WEBVTT - TechStuff Classic: Authentication Tech and You 0:00:04.440 --> 0:00:12.320 Welcome to tech Stuff, a production from iHeartRadio. Hey Thearon, 0:00:12.480 --> 0:00:16.120 Welcome to tech Stuff. I'm your host, Jonathan Strickland. I'm 0:00:16.160 --> 0:00:21.079 an executive producer with iHeartRadio. And how the tech are you? Well, 0:00:21.120 --> 0:00:24.040 it's time for another tech Stuff classic episode and this 0:00:24.160 --> 0:00:28.800 episode is titled Authentication, Tech and You. It originally published 0:00:28.800 --> 0:00:33.120 on February twenty second, twenty seventeen. Let's have a listen. 0:00:34.400 --> 0:00:38.080 I feel like security is becoming a bigger and bigger 0:00:38.120 --> 0:00:41.479 concern as it should be for a lot of people. 0:00:41.640 --> 0:00:44.319 People are more aware of it, I think than they 0:00:44.320 --> 0:00:47.920 were perhaps five years ago. Not everyone is practicing good 0:00:47.960 --> 0:00:52.160 security measures. Not everyone's practicing two factor authentication or multi 0:00:52.159 --> 0:00:55.840 factor authentication. We'll talk about that in this episode. And 0:00:55.960 --> 0:00:59.600 if you weren't familiar with what that's all about, That's 0:00:59.600 --> 0:01:01.520 why I'm wanted to do the show was to kind 0:01:01.520 --> 0:01:06.040 of explain what that actually means and why it is important. 0:01:06.840 --> 0:01:11.440 Authentication is something that we should probably define. First of all, 0:01:11.560 --> 0:01:17.360 it's the process or action of proving something to be true, genuine, 0:01:17.880 --> 0:01:22.120 or valid. So that covers a broad spectrum right authentication. 0:01:22.240 --> 0:01:27.760 You could be talking about authenticating a historical artifact. That's 0:01:27.760 --> 0:01:30.800 a great example, you bring a historical artifact to an expert, 0:01:31.240 --> 0:01:35.560 they authenticate that it is in fact a historical artifact 0:01:35.800 --> 0:01:38.679 and not something that was whipped up in some sort 0:01:38.680 --> 0:01:41.880 of souvenir shop and some out of the way place. 0:01:42.840 --> 0:01:47.199 But authentication has a very special role in the world 0:01:47.200 --> 0:01:49.920 of technology. In the world of computers and electronics, it 0:01:49.960 --> 0:01:53.840 gets a bit more specific. It's the process of verifying 0:01:53.880 --> 0:01:58.840 the identity of a user or a program or process. 0:01:59.520 --> 0:02:02.160 You want to make certain everything is authentic so that 0:02:02.480 --> 0:02:06.919 a program or person doesn't get unauthorized access to a system. 0:02:07.200 --> 0:02:12.160 So you're probably familiar with a lot of authentication processes, 0:02:12.200 --> 0:02:15.480 even if you didn't call them that, because you yourself 0:02:15.760 --> 0:02:21.320 have to employ them on a regular basis. Programs do too. 0:02:21.600 --> 0:02:24.280 But I'm not gonna really spend a lot of time 0:02:24.280 --> 0:02:26.120 talking about programs. In fact, I'm really not going to 0:02:26.200 --> 0:02:28.720 dive into it at all because that gets super technical, 0:02:29.560 --> 0:02:31.680 and really I think it's more important to focus on 0:02:31.720 --> 0:02:34.880 the stuff that you have a direct involvement with, unless, 0:02:34.880 --> 0:02:38.480 of course, you're a programmer, in which case Mia Kulpa. 0:02:38.560 --> 0:02:42.240 So I'm going to focus on authentication technology targeted at humans. 0:02:43.000 --> 0:02:45.600 So one day maybe I'll do a software one if 0:02:45.639 --> 0:02:47.920 there's a lot of requests for it. But I feel 0:02:47.919 --> 0:02:49.720 like that might just get a little too deep in 0:02:49.760 --> 0:02:53.120 the weeds. So I'm going to talk about the stuff 0:02:53.160 --> 0:02:56.040 you and I encounter when we try to access or 0:02:56.080 --> 0:03:00.359 protect our technology and our data. Now, there are a 0:03:00.360 --> 0:03:02.639 ton of different ways to do this. Some of them 0:03:02.919 --> 0:03:08.359 are inherently stronger methods of authentication than others and are 0:03:08.919 --> 0:03:14.680 better as far as being more secure, And all of 0:03:14.680 --> 0:03:19.040 these authentication strategies can be divided into three broad categories. 0:03:19.760 --> 0:03:26.280 Those categories are inherence factors, knowledge factors, and ownership factors. 0:03:26.560 --> 0:03:30.360 So when you hear about two factor authentication, we're talking 0:03:30.400 --> 0:03:40.200 about a specific strategy that employs different different approaches belonging 0:03:40.240 --> 0:03:44.880 to different factors. Now, that doesn't really mean anything unless 0:03:44.880 --> 0:03:48.600 I expand on it. So an inherence factor relies upon 0:03:49.120 --> 0:03:51.800 the user him or herself. In other words, it has 0:03:51.840 --> 0:03:56.200 something to do with you as a user. It has 0:03:56.240 --> 0:03:59.680 to do with either your physical traits or your behavioral traits. 0:04:00.600 --> 0:04:03.760 So a very easy to understand example of this would 0:04:03.760 --> 0:04:08.160 be a fingerprint scanner. Right, like your fingerprints are unique 0:04:08.160 --> 0:04:12.000 to you, It is something you have inherited, is inherent 0:04:12.440 --> 0:04:16.520 in who you are. So it's an inherence factor, But 0:04:16.560 --> 0:04:18.600 there are lots and lots of others, and I'll talk 0:04:18.600 --> 0:04:22.440 about some of those later on this episode. Knowledge factors 0:04:22.440 --> 0:04:25.920 are pretty self explanatory. Those are authentication strategies that rely 0:04:25.960 --> 0:04:29.560 on something that the user knows, like a password or 0:04:29.600 --> 0:04:35.120 a personal identification number otherwise known as a pen. Ownership 0:04:35.160 --> 0:04:38.640 factors are also pretty easy to understand. Those rely on 0:04:38.720 --> 0:04:42.760 something the user possesses, like a key card for security door. 0:04:43.120 --> 0:04:46.359 That would be an ownership factor. Now, on top of 0:04:46.360 --> 0:04:49.920 those categories, you have the additional strategies to enable authentication, 0:04:50.160 --> 0:04:54.440 which includes that two factor authentication that I talked about before. 0:04:55.360 --> 0:04:57.719 And maybe you don't know exactly what that means, well, 0:04:57.760 --> 0:05:02.039 that's why i'm here. Really, single factor authentication relies on 0:05:02.160 --> 0:05:06.120 just one component to access a system. So, for example, 0:05:06.120 --> 0:05:09.279 a lot of smartphones require users to unlock the device 0:05:09.400 --> 0:05:13.800 with a pin or a swipe pattern or a fingerprint scan. 0:05:14.640 --> 0:05:17.640 But that's it, right, You just have to do one 0:05:17.800 --> 0:05:20.839 of those things. You don't have to do multiple things, 0:05:21.760 --> 0:05:24.640 and once you do, whichever method you've enabled on your device, 0:05:25.120 --> 0:05:28.960 you have access to it. There's no secondary requirement. Systems 0:05:29.000 --> 0:05:32.920 that use single factor authentication are weaker than those that 0:05:33.000 --> 0:05:39.240 require more than one authentication strategy. In general, there are 0:05:39.520 --> 0:05:43.240 some different definitions for strong authentication I'll get into, and 0:05:43.720 --> 0:05:47.640 you could argue that some inherence factors are so strong 0:05:47.760 --> 0:05:51.479 as to be fine on their own, But in general, 0:05:52.680 --> 0:05:55.160 going with a single factor is less secure than going 0:05:55.200 --> 0:05:58.160 for a two factor authentication strategy, which is exactly what 0:05:58.200 --> 0:06:03.680 it sounds like. It requires two different authentication factors. That 0:06:03.760 --> 0:06:07.159 means the system will require users to provide authentication in 0:06:07.279 --> 0:06:11.279 two of those three categories. So an example of this 0:06:11.560 --> 0:06:14.320 is an ATM card. If you want to use an 0:06:14.360 --> 0:06:17.960 ATM card, you need to provide the card. That's an 0:06:17.960 --> 0:06:20.599 ownership factor. You have to be in possession of the card, 0:06:21.200 --> 0:06:25.760 and you have to supply the pen that's the knowledge factor. 0:06:26.320 --> 0:06:29.279 So you have an ownership factor and a knowledge factor. 0:06:29.480 --> 0:06:33.440 Those are two factors. That's two factor authentication. Possession of 0:06:33.480 --> 0:06:37.440 one factor should not be sufficient to access the respective system, 0:06:38.080 --> 0:06:42.000 nor should it lead to the discovery of the second factor. 0:06:42.160 --> 0:06:44.719 In other words, if you get hold of the card 0:06:44.920 --> 0:06:48.480 like you get hold of someone else's card, ideally there 0:06:48.480 --> 0:06:51.760 should be no indication on the card of what the 0:06:51.800 --> 0:06:55.120 pen is because you need both of those things in 0:06:55.200 --> 0:06:58.160 order to access someone's account, and if you make sure 0:06:58.200 --> 0:07:00.760 that only one of the two things is in possession 0:07:00.800 --> 0:07:04.600 of somebody else, they still can't get your stuff. So 0:07:04.680 --> 0:07:08.200 that's why you want the two factor authentication. You have 0:07:08.240 --> 0:07:11.640 to possess or know both of the authentication requirements independently 0:07:11.680 --> 0:07:16.000 of each other. This also applies to other factors as well. 0:07:16.040 --> 0:07:18.240 It doesn't just have to be knowledge and ownership. It 0:07:18.240 --> 0:07:21.080 could be ownership and inherence. It could be knowledge and inherence. 0:07:21.160 --> 0:07:25.120 You get the idea. So, if you've enabled two factor 0:07:25.160 --> 0:07:29.400 authentication on various online accounts, which I urge you to 0:07:29.520 --> 0:07:33.160 do for any accounts that actually offer it, you've likely 0:07:33.240 --> 0:07:35.880 had to supply a password as well as a code 0:07:36.160 --> 0:07:39.160 sent to you in some way. For example, you might 0:07:39.200 --> 0:07:41.920 have an email account that when you try and access 0:07:41.920 --> 0:07:45.120 it using a brand new device, says, all right, well 0:07:45.120 --> 0:07:47.440 what's your password? So you typed a little password in 0:07:47.480 --> 0:07:49.280 and then says all right, well, now I'm going to 0:07:49.360 --> 0:07:53.320 send you a code via text message. You need to 0:07:53.600 --> 0:07:56.320 put that code into this little box here, and then 0:07:56.360 --> 0:07:59.920 I'll give you access to your email. So the past 0:08:00.000 --> 0:08:03.800 this word part taps into that knowledge factor because you 0:08:03.960 --> 0:08:08.360 know the password and the text message taps into the 0:08:08.440 --> 0:08:11.960 ownership factor because there's a specific cell phone with a 0:08:12.000 --> 0:08:15.880 specific cell phone number associated with your email account, so 0:08:15.920 --> 0:08:18.080 you have to be an ownership of the cell phone 0:08:18.120 --> 0:08:21.360 in order to receive the text message and complete that 0:08:21.440 --> 0:08:26.080 authentication strategy. Many two factor authentication systems will actually allow 0:08:26.120 --> 0:08:30.880 you to designate specific devices as being safe quote unquote safe, 0:08:30.880 --> 0:08:32.800 meaning that you don't have to do that every single 0:08:32.800 --> 0:08:35.840 time you log in from that specific device. That way, 0:08:35.840 --> 0:08:37.719 you don't end up waiting for a text message every 0:08:37.760 --> 0:08:40.640 time you try and check your email from your personal laptop, computer, 0:08:40.800 --> 0:08:44.360 or smartphone. Now, there are systems that require even more 0:08:44.480 --> 0:08:49.320 forms of authentication, and we typically group these under the 0:08:49.400 --> 0:08:54.760 category multi factor authentication, indicating you've got to supply at 0:08:54.880 --> 0:08:58.520 least two methods in order to access the respective system. 0:08:58.720 --> 0:09:01.640 So technically, two factor authentication is a type of multi 0:09:01.640 --> 0:09:05.720 factor authentication. Most of the time, when I encounter it, 0:09:05.840 --> 0:09:08.880 multi factor is being used to mean more than two. 0:09:10.040 --> 0:09:14.440 I haven't personally ever encountered a system where I've had 0:09:14.480 --> 0:09:17.760 to supply more than two factors. But then again, no 0:09:17.800 --> 0:09:21.120 one trusts me with anything that's that important, so no 0:09:21.200 --> 0:09:26.120 big surprise there. Now, confusing matters somewhat. Is this term 0:09:26.320 --> 0:09:30.439 called strong authentication, which is used in a lot of 0:09:30.480 --> 0:09:34.160 different places, including the European Union. In fact, it's very 0:09:34.480 --> 0:09:37.800 prominently used in the EU. At first glance, you might 0:09:37.840 --> 0:09:42.120 think strong authentication and two factor or multi factor authentication 0:09:42.320 --> 0:09:45.079 are synonymous, that in order for it to be strong, 0:09:45.160 --> 0:09:48.320 it must be at least two factor authentication, But that's 0:09:48.360 --> 0:09:53.240 not actually the case. If a single authentication strategy is 0:09:53.280 --> 0:09:57.640 deemed secure enough, it can fall under the category of 0:09:57.720 --> 0:10:02.200 strong authentication. And so there's a lot of disagreement over 0:10:02.240 --> 0:10:04.920 what the actual definition is. It makes it pretty confusing. 0:10:05.280 --> 0:10:07.040 But let's give you an example. Let's say that there's 0:10:07.080 --> 0:10:10.920 a retinal scanner that scans the pattern of blood vessels 0:10:10.960 --> 0:10:15.480 in your eye. Now that's really difficult to replicate compared 0:10:15.520 --> 0:10:18.959 to other biometric measures such as a fingerprint, which you could, 0:10:19.600 --> 0:10:23.800 in fact, if you're very clever fake. So in the 0:10:23.920 --> 0:10:27.240 European Union, a system that looks at the blood vessels 0:10:27.280 --> 0:10:31.520 in your eye for authentication might be considered strong even 0:10:31.559 --> 0:10:34.080 though it's just a single factor. Let's say you don't 0:10:34.080 --> 0:10:36.640 have to provide any other information, it's just a quick 0:10:36.679 --> 0:10:39.400 scan of the eye and you're in If the system 0:10:39.440 --> 0:10:41.960 is robust enough, and if it's looking at something that 0:10:42.040 --> 0:10:44.960 is difficult enough to replicate, it could still count as 0:10:44.960 --> 0:10:49.120 strong authentication. It could even refer to knowledge based factors. 0:10:49.480 --> 0:10:51.640 So let's say a system requires you to answer a 0:10:51.679 --> 0:10:54.800 series of unrelated questions when you set up your account. 0:10:55.480 --> 0:10:58.120 Accessing the account at a later time requires that you 0:10:58.240 --> 0:11:01.200 replicate those answers. You've got to remember how you answered 0:11:01.200 --> 0:11:03.040 the questions when you first set it up. It's kind 0:11:03.040 --> 0:11:06.160 of like the security questions a lot of different systems 0:11:06.240 --> 0:11:10.280 use right now. Now, because these questions are unrelated and 0:11:10.400 --> 0:11:14.160 knowledge of one answer doesn't provide any of the other answers, 0:11:14.600 --> 0:11:17.880 that could be considered strong authentication. Now, personally, I find 0:11:17.920 --> 0:11:19.800 that method to be a little on the flimsy side, 0:11:19.840 --> 0:11:22.680 but I'm not the one making definitions. I'm just reporting 0:11:22.679 --> 0:11:27.360 them to you guys. Now we've got the basic definitions 0:11:27.480 --> 0:11:30.640 out of the way, let's dive into a bit of history, 0:11:30.880 --> 0:11:33.000 because you guys know, I love to talk about the 0:11:33.120 --> 0:11:37.520 history of the various technologies and processes we've developed over 0:11:37.559 --> 0:11:41.560 the years. So the concept of authentication is ancient. It 0:11:41.600 --> 0:11:46.360 predates electronics by centuries. Throughout the years, people would have 0:11:46.480 --> 0:11:49.880 to provide some sort of proof of their identities. It 0:11:49.960 --> 0:11:53.199 might require someone else to vouchsay for a person, or 0:11:53.240 --> 0:11:56.760 it might require a special seal belonging to a particular 0:11:56.800 --> 0:12:00.560 office or noble house, placed upon an official document. You 0:12:00.600 --> 0:12:02.760 may have heard that a lot of those documents would 0:12:02.760 --> 0:12:06.880 be sealed with wax, and then someone would use a 0:12:06.920 --> 0:12:10.160 signet ring in order to put a specific stamp in 0:12:10.240 --> 0:12:13.640 that wax. That was considered a form of authentication. If 0:12:13.640 --> 0:12:17.680 you saw the proper symbol, then presumably it came from 0:12:17.880 --> 0:12:22.040 the proper place. Not that you couldn't create a fake 0:12:22.080 --> 0:12:24.240 of that if you really wanted to, but you know 0:12:24.320 --> 0:12:26.760 that was the idea. Or you might even just have 0:12:26.800 --> 0:12:29.760 a password shared between a small group of people. So 0:12:29.840 --> 0:12:31.600 as long as there have been secrets, there have been 0:12:31.600 --> 0:12:34.720 means to identify those who should and should not have 0:12:34.920 --> 0:12:38.880 access to those secrets. And secrets predate the written word. 0:12:40.000 --> 0:12:45.280 But let's talk about passwords and authentication and electronics, because honestly, 0:12:45.320 --> 0:12:48.920 if I did a full episode about the history of passwords, 0:12:49.040 --> 0:12:51.320 that would not really be tech stuff. That would be 0:12:51.360 --> 0:12:53.679 an awesome, awesome episode of stuff they don't want you 0:12:53.720 --> 0:12:58.520 to know. Hint, hint. So computer passwords actually pre date 0:12:58.800 --> 0:13:03.680 personal computers. Back in nineteen sixty one, MIT created a 0:13:03.720 --> 0:13:07.960 password system for authorized access to its Compatible Time Sharing 0:13:08.000 --> 0:13:13.640 System or CTSS. CTSS allowed multiple users to access the 0:13:13.720 --> 0:13:17.679 same computational core. So imagine that you are in a 0:13:17.800 --> 0:13:21.560 room and it's filled. There's like lots of tables everywhere, 0:13:21.559 --> 0:13:24.920 and every table has a couple different workstations. Every workstation 0:13:25.000 --> 0:13:28.480 has a screen and a keyboard, but not a computer. 0:13:29.000 --> 0:13:31.920 They just have the keyboard in the screen, which are 0:13:32.120 --> 0:13:35.959 connected via cables to a single computer. Everyone is sharing 0:13:36.400 --> 0:13:39.800 the exact same computer. Well, way back in the day, 0:13:39.840 --> 0:13:42.720 that's how a lot of computer systems were made. They 0:13:43.000 --> 0:13:47.720 didn't have personal devices at every station. The stations were 0:13:47.760 --> 0:13:51.560 just dummy terminals that connected to a core system. Also, 0:13:51.679 --> 0:13:54.720 in those days, time sharing meant that the computer actually 0:13:54.800 --> 0:13:58.400 would divvy up when it was specifically available to do 0:13:58.600 --> 0:14:02.360 your calculation. So let's say you're typing in something, you're 0:14:02.400 --> 0:14:05.760 programming some code, and you send it to the computer. 0:14:06.600 --> 0:14:11.080 It would be responding to each station in turn, and 0:14:11.120 --> 0:14:14.360 it's doing it so fast that it feels almost instantaneous, 0:14:14.480 --> 0:14:17.720 or close enough to it, but in fact it would 0:14:17.760 --> 0:14:22.080 be responding in sequence. As people had logged into the 0:14:22.160 --> 0:14:28.400 various terminals now obviously using the same computer for all 0:14:28.400 --> 0:14:32.440 these dummy terminals create some challenges. How can each individual 0:14:32.720 --> 0:14:36.120 user maintain control over his or her data? How do 0:14:36.200 --> 0:14:40.040 they maintain their own private files? Because every user had 0:14:40.080 --> 0:14:43.480 a set of private files that other users should not 0:14:43.560 --> 0:14:47.560 be able to access without authorization. I mean, one person 0:14:47.640 --> 0:14:50.000 might be working on a project, someone else is working 0:14:50.040 --> 0:14:52.480 on a totally different project. You don't want those files 0:14:52.520 --> 0:14:56.920 to intermingle. You had to partition that stuff. So without 0:14:56.920 --> 0:15:00.000 a password, you really couldn't do that. So if everyone 0:15:00.240 --> 0:15:02.360 using a core machine as the processor in storage unit, 0:15:02.440 --> 0:15:05.800 you had to create some means of differentiating one user 0:15:06.040 --> 0:15:10.720 from another. The solution was the password, So every user 0:15:10.760 --> 0:15:13.480 would get a unique password to enter into the system, 0:15:13.800 --> 0:15:16.960 which would then allow that user to create and access 0:15:17.040 --> 0:15:20.480 private files. And it also helped control the amount of 0:15:20.520 --> 0:15:24.560 time any individual user had with the machine. Because these 0:15:24.600 --> 0:15:27.840 machines they were rare. There were only a few of 0:15:27.880 --> 0:15:32.200 them in nineteen sixty one, so the time on those 0:15:32.240 --> 0:15:37.400 machines was very valuable. You know, people were hoarding time. 0:15:37.480 --> 0:15:38.960 They were trying to do their best. You know, you 0:15:39.040 --> 0:15:42.200 might only get a few hours a week, so they 0:15:42.200 --> 0:15:45.400 would end up parsioning that out through passwords. It was 0:15:45.480 --> 0:15:48.680 kind of like a controlled ticket system so that a 0:15:48.960 --> 0:15:51.920 ride doesn't get overwhelmed with a ton of people. You 0:15:52.400 --> 0:15:54.960 release a certain number of tickets per hour and you 0:15:55.080 --> 0:15:57.720 keep the traffic flowing steadily. Same sort of thing, except 0:15:57.720 --> 0:16:00.440 in this case it was with a computer access so 0:16:00.520 --> 0:16:03.160 as a way to control the point of entry into 0:16:03.200 --> 0:16:06.920 the system. We're going to take a quick break from 0:16:07.000 --> 0:16:20.840 talking about authentication tech to thank our sponsors. Now, at 0:16:20.840 --> 0:16:23.720 that time, the passwords were pretty simple, and they were 0:16:23.760 --> 0:16:27.280 not really secure at all. It was more for the 0:16:27.320 --> 0:16:31.960 matter of convenience than security really. After all, this predated 0:16:32.000 --> 0:16:35.320 the Internet, so external access to the system wasn't really 0:16:35.320 --> 0:16:37.280 a factor. If you wanted to get your hands on 0:16:37.360 --> 0:16:40.800 those sweet, sweet private files, you actually needed to have 0:16:40.840 --> 0:16:43.960 physical access to the system itself. You couldn't just hack 0:16:44.040 --> 0:16:46.800 in from across the country. So in a way, that's 0:16:47.320 --> 0:16:51.200 one factor of authentication all by itself. Ownership in this case, 0:16:51.240 --> 0:16:54.200 the ownership doesn't really refer to something that you personally owned, 0:16:54.280 --> 0:16:59.560 but rather your physical access to the system. But these 0:17:00.120 --> 0:17:03.280 weren't encrypted or stored in a particularly safe way. They 0:17:03.280 --> 0:17:06.960 were in plain text. So just a year after they 0:17:07.119 --> 0:17:12.119 debuted this password strategy, a graduate student named Alan Scherer 0:17:12.440 --> 0:17:16.639 accessed the entire list of unencrypted passwords stored on the 0:17:16.680 --> 0:17:20.120 system and printed them out. Now, the reason Shared did 0:17:20.119 --> 0:17:23.439 this was not to access private files created by other people. 0:17:24.040 --> 0:17:26.640 It was so that Share could get more time on 0:17:26.680 --> 0:17:30.280 the system because every student was allotted just four hours 0:17:30.280 --> 0:17:33.879 of access per week, and he needed more access, and 0:17:33.960 --> 0:17:36.560 he figured, well, there's all these other hours of access 0:17:36.560 --> 0:17:40.000 that are going unused from other students. That's not fair. 0:17:40.359 --> 0:17:44.159 I'll just take their hours and use them myself. The 0:17:44.200 --> 0:17:46.320 way he did this was he actually created a punch 0:17:46.359 --> 0:17:51.000 card that contained the file name and location for the 0:17:51.040 --> 0:17:54.760 password list, and it also contained a set of instructions 0:17:54.800 --> 0:17:58.480 that said take this file and send it to a printer. 0:17:59.840 --> 0:18:02.960 Didn't even have to physically look at this file at all. 0:18:03.000 --> 0:18:05.200 He just had to figure out what was the file name, 0:18:05.320 --> 0:18:08.240 where was it located on the system, and then include 0:18:08.240 --> 0:18:11.639 the instructions send to printer. By the way, if you 0:18:11.640 --> 0:18:13.880 want to know more about how punch cards work and 0:18:14.000 --> 0:18:17.680 the way that they were an integral part of early computing, 0:18:18.160 --> 0:18:20.920 you can actually listen to a classic two thousand and 0:18:21.040 --> 0:18:25.199 nine Tech Stuff episode titled Computers from the past, and 0:18:25.320 --> 0:18:27.439 Chris Palette and I talked a lot about them in 0:18:27.480 --> 0:18:31.960 that episode. So it's easy in hindsight to criticize the 0:18:32.080 --> 0:18:34.480 MIT strategy. But keep in mind this was at a 0:18:34.560 --> 0:18:39.360 time when unauthorized access to computers was exceedingly rare, because well, 0:18:39.400 --> 0:18:43.040 the computers were exceedingly rare. As computers began to proliferate 0:18:43.400 --> 0:18:46.840 throughout all areas of life, the need for more secure 0:18:46.920 --> 0:18:51.679 access strategies grew. According to Roger Needham, who was a 0:18:51.680 --> 0:18:55.880 professor of computing at Cambridge University, the Cambridge Lab came 0:18:56.000 --> 0:18:59.159 up with a concept to make passwords more secure, and 0:18:59.200 --> 0:19:02.400 that's the concept of hashing. Now, that's when you convert 0:19:02.400 --> 0:19:06.399 passwords of variable lengths into a fixed length string of 0:19:06.480 --> 0:19:10.760 characters using an algorithm for the transformation. It's a fancy 0:19:10.800 --> 0:19:13.159 way of saying, no matter how long or short a 0:19:13.240 --> 0:19:18.280 password is, you put it through a series of mathematical processes. 0:19:18.480 --> 0:19:22.119 Will you convert the password into numerals first? Then you 0:19:22.200 --> 0:19:26.840 do this series of mathematic processes, the result of which 0:19:27.000 --> 0:19:31.720 is you get a much longer string of characters and 0:19:31.760 --> 0:19:34.640 that represents the password. And it doesn't matter how long 0:19:34.720 --> 0:19:38.240 or short the original password was. All of the hashed 0:19:38.560 --> 0:19:42.399 versions of the password are the same length. So let's 0:19:42.440 --> 0:19:45.000 say the hash is eighty characters long. That means if 0:19:45.000 --> 0:19:51.000 your base password is pass or its anti disestablishmentarianism or 0:19:51.080 --> 0:19:54.280 anything else, it will end up converted into a string 0:19:54.359 --> 0:19:56.959 of eighty characters. So if someone gets hold of the 0:19:57.000 --> 0:19:59.679 hashed passwords, those are the only ones that are being 0:19:59.720 --> 0:20:02.080 stored on the system, they would still have to figure 0:20:02.080 --> 0:20:05.000 out what was the mechanism used to generate the hashes 0:20:05.080 --> 0:20:08.240 in order to guess what the root password was, because 0:20:08.240 --> 0:20:11.280 otherwise they're all going to look like they're eighty characters long. 0:20:11.320 --> 0:20:14.320 You won't know which ones were short passwords or long passwords. 0:20:16.160 --> 0:20:18.600 In order to do that, obviously, you have to decide 0:20:18.640 --> 0:20:22.520 upon what the specific sequence of mathematical operations are going 0:20:22.560 --> 0:20:27.040 to be and what seed you're using for those operations. 0:20:28.240 --> 0:20:30.440 And once you do that, then you're able to make 0:20:30.520 --> 0:20:35.280 these kind of changes. So Needham said that the system 0:20:35.400 --> 0:20:38.840 was created and implemented in the mid to late nineteen sixties, 0:20:39.240 --> 0:20:45.800 so it wasn't very long after the MIT rollout of passwords. 0:20:46.440 --> 0:20:49.400 Now later, still, computer scientists began to develop more secure 0:20:49.480 --> 0:20:54.240 hashing strategies. This includes salting passwords, which means adding characters 0:20:54.280 --> 0:20:57.720 to a password before you hash it. So a simple 0:20:57.760 --> 0:21:00.800 example of this is using a computer's claw to insert 0:21:00.880 --> 0:21:04.680 digits into the password and then hashing the new password, 0:21:04.840 --> 0:21:07.080 which makes it even harder for a hacker to figure 0:21:07.080 --> 0:21:10.120 out the root password from the hash because they need 0:21:10.160 --> 0:21:13.399 to know at what time that operation was performed on 0:21:13.440 --> 0:21:17.879 the original password, otherwise they wouldn't be able to replicate 0:21:17.960 --> 0:21:22.280 the original password. Now, this is easier to understand if 0:21:22.320 --> 0:21:24.840 I give you an example. So let's say your password 0:21:25.480 --> 0:21:29.520 has been set to let's say tech stuff. You chose 0:21:29.560 --> 0:21:32.320 tech stuff as your password. First of all, that was dumb. 0:21:32.480 --> 0:21:35.160 Don't do that. Don't pick a word that's easy to guess, 0:21:35.200 --> 0:21:37.480 even if it's a name like tech stuff, which is 0:21:37.760 --> 0:21:41.399 granted an awesome show. But you've chosen tech stuff for 0:21:41.440 --> 0:21:45.240 this example. You access the system at two thirty five 0:21:45.240 --> 0:21:48.439 in the afternoon. Let's say that the computer converts that 0:21:48.520 --> 0:21:51.720 into military time, so that gives you fourteen thirty five, 0:21:52.040 --> 0:21:55.199 and then it salts your password with those numbers, so 0:21:55.440 --> 0:21:57.960 instead of it just saying text stuff, now it says 0:21:58.080 --> 0:22:04.920 T one E four C three H five stuff. That 0:22:04.960 --> 0:22:09.280 password then gets hashed into that eighty character long version 0:22:09.400 --> 0:22:12.240 stored on the computers. By the way, that eighty characters 0:22:12.280 --> 0:22:15.679 is just an arbitrary example. It doesn't really mean anything. 0:22:15.720 --> 0:22:18.720 I just need a number for the example. Now, let's 0:22:18.720 --> 0:22:21.639 say you access the same system the following day, but 0:22:21.680 --> 0:22:24.119 this time it's one twenty three in the afternoon. Remember 0:22:24.119 --> 0:22:25.960 it was two thirty five the day before, but now 0:22:25.960 --> 0:22:29.640 it's one twenty three the next day. The salted password 0:22:29.680 --> 0:22:31.960 is going to be different because it's going to convert 0:22:32.000 --> 0:22:34.520 one to twenty three to military time, and then it's 0:22:34.560 --> 0:22:37.520 going to salt the password that way, so it would 0:22:37.560 --> 0:22:41.120 be T one E three C two H three stuff. 0:22:42.800 --> 0:22:45.679 The hashed value will end up being different as well, 0:22:46.000 --> 0:22:49.359 because it's inserted those new numbers. So that means that 0:22:49.440 --> 0:22:52.600 if the hacker gets two versions of your hashed password, 0:22:53.000 --> 0:22:55.440 they're still going to be different from each other. It's 0:22:55.480 --> 0:22:57.680 all going to be dependent upon the time you tried 0:22:57.720 --> 0:23:01.960 to access the system. Now itself, it knows when you 0:23:02.000 --> 0:23:04.879 were accessing it, so it's able to do all of 0:23:04.920 --> 0:23:09.800 this decoding easily. There's no problem for the system, but 0:23:09.880 --> 0:23:12.960 it makes it difficult for a hacker to figure out 0:23:12.960 --> 0:23:15.919 what your password was based upon the hashed value that 0:23:16.000 --> 0:23:20.280 appears inside the system. Now, of course, hackers can bypass 0:23:20.320 --> 0:23:23.160 all that and try to hack a password using brute force. 0:23:23.840 --> 0:23:26.720 That's when someone and usually it's a computer program not 0:23:26.760 --> 0:23:31.240 a person these days, submits endless guesses into a password 0:23:31.240 --> 0:23:35.280 protected account in order to gain access. There's no need 0:23:35.320 --> 0:23:38.680 to work backward from hashed values. Using this approach, you're 0:23:38.760 --> 0:23:42.439 just guessing the root password from the get go. But 0:23:43.040 --> 0:23:45.400 it takes a lot of time, particularly if the user 0:23:45.440 --> 0:23:49.000 has created a strong password. So the longer and more 0:23:49.040 --> 0:23:52.880 complex a password, the less likely a traditional computer can 0:23:52.920 --> 0:23:56.440 hack it in a reasonable amount of time. Given enough 0:23:56.480 --> 0:24:01.359 time and enough computing power, any password and ultimately be 0:24:01.640 --> 0:24:05.719 cracked by brute force. But the more complex it is 0:24:05.760 --> 0:24:09.200 and the longer it is, the more time it requires 0:24:09.240 --> 0:24:13.200 to a point where it can approach time that last centuries, 0:24:13.240 --> 0:24:14.960 which means no one's going to bother to do it 0:24:15.040 --> 0:24:17.560 because they're not going to be around to actually see 0:24:17.600 --> 0:24:22.000 it work. Assuming you've picked a good strong password, So 0:24:22.000 --> 0:24:24.440 why you should never use real words or even names 0:24:24.480 --> 0:24:26.520 as a password. They're too easy for a computer to 0:24:26.560 --> 0:24:30.320 guess using what's called a dictionary attack, So make sure 0:24:30.359 --> 0:24:33.520 you create those really strong passwords and as always, I 0:24:33.600 --> 0:24:37.840 like to recommend using a password management program so that 0:24:37.880 --> 0:24:41.240 way you don't have to remember those strong passwords, because 0:24:41.240 --> 0:24:44.560 obviously the downside to creating a strong password is they're 0:24:44.560 --> 0:24:47.600 difficult to remember. It's really easy to remember a word 0:24:47.760 --> 0:24:51.840