Hashing - (Password Security)

Maads 101 here today. This is a video on password security.

Now, a few subscribers have been commenting in personal messaging us and saying that they want us to get their parents' passwords or their friends' passwords. So, let me just explain something about getting passwords.

For most services, your password is "hashed." And on the Mac, I know it is hashed. What hashed means is that when you type your password and set your password for the first time, it takes your password and, in some services, it uses your username and hashes them. So, it does a unique math algorithm to your password and supposedly your username, and makes a random number out of that.

Now, that math algorithm it ran your password through cannot be undone. So now you have this random number that is the hash of your username and password put together. Then, when you log in, it takes your password and your username again. When you've typed your password to log in, it hashes them. If they equal this hash, then they log you in; but if the hash does not equal the original saved hash, then it doesn't log you in.

So, passwords are not stored in plain text; they are hashed in this one-way algorithm. If you want to find a password, you'd be root forcing it. You'd be making programs to go through and guess every single password and hash the password, then check it. Unfortunately, that would be too time-consuming and just not good in general.

But, let me just demonstrate this. I'm going to take my password and my username, click encrypt, and here's the encryption code for my password. I'm going to copy this; so right now, this is the hash of my username and password: F Etc Q la la la.

So now, if I log in, say I type a random password, clicking encrypt—it’s not going to equal that original hash. It's going to equal something different. So that's why hashing is very secure. It’s what all the advanced systems do.

I know for some of you, if you click "forget password," and then type the answer to your security question, they might email you your password. If that's the case, then they don't hash your password, and your passwords with that are in plain text. But I say you don't have to worry about that too much on the Mac because your password is, in fact, hashed on your Mac.

So, thank you for watching Maads 101. Subscribe and give back!