WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:06.500
Youtube doesn't know your password. Neither does Facebook, or Twitter, or any decent web service, literally.

2
00:00:06.540 --> 00:00:11.020
Your password is not stored in their database. It's safer that way.

3
00:00:11.020 --> 00:00:15.340
A hacker or a rogue employee can't find out what your password is.

4
00:00:15.380 --> 00:00:21.000
So, how do they know that you've typed the right password in when you go back to log in?

5
00:00:21.000 --> 00:00:27.800
Well, there are certain types of maths operations that are really easy to do one way, but really difficult to reverse.

6
00:00:27.800 --> 00:00:35.000
Multiplying two prime numbers together is relatively easy: 17×11 is 187.

7
00:00:35.000 --> 00:00:40.400
There's a shortcut I used there: to multiply by 11, you times by 10 and then add the original number.

8
00:00:40.400 --> 00:00:47.300
Now, because these two were prime, these are the only two numbers you can multiple together to get 187.

9
00:00:47.300 --> 00:00:49.940
So let's ask the question the other way:

10
00:00:49.940 --> 00:00:55.900
What two prime numbers multiplied together get you similar, semi-prime number? Let's pick 299.

11
00:00:55.900 --> 00:01:01.260
Well OK, it can't be 2× something,
 because it doesn't end in an even number.

12
00:01:01.260 --> 00:01:06.200
It can't be 3× something,
because the digits don't sum to a multiple of 3.

13
00:01:06.200 --> 00:01:09.400
It can't be 5× something,
 because it doesn't end in 5 or 0.

14
00:01:09.400 --> 00:01:11.400
Can it be 7? Well, I don't know,

15
00:01:11.400 --> 00:01:14.000
I have to work that out the long way and there are so many other numbers it could be.

16
00:01:14.000 --> 00:01:18.800
There are a few shortcuts that computers and good mathematicians can use to make the operation a bit

17
00:01:18.800 --> 00:01:25.300
faster but, in summary, particularity for huge numbers, there is no efficient way to reverse that operation.

18
00:01:25.300 --> 00:01:29.460
It is maths that is easy to do one way, and difficult to reverse.

19
00:01:29.460 --> 00:01:34.500
Now to you, your password is a string of letters, or symbols, or numbers but to a computer

20
00:01:34.500 --> 00:01:39.300
it is the same as everything else - a string of binary digits - ones and zeros,

21
00:01:39.300 --> 00:01:43.600
and you can do maths on those ones and zeros, you can do those one way operations.

22
00:01:43.600 --> 00:01:47.500
Not necessarily anything to do with prime numbers, although there sometimes is.

23
00:01:47.500 --> 00:01:52.200
That process is called hashing, and there's something called salting that makes it more complicated still,

24
00:01:52.200 --> 00:01:57.000
but basically what you have at the end: you type in your password when you register -- "abc" --

25
00:01:57.000 --> 00:02:01.960
you put it through a process,  what you get is a random string of characters.

26
00:02:01.960 --> 00:02:07.000
That's what they keep in their database, and when you type your password in again to log in

27
00:02:07.000 --> 00:02:11.080
they put it through the same mathematical one way operation.

28
00:02:11.080 --> 00:02:17.300
If the hash that comes out matches what they have in their database then they know what you entered

29
00:02:17.300 --> 00:02:21.600
was right, even though they don't know anymore what you actually typed in.

30
00:02:21.600 --> 00:02:27.800
And if they've done it right, you can't reverse that hash back to your password without centuries

31
00:02:27.800 --> 00:02:30.800
of computer time or billions of dollars.

32
00:02:30.800 --> 00:02:36.300
That's why Google, Facebook, Yahoo, everyone, they don't email your password when you say

33
00:02:36.300 --> 00:02:41.000
you've forgotten it, they ask you to set a new one. They can't email you. They don't know it.

34
00:02:41.000 --> 00:02:45.500
And for that reason, if you ever find a company that does email you your password when you say

35
00:02:45.500 --> 00:02:52.000
that you've forgotten it, well, run, because they have no idea about security.

36
00:02:53.140 --> 00:02:56.760
If that was interesting, I've done a couple of longer videos over at Computerphile

37
00:02:56.760 --> 00:03:00.520
about hashing and password security and if it wasn't, well –

38
00:03:00.520 --> 00:03:04.200
The stunts you are about to see were performed by trained drivers on a closed course.

39
00:03:04.200 --> 00:03:06.480
Do not try this at home.

40
00:03:07.860 --> 00:03:09.860
[Translating these subtitles? Add your name here if you'd like credit!]