Your password probably sucks, but that's not the real problem here.
The real problem is the companies that store it like amateurs, making even stronger passwords
crack in seconds sometimes.
Key stretching changes this equation by making every wrong guess cost actual money in electricity
and hardware and time.
Picture your password as a cheap lock on a storage unit, for example.
Anyone with bolt cutters can walk right through it, essentially.
Key stretching wraps that lock in layers of computational concrete, like suddenly those
bolt cutters need to become like industrial mining equipment that burns thousands of
dollars in electricity just to try to get it open.
Most people think password strength comes from randomness and length, and that's part
of it, but there's more to it.
What actually matters is how expensive your password becomes to guess.
For example, a character password properly stretched with modern algorithms resists attacks better
than a 16 character password stored with basic protection.
Here's what nobody actually explains about password storage.
When you create an account, the website doesn't actually save your password, right?
They run it through a mathematical function that creates a unique fingerprint called a hash.
Attackers who steal these ashes need to try to guess the passwords and check if they
can create the same type of fingerprint that was created.
Now, without key stretching, modern graphics cards check billions of guesses per second, so
your super secure one, two, three password falls in basically microseconds.
With proper stretching, using something like Argon2, each guess takes half a second and
eats a gigabyte of RAM.
Now your attacker went from billions of attempts per second down to maybe one or two.
The math becomes kind of hilarious when you scale it up, so testing one million password
candidates at two guesses per second requires almost six days of continuous computation,
which is a lot more effort, right?
Obviously, testing one billion, though, requires nearly 16 years, and that assumes perfect
efficiency with zero downtime, like no hardware failures, no electrical cost piling up.
Think about what that actually means for mass surveillance, for example.
The NSA can't just vacuum up everyone's data and crack it later when key stretching is
actually done right.
They need to try to decide if cracking your encrypted file is worth burning 50 grand
in computational resources, and most people really aren't worth that level of investment.
Early UNIX engineers basically understood this principle back when computers filled
entire rooms because they had to.
You have to be more efficient when you have less.
So they used multiple rounds of encryption, DES specifically, not to hide passwords better,
but to make each guess hurt, and modern algorithms took this concept and basically
weaponized it into economic warfare against attackers.
PBKDF2 runs your password through thousands or even millions of hash iterations,
and each feeding into the next, kind of like a computational chain that can't be shortcut.
Bcrypt uses something called Blowfish Cipher to create deliberate complexity that really
neutralizes GPU advantages to a large degree.
Those expensive graphics cards that hackers love suddenly become inefficient,
paperweights basically, or space heaters.
Xcrypt goes nuclear on memory requirements by demanding huge amounts of RAM for each guess,
and it makes specialized cracking hardware just economically stupid.
Your attacker needs actual computers with real memory, not just raw processing power.
Argon2 combines all of these approaches with adjustable parameters that let defenders adapt
to evolving threats when they evolve.
Have you heard of Keystretching before this video?
Like most people haven't, that's why I'm asking.
Because companies really, on one degree, don't really want you to understand
how badly they're failing you.
I'd definitely like to hear in the comments if this is new information to you.
I'm genuinely curious how well this knowledge is actually spread
outside of the kind of technical circles that exist.
And here's where companies, some degree, constantly screw you over.
Like your bank probably protects your password worse than a properly configured WordPress blog
does.
They chose speed, like over security, because they'd rather get hacked than
weigh an extra half a second.
And that's just being competent.
The implementation failures definitely go even further than just being cheap, though.
We can't just put it all on that.
Keystretching needs something called the salt.
And basically it's a random value.
You need to each user that gets mixed with your password before it gets stretched.
And without proper salts, attackers can basically pre-compute answers
or optimize their approach.
Yet company after company reuses salts or doesn't use them at all.
Because their developers learn security from a YouTube tutorial that was not this channel.
Password managers like KeyPass and Bitwarden do actually implement this correctly
for things like their master password.
BearCrypt is great in that it lets you configure millions of iterations for disk
encryption.
Even some consumer routers actually support stretched passwords if you dig through their
settings.
The tools exist.
Companies just really refuse to actually use them properly.
And here's the kind of dark comedy of our surveillance state.
The FBI complains about going dark when criminals use encryption.
But what that actually means is that properly stretched keys cost too much to actually
crack.
Actual security interferes with their dragnet surveillance program.
And every additional iteration of key stretching represents friction against
the unconstitutional spying that's constantly going on.
The same government that's spending billions on quantum computers to break encryption can
be defeated by properly configured password stretching that any competent developer could
implement in an afternoon.
They're building death stars while we're winning with computational guerrilla warfare.
Your operational security depends on understanding these kind of basic dynamics that exist.
Strong passwords alone will not protect you when they're stored completely incorrectly.
But even mediocre passwords become nearly unbreakable when properly stretched.
The transformation happens through pure mathematics.
And that means like there's no back doors or weaknesses.
It's just computational expertise that scales with attack or resources.
Like individual users can take control immediately when choosing services.
Ask about their key stretching parameters.
Use tools that let you control these settings.
Make your secrets too expensive for anyone to try and steal.
Stop trusting companies that have proven repeatedly
that they choose profit over your protection.
The economics become pretty brutal for attackers when we get to scale, right?
Like cryptocurrency miners, for example, perfectly understand this.
They calculate attrition costs versus potential profits.
Password cracking follows identical economics.
Make the cost exceed the value and the attack stops.
And not because attackers can't actually succeed, so what I'm saying.
But because they just can't afford to succeed.
Like surveillance capitalism depends on weak security to remain profitable.
Data breaches need to stay cheap if every password required
serious computational investments to actually crack
the entire ecosystem of buying and selling stolen credentials
to some degree would collapse.
And that's exactly why proper implementation faces such strong resistance.
Every properly protected password increases the global cost of surveillance.
Every company implementing real key stretching
makes mass data breaches less and less valuable, right?
Like the aggregate effect could absolutely cripple
the surveillance economy if deployed widely enough.
And this isn't really, this has nothing to do with personal privacy, right?
I'm talking more about systemic resistance to authoritarian overreach.
For example, key stretching transforms authentication from a speed bump
into kind of an economic battlefield where defenders set the terms
and you get to decide the computational requirements that will be needed.
You control the memory demands.
You force attackers to fight where their advantage is essentially evaporate
and their budgets screaming pain.
The solution is not that complex.
New systems should use Argon to with at least 64 megabytes of memory
with multiple iterations legacy systems need S-crypt or B-crypt
with aggressive parameters that never accept PBKDF2 with shot one
despite what outdated compliance frameworks actually suggest.
These definitely are not recommendations.
They're kind of minimal viable security in this day and age, right?
With like $8 per hour criminals renting massive GPU clusters.
What password managers or encryption tools are you using
that actually implement proper key stretching?
Security theater to most companies they don't bother actually doing this
which is why I saw making this video as a worthwhile project
for us to sit down and discuss key stretching.
If you haven't heard of this, I'd love to know about it in the comments
and if you did hear about it, I'd like to know what's about it
and if you did know about it, I'm sorry that you already knew about it
and saw nothing new.
I get comments all the time.
I was like, I already knew about this.
Why didn't you talk about something more detailed
and in depth, sorry, I get a poll of what everyone knows
when I make these videos and I guess I digress.
Thank you for watching to the end and I'll see you in the next video.