your password doubles.
And so that means you don't have to change your hashing algorithm or update your code other than simply
changing one number to keep up with the times.
So just to review, coming back to that user database, we'll have each user's username stored, we'll have
their randomly generated salt stored, and then we'll store their hash after a set number of salting
rounds.
And when it comes to checking their password when they login, we'ill take the password that they put
in, combine it with the salt that's stored in the database, and run it through the same number of salting
rounds until we end up with the final hash and we compare the hash against the one that's stored in
the database to see if they've entered the correct password.
So let's give that a go in real life and implement salting rounds into our website's authentication.