Salting, peppering, and hashing passwords

What can a hacker do when a database is leaked?
Use coupon code MCODING at checkout for up to 91% off all yearly hosting plans!

Your password database just leaked. What info does the hacker get and what can they do with it if you used plaintext passwords, hashed passwords, salted hashed passwords, or peppered salted hashed passwords?

In this video we will talk about hashes, salts, and peppers, which can be used to more securely store passwords in your application's database. We use builtin secure Python primitives. Big open source libraries like Flask and Django use these techniques.

Note: DO NOT WRITE YOUR OWN CRYPTO. This video is for educational purposes to explain the purpose and benefits of salting and peppering, it is not an example of secure production code.
Note: Hash functions used in hashing passwords should be purposefully and configurably slow so that it takes an attacker a long time to check hashes even offline, making it more time-consuming to crack even weak passwords.

SUPPORT ME ⭐
---------------------------------------------------

Top patrons and donors:
John M, Laura M, Pieter G, Vahnekie, Sigmanificient

BE ACTIVE IN MY COMMUNITY 😄
---------------------------------------------------

CHAPTERS
---------------------------------------------------
0:00 Intro
0:39 DB Leaks
1:14 Plaintext
2:35 Hashes
4:39 Salts
6:14 Peppers
8:14 Closing remarks

[atrus]

This has got to be one of the best Python channels on YouTube. Really great material, interesting topics, in-depth but not overwhelming, and not sensationalized but still engaging. Keep it up!

[komodiT]

To recap, use a pot to bake some varied sprinkling of salt, a single non-locally sourced twist of pepper, over some hash pwns. But also keep your kitchen clean to avoid leaks. Happy cooking!

[jemand]

I once heard about peppers in a slightly different way: when initially saving a password, a very short (1-2 characters) random sequence (pepper) is generated and hashed together with the salt and password. the pepper is not saved anywhere at all. when verifying the password, the application itself has to "crack" the password by trying all the possible peppers. this increases password validation time by a factor of x (e.g. 26 for a single lowercase letter) which should be neglible (anything below 500ms is completely fine). however, this also increases the time needed to crack the password by the same factor, making it much harder for an attacker to crack the password offline

[samuellebot]

Python is not a language I usually work with but this channel is just so interesting and its teachings are so horizontal to most programming language that i can not stop watching it 😂

[liesdamnlies]

Use a unique, strong password for every site and service? Yeah. I do that. It’s called a password manager.

A glossary term: Precomputed hashes are called rainbow tables, and by now the ones available are _massive._ Just a hash should be considered as bad as plaintext.

This was a fantastic explanation of password hashing, salts, and peppers. Very good for everyone to know these things.

[georgesanderson]

I love these security videos, they're awesome! I'm really learning a lot! Thanks mCoding!

[Ganerrr]

chad security: just hash it, if someone has a password that can be cracked within a year its his their own fault

edit: this comment is not a joke

[NobleMushtak]

Never knew about peppers before! You mentioned that peppers could be stored in a "secure memory enclave." What is a secure memory enclave, and how would it be different or more secure than the database?

(Also, Discord gang)

[AnilKeshwani]

This channel is so consistently excellent in that you provide very clear, succinct and approachable introductions to each topic you cover. Absolutely fantastic. Great explanation of the utility of salts

[alexwhb]

Another fantastic video! I learned a lot. Hopefully more frameworks will support pepper soon. That's a really interesting trick.

[xarros]

I hope you can make a sequel to this video discussing algorithms like SHA, Bcrypt, Scrypt and the differences in using them for authentication

[SomeRandomFellow]

here from the community post. for some reason, youtube is really good at recommending those but not videos 🤔

[Sonyim]

Hey that's pretty cool. I've never heard of peppers before. Learned something new today!

[itsalongday]

Great video, this is the first time that I actually understood the concepts of salt and pepper

[LunaDragofelis]

I have heard of pepper before, but I completely forgot what it was, and this video was helpful to me

[SorFig]

1:11 - As someone whose been writing Python code for 11+ years, one of the new changes to Python3 that always surprises me when I see it is type-hinting. After learning Java a few years ago, I understand the appeal and the benefits, but if you want actual static typing, Cython seems a more robust answer.

[piriyaie]

Thank you for this video. Another security, which I think should be brought in any case, is that you should save the salt in its own column. Currently you save everything in one column. This means that if a potential hacker gets the hash of the password, he can immediately get the salt as well. But if the salt is stored in a separate column, the hacker must also be able to get to the column with the salt. This increases the security a bit.

[Mutual_Information]

I don't know *anything* about cryptography, but that is now slowly changing. It's interesting the clever defensiveness you need to take to protect against hackers. Another solid vid!

[jackhuangly]

Thank you for videos - it one of best (if not the best) channels i've seen for intermediate-advanced python, and importantly, introducing functionality or ideas that are not commonly used. Importantly, it is also very short and sweet, and cuts to the chase. Really well done!

[anthonyfontana]

Great! A clear example of how Salt and Pepper work.