Rainbow Tables - Web Development Udacity English Japanese

Rainbow Tables - Web DevelopmentYouTube↗ IA↗(long shot)
Education 5.6K views 41 likes 12 dislikes 23 Feb 2015

Udacity 651K subscribers United States YouTube↗

Click to Play Video

So, passwords are hashed. Are you completely safe? No. Sorry to

ではハッシュ化したら安全でしょうか?

lead you down this path. We have, we have more to

いいえ　残念ながらまだやることがあります

do. The problem is, there are, you know, a handful of good hashing algorithms that people would use for this sort of thing. You know, let's, let's, let's pretend we're using SHA-256, because

問題なのはアルゴリズムの種類が多くないので同じものを使う人が多いことです例えばSHA-256を使っているとしましょう

that's a pretty decent algorithm. If somebody were to go through

とてもすばらしいアルゴリズムですが

and create a mapping of every word to the hash of that word. That would be a problem. because remember the whole strength of this hashing problem is that it's really hard to

もし誰かがすべての単語についてハッシュ化するマッピングを作っていたら問題です先ほどハッシュ値から元のテキストを導き出すのは

get from the hash to the plain text that led to

とても手間がかかると言いましたね?

that hash. You know, to, if you have H of a,

例えば文字aのハッシュ値H(a)を

you know, the hash of a. It's really hard to figure

aと認識するのは困難です

out a. But if you've got already computed it for every word, and all you have to do is you know compute

でもすべての単語について計算しておけば

at once and create the inverse table. Once somebody has this

即座に逆テーブルを作ることができます

table of all this words computed once, they're done. You know,

一度すべての単語について計算してしまえば

if you created a mapping of you know the SHA-256 of

それでもう終わりです元の言葉についてSHA-256のマッピングを

every word to the original word, all of a sudden you get,

すべて作成すればあっという間に

you get a database of a bunch of SHA-256 passwords. You can

SHA-256パスワードのデータベースができ

look up what the password is instantly. And this table has a

どんなパスワードかを即座に探索することができます

name. It's called a rainbow table. There are these things, these mappings, these databases of a hash version of a password to the clear

これはレインボーテーブルと呼ばれハッシュ化されたパスワードをテキストにするデータベースです

text password, they exist. You can Google for a rainbow table for

レインボーテーブルや同種のアルゴリズムをネットで検索して

a hash algorithm of your choice, you know, download that hash table

ハッシュテーブルをダウンロードするか

or, you know, download that mapping, turn it into a hash table and

マッピングをハッシュテーブルに変換することができます

you're good to go. There's a very simple way to get around this. You

とてもシンプルな方法です

may remember from our cookie approach, that all we have to do is

ところでCookieの使い方の講義で秘密のワザについて勉強しましたね

add in some secrets. But we don't want to add in the same secret over and over again. Otherwise, you're basically

でも同じ手法を繰り返すのはよくありません

vulnerable to the same fairly similar technique.

結局は解読されやすくなりますからね

So what we do instead is we use something called a salt. So in

そこで便利なのがソルトです

our user table, we're storing our name, and we're storing a hash of

ユーザテーブルの中には名前と

the password. Instead of storing just a hash of the password, we're going to add.

パスワードのハッシュ値が格納されています

A secret to it. It's similar to how we

このハッシュ値に秘密を足します

did with the cookies except this is not really secret.

Cookieの講義でやったのと似ているので

We're just going to say this hash is going to equal our

厳密には秘密ではありませんがこのハッシュ化の関数は

hashing function of the password plus salt. And this

h=H(pw+salt)となります

salt, instead of, so this looks very similar to

どうです?　Cookieでやった関数と似てるでしょう

what we did with the cookies. Right? We were using HMAC and, and we had a password, and, and a

HMACを使ってここにパスワードと秘密のワザでしたね

secret. Except the salt is just. It's just some random

ソルトは任意の文字にすることができます

characters we make up. You can make them up

これを作成してハッシュフィールドの

and you store them in the hash field, in the

空いているところに格納します

clear. So, in this field, we'll, we'll actually have the hash. Now this abbreviated as H and right along

このフィールドに"H"と表されるハッシュが来て

with it we'll have the salt and what this

その隣にソルトを置きます

does is, is this prevents this quick lookup from working

ランダムな文字列を挿入することにより素早く探索されるのを防止します

because all of a sudden we've added this these random

ここにランダムな文字列が加わることにより

strings. So, instead of saying hash of a equals a,

H(a)=aになるものではなく

we have to figure out what's, well what's hash of

H(a+salt)が何を意味するかを

a you know, plus the salt. And all of a sudden

探索することになるからです

that table's completely invalid. So, when you store a user. You

こうするとテーブルは完全に無効になります

know this is the type of algorithm you can do. Now,

ユーザの格納に便利な手法です

outside of this class I want you to think very hard

でも実装する前によく考えてください

about doing this yourself. You know as with all crypto you

暗号についても同じことが言えますが

should probably not being implementing it yourself because people have thought

まだ実装しない方がいいでしょうなぜならこれを考えた人たちは

this through. They have done it securely and you are not

練りに練って安全に運用していますが

yet qualified to do so. I want you to think very

皆さんはまだ学んでいる途中です

hard. About using third party libraries, because a lot of third party

サードパーティライブラリを使う時はよく考えてください

libraries also get this wrong. So, basically, think very hard. You

サードパーティライブラリを導入して失敗するケースは多いのです

want to get this right. There's a couple more things I'll tell you

間違いを犯したくないでしょう?

to look for when you're evaluating a third party library, but

これを見極めるコツについて伝えたいことがまだあります

a lot of them really screw this up, and you don't want to

よくないものも多数あるので

just trust them blindly, so. You know, I'd rather you do

やみくもに信用しないでください

it yourself knowing how to do it than you trust a third party library blindly, but the best knowledge you

サードパーティライブラリに頼るよりも勉強して自分で作成することを勧めます

can have is what to look for in a third party authentication library. Let's go ahead

でも一番いいのは見極める目を持つことです

and implement some naive functions for, you know, hashing

それでは単純な関数を実装して

and salting a password so you can see how the, the flow works. And then we'll

ソルトを足してハッシュ化してみましょう

talk about some of the things you should

これがどう機能するか分かります

look for when you're evaluating you know somebody's approach.

その後ライブラリの見極め方についてお話ししましょう

Similar videos:

Problems with Memcachedb - Web Development
Udacity
6K views 13 likes 0 dislikes 27 May 2012100% match

Italics
Udacity
49.1K views 16 likes 2 dislikes 23 Feb 2015100% match

Dynamic Content - Web Development
Udacity
6.1K views 2 likes 0 dislikes 23 Feb 2015100% match

Web 简介
 Udacity
25.7K views 60 likes 0 dislikes 23 Feb 2015100% match

Whitespace Solution - Web Development
Udacity
15.7K views 10 likes 1 dislikes 23 Feb 2015100% match

Inline Vs Block
Udacity
17.3K views 139 likes 5 dislikes 23 Feb 2015100% match

Components of the Web Solution - Web Development
Udacity
9.6K views 19 likes 0 dislikes 23 Feb 2015100% match

Whitespace
Udacity
47.8K views 26 likes 4 dislikes 23 Feb 2015100% match

Course Outline - Web Development
Udacity
46.2K views 169 likes 0 dislikes 23 Feb 2015100% match

Web Applications - Web Development
Udacity
19.5K views 59 likes 4 dislikes 02 Jun 2014100% match

Best Browser Solution - Web Development
Udacity
9.6K views 22 likes 1 dislikes 23 Feb 2015100% match

Shopping List Take 1 - Web Development
Udacity
841 views 1 likes 0 dislikes 23 Feb 2015100% match

Bold Tag - Web Development
Udacity
53K views 29 likes 0 dislikes 23 Feb 2015100% match

Bold Tag Solution - Web Development
Udacity
6.1K views 5 likes 0 dislikes 23 Feb 2015100% match

User Agent Header - Web Development
Udacity
11.6K views 24 likes 7 dislikes 23 Feb 2015100% match

Forms - Web Development
Udacity
6.2K views 16 likes 1 dislikes 22 Apr 2012100% match

Missing End Tag
Udacity
43K views 15 likes 1 dislikes 23 Feb 2015100% match

Part 2 - Web Development
Udacity
643 views 2 likes 0 dislikes 07 May 2012100% match

Caching Techniques - Web Development
Udacity
34.4K views 216 likes 7 dislikes 23 Feb 2015100% match

Rot13 - Web Development
Udacity
9.3K views 46 likes 8 dislikes 23 Apr 2012100% match

Document Structure
Udacity
7.2K views 24 likes 1 dislikes 23 Feb 2015100% match

Cookie Domains - Web Development
Udacity
5.1K views 22 likes 0 dislikes 23 Feb 2015100% match

Cookie Headers - Web Development
Udacity
4.2K views 23 likes 1 dislikes 23 Feb 2015100% match

Datastore Types Solution - Web Development
Udacity
656 views 1 likes 0 dislikes 25 Apr 2012100% match

URL Encoding - Web Development
Udacity
13.7K views 17 likes 13 dislikes 22 Apr 2012100% match

Growing Reddit - Web Development
Udacity
82.7K views 484 likes 27 dislikes 27 May 2012100% match

Best Browser - Web Development
Udacity
14.9K views 7 likes 0 dislikes 23 Feb 201567% match

Code Organization - Web Development
Udacity
7.2K views 25 likes 1 dislikes 27 May 201267% match

The Method Attribute - Web Development
Udacity
9.6K views 14 likes 8 dislikes 22 Apr 201267% match

Most Common Method - Web Development
Udacity
9.7K views 5 likes 0 dislikes 23 Feb 201567% match

Settings Privacy About Contact Donate