Namaste. In financial accounting, if you remember in our first session we had tried to understand what is accounting and then started discussion on financial statements. In the second session we discussed what is a business cycle and from that how the main financial statements that is balance sheet and P and L account emerges. Then in our session 3 and 4, we went into what is balance sheet and what are the items in balance sheet. Today we will continue with our discussion on balance sheet and then we will proceed to understand the profit and loss account. We will take a quick review of balance sheet, so you already know short form format of balance sheet, there are 6 items, then I will go ahead we are going to discuss each of them in detail. We had also seen a detailed format of balance sheet under schedule 3 of companies act. So we have equities and liabilities, then shareholders funds, share, capital, reserves and surplus, I hope you know their meanings. If you really do not know, please do not keep quiet, ask them on the discussion forum, then you have got money received against share warrant, then we went on to discuss share application money pending allotment and non-current liabilities, then current liabilities, then we discussed on assets again divided as non-current assets followed by current asset. If we look at the format, it is as per the permanence. So what is permanent comes first, for example in balance sheet share capital has the longest tenure that comes first, then non-current liabilities, then current liabilities. In assets first we have got non-current liabilities because they are going to be with us for more than one year, within that also fixed assets are likely to be more with the company for a longer tenure. So first we have got fixed assets, then we have got other non-current assets, then we have got current assets. So in the format of balance sheet, if we look at the elements, which we are going to discuss in detail now, there are three elements, one is assets, next liabilities, here I mean external liabilities followed by owner's funds. In the last session, we had just started our discussion on assets, so we will just start again from that. In the assets, we are already seeing the major examples of assets. So we have got land building, patents, investments, cash and so on. As a definition, something which is a property of the company which has a probable economic value that is called as an asset and the second condition is it must be owned or controlled by the entity. We also saw in our earlier sessions, we had seen that business cycle. You need human power, you need people to manage the business, they are invaluable assets of the enterprise, their skills are important, how they behave is important, however they cannot be shown in the balance sheet because human beings are not owned by the company. In assets, essentially there are the items which are owned by the company and which are going to have economic value in future. Usually, assets would not be made available to company for free, so there will be some cost for the asset and we are assuming that there is an economic value which can be measured and if exact value is not known, at least it can be estimated. Now coming to the types of assets, as we know there are major two types of assets, one are non-current, the other ones are current, non-current means those which are likely to last for more than one year which again the major examples of fixed assets and current assets. Do you remember what is meant by fixed assets? Because when we discussed money cycle, we had started with the first asset which is fixed asset. Do you remember what it is? Yes, many of you are correct I think, it is a kind of infrastructure using which company does it business. Whatever operations are happening, fixed assets themselves do not get converted but they act as catalyzed, catalysts, they support the whole process. Now what are the types of fixed assets? There are two types, one is tangible, the other is intangible. Tangible means something which you can touch, physical existence, they are called as tangible assets. I think the examples are very, very easy, everybody knows what are the examples of tangible assets, we have got land, machinery, furniture, vehicles, large number of say computers, cameras, mobile phones, large number of assets which you can touch feel are all called as tangible fixed assets. The other type is intangible. Now this is something which you cannot touch or feel but still they have a value, they are going to be with a company for a long time. So what are the examples of intangible assets? Can you think of any examples? Here I had taken one example if you remember, we had seen that we have a computer, is it a fixed asset? The answer is yes, there are two things in computer, there is a hardware, there will be a mouse, there will be a keyboard, there will be all other parts. Now whatever you can touch, whatever you can see, these are all tangible parts but there is also intangible part which is software, which is loaded in the computer and many of you use mobile phone, so in mobile phone more frequently whole day I think most of you would be on mobile phone. So you can see your instrument but in that instrument there are apps, there are various other things which are loaded on instrument which do not have physical existence but which are of very much use to you. Those things are an example of intangible assets. Any other examples of intangible asset do you think of? Let us see you are doing some scientific research and you get a new formula or you develop a new product, then you will apply for a patent. If you get a patent it has a very important economic value and patent will be an example of intangible asset. Those of you who are good in art or those who have got creative attitude, you might have a new drawing or you might come out with a new size or a design that also can be registered. It is registered as a copyright. Then a copyright or a trademark is also an example of intangible asset, are you seeing the example? So we have got patents, we have got trademarks, we have got goodwill. Now what is goodwill? As the name suggests it is a good name of the concern. If you are say running a shop for many years, 2 years, 3 years, 5 years, 10 years, several people in the locality or even from far away places will know your shop. They would prefer your shop over other shops because of the trust factor, because of reliability and so on, that will be what is known as goodwill. There are several brands of international and national importance, they can be considered to be valuable, that brand name itself is valuable. Can you name of or think of a few brands? I think everybody would have heard of Tata, which is highly reputed brand all over India. There are several companies under Tata's like TCS or Tata Motors or Tata Steel. But the brand name is Tata. So that Tata name is attached with lot of goodwill. Similarly, nowadays most of you know Geo. So Geo is a brand name which is owned by Reliance Industries, that is also a brand name. Not to advertise too many companies, but I am just giving you examples. For example, relatively new but which has taken a big name is Patanjali. So Patanjali is a big brand name today, not only in Yog but also in Ayurveda like that there are also several international brands. So all of these are backed by some goodwill of that company. It is sometimes copyrighted, then the copyright is a intangible asset, sometimes it is not copyrighted, then it can be called as a goodwill. Now valuation of intangible assets is bit difficult. Relatively valuation of tangible assets is easy. Anyway, we will go into it later on. But right now on your screen you have got variety of both tangible and intangible fixed assets. Now the next one is current assets. Now what is the definition of current asset? I think we have seen it earlier, we have got a money cycle or a cycle of operations and in the operations cycle or in the money cycle or in the value addition cycle, many assets are getting continuously exchanged. Those assets are typically what are known as current assets. Normally the life of these assets is not very long, they are likely to be with you for a relatively shorter time, may be 15 days, 1 month, 2 months, 3 months and so on, these assets are known as current assets. Now current assets can be classified into two types. One is a monetary one, the other one is non-monetary. Now can you give examples of monetary current assets or non-monetary current asset? Is any one of you able to think? Something which can be expressed in money terms is monetary, I think most of you would be thinking of it. But in fact, every value in the financial statement can be expressed in monetary terms. Then can you call everything as a monetary, then what will come as non-monetary? I will try to respond to your question. So see monetary assets are debtors and bank. So they represent something which you are going to receive from bank or something which you are going to receive from your customers or debtors, their value does not change. So they are called as monetary fixed assets, now monetary current assets. Now what are non-monetary current assets? Can you think of any examples? Non-monetary current assets are variety of stocks or inventory with you. So if you have purchased raw material, it is a pick, it is an inventory of raw material. You will convert it into finished goods, it becomes inventory of finished goods. Some of the companies only deal trading business. They purchase finished goods, they sell finished goods. In that case, the stock of finished goods in their hand is a non-monetary current asset. As I was just saying, even non-monetary assets have a monetary value. Then why do you call them non-monetary? The reason is because their value goes on changing with the changes in the market value in the market. So for example, the value of inventory of finished goods may go up and down, the value of investment sometimes go up and down. So such assets are known as non-monetary current assets. Now I think you would have understood what are the important assets. Now let us go to the next part, that is liability. Now what is meant by a liability? I think you are able to see it on the screen, that it is a present obligation of the enterprise that arise from the past events. So in the past, suppose we have purchased raw material from somebody. If you pay in cash, you get raw material, you pay cash, then there is no liability. But if you purchase raw material but you are yet to pay, let us say you are going to pay at the end of one month. But as of today you are not paid, then it will be shown as a liability in your books. It will be what type of liability in the example which I am saying? I have purchased raw material, I have not yet paid, I am going to pay within a month. What type of liability it is? I think most of you are guessing it correctly, it will be a current liability because it is going to be settled in just one month. Next types we will see later on. Now it is an existing obligation, there should be some evidence available on the balance sheet date and it is expected that there will be some outflow which can be anticipated and value also can be measured. So suppose we have purchased raw material of 1 lakh, we will pay after one month rupees 1 lakh. So you know that expected outflow is 1 lakh, that is why it is called as a liability. Sometimes you do not know exact value, but you can estimate the value, still it will be called as a liability. Can you think of any examples of liability other than what example I give you? I think most of you are guessing it rightly. Suppose I take a loan from bank, I will have to repay it. So bank loan also is an example of a liability. Now what are the types of liabilities? Nowadays your life is very simple. If you remember current, one type is current, the other type is non-current. So non-current is something which will be settled after one year which has a life of more than one year. So can you think of any examples of non-current liability? I think bank loan which we discussed was one because it is mostly for more than one year. But other than bank loan, are there any other liabilities? Any other non-current liabilities? These are long term or non-current liabilities, they are likely to be repaid or performed beyond one year. Usually they represent sources of funds because that is how the enterprise or company is raising its funds. Now example one is bank loan you already know if it is more than one year. It can be loan from NBFCs, do you know what is NBFC? Full form is non-banking financial companies. So other than banks, there are companies which give you variety of loans. That is also a non-current liability for us. One more possible liability is debenture. Now what do you understand by debentures? debenture also is a type of loan. So many companies come out with a debenture issue. They inform the investors that we will issue you debentures. Investors pay them money and they issue a certificate for debenture. So it is a loan but which can be traded in the debt market. In any case as far as the balance sheet is concerned it is an example of a long term loan. One more possible liability is deferred tax liability. Earlier we had discussed a bit on it when we discussed the format. So normally the tax liability should be paid within one year but under special circumstances or because of some specific provision in the law if it can be paid after more than one year it will be called as a deferred tax liability. Now the other type is current liability. I think you all know the examples but just have a look. So these are the obligations which are likely to be repaid or performed within one year and normally they come from day to day business transactions or from the money cycle or from the business cycle as we were seeing. I think you know most of the examples. One is creditors also known as accounts payable then outstanding expenses. Now what do you mean by outstanding expenses? So for example if you have got 100 employees normally the salary should be paid on the last day of the month say on 30th or 31st. If we do not pay salary on that day and we pay salary on let us say salary of April should be paid by 30th of April but if you do not pay. If we pay it in May on 10th of May then on 30th of April up to 9th of May if you make a daily balance sheet in each balance sheet it will be shown as a outstanding expense or it can be also called as an outstanding liability. Knowing that any expense which is unpaid will be considered as an outstanding expense. Then one more example is interest accrued but not due. Now what is the meaning? So suppose you have taken loan from bank let us say you have taken loan of 1 lakh at 10% per annum that means every year you have to pay 10% so on 1 lakh you have to pay 10,000 but at the end of the year. Now at the end of the year if you do not pay 10,000 it will be an example of an outstanding expense which we have already discussed but even during the year let us say 3 months are over and you are preparing a balance sheet. So you have to pay 10,000 at the end of the year that means at the end of 3 months you have to pay 1 4th of 10,000 or say 2,500 but you do not have to pay it now you will pay it at the end of the year but at the end of 3 months you have already created an obligation it is called as an accrued interest it is accrued but not due due curve hojayaega ek saal ke baat due hojayaega but after 3 months since you have used the funds you will need to show 2,500 as an accrued interest it is one more example of current liability. The next example is provision for tax now what is the meaning? As we were discussing whatever profit we earn we have to pay income tax on it the calculation is done by us finally it is to be approved by income tax department until it is approved by department we will show as per our calculation we will calculate the profit as per our calculation we will also calculate the taxes payable till the time we pay it it will be shown as provision for tax under the head current liabilities. The next is bank overdraft now what is the meaning of bank overdraft? Now bank gives a facility to the account holder that account holder can withdraw some money that is called as a bank overdraft so suppose we have deposited 10,000 in bank normally we can withdraw only 10,000 balance will be 0 but in case of current accounts you can deposit 10,000 but you can withdraw 15,000 that 5000 which you have taken more the balance in the bank account will be appearing as minus 5,000 that minus 5,000 is called as a bank overdraft of course there will be a limit that a particular company can draw how much from the bank but it is payable in the short term so it is considered as a current liability are you getting? Just think of some more examples of current liabilities now we have understood both non-current assets, current assets then current non-current liabilities current liabilities think of the examples and they will be discussed on the discussion forum ok. Now let us go to one special type of liability that is called as a provision if you have marked when we discuss the current liability we had shown one item known as provision for tax now did you think why it is called as a provision why I did not call it as outstanding tax Agar mani tax time pehbhara no problem no liabilities created if I do not pay tax on time it should have been shown as a outstanding tax but instead of calling it outstanding we are calling it provision for tax now what is the reason ok now have a look at it so provision are those amounts which are retained by way of providing for a known liability for which amount cannot be determined with substantial accuracy that means I know there is a obligation I know there is a liability but I do not know exactly how much should be payable in such scenarios you create a special item it is also a type of liability but it has a special name as provision so provision refers to amount which is set aside for meeting claims which are admissible but amount is not yet confirmed now examples are also in front of you one example is provision for electricity charges now let us say we prepare accounts or balance sheet at the end of 31st of March and every month we get the bill for electricity on the 10th of next month that means February kajo bill have a 10th of March ko aega March kajo bill have a 10th of April ko aega that means on 31st March I do not know the amount of bill but I know that I have consumed electricity that means some amount is payable on account of electricity charges so as on 31st March when I am making a balance sheet I am unaware of the amount which I have to pay but I am very much aware that electricity has been consumed that means some amount needs to be provided for so we will create a provision now the question which will come in your mind is so far we have not received any bill so how will we know the charges for electricity bill for the month of March now there are various ways of estimating for example I can do one thing I know the charges for last 11 months right from April to February I have all the bills only March bill is pending so I can take average of 11 months or I can even take last March electricity bill and add 5 or 10 percent and treat it as a provision for this March so there are various ways of estimating but there will be some estimation done and a provision is created I hope you are getting what is a provision another example which we are already discussed was provision for taxes now as far as the provision is concerned we do not know how much taxes will be finally payable because those decisions are taken by tax authorities but what I do is based on my understanding I calculate profit I also calculate the taxes payable and make a provision in the balance sheet for estimated amount of taxes likely to be paid that is called as a provision for tax same way to the employees normally bonus is paid at the end of the year based on their performance exact amount is not known because that will be known after performance evaluation so as on 31st March some estimated provision is made for bonus that is called as provision for bonus there is a possibility that there will be some bad debts we are having debtors or accounts receivable in the balance sheet there could be some bad debts maybe half percent maybe 1 percent maybe 2 percent maybe 5 percent according to the type of business I will make an estimate and create a provision that is known as provision for bad debts so today we have discussed both current non-current assets then current non-current liabilities and we have come up to some specific liability which is called as provision in our next session we will go ahead and go into further some more types of liabilities and then into profit and loss account. Thank you so much.


Anybody else? Anything else? I have Dojo, I have Fiori, I have JQBidget, YUI. Anybody else has played around with any other frameworks? Everybody's saying this, you know, that's why. I'm trying to see if anybody has heard the name, because that's the whole talk about this. So I put up the slide over there, okay, Bootstrap, yeah, yeah, to some extent. But still, I feel like, you know, Bootstrap, only the CSS, you've got to have your HTML and then Bootstrap does the magic, but it doesn't give you anything else other than that. It's just the colored thing that, you know, I see Bootstrap as. I have not started the session, don't worry, I'm just interacting, you know, she's like, she's already started, now, she's still waiting for some more guys to come in. By the way, if I say next 45 minutes is death by PPD, will you still sit? That's a tough question, right? You cannot say yes, you cannot say no, no, I'm not going to do that, and we have an internet challenge, so we'll see.  How many of you know this? What will it do now? Yeah. It's a static, I see it somewhere, you've attended some other event, e-maps, yeah, okay. So basically what I'm trying to do is my, I don't know, if you ever had this need that you're quickly building some HTML for completely static web pages and then, but you need a web server to, you know, kind of make that feel, right? I come from .NET world, so for us, the day in and day out, it's all about Visual Studio and then you do file new ASP.NET application, but that's too heavy for me, like, you know, I have to wait for the IDE to do everything. All I needed was, I'm creating an HTML file, I just need localhost colon 8080 slash index dot html, I want to do that, right? So believe me or not, I figured out about this only like a three months back. I was wondering how the hell do you do this, right? An npm as you rightly said is a.


Let's do a final example from lecture 15, which would be our last example about partial fraction decompositions. This one's gonna be a little bit of a doozy, so maybe pause the movie and take a bathroom break before we get started here. Because what's gonna happen this time is that we're gonna have an irreducible quadratic, x squared plus four. Now good news for us, this is already a completed square, it's a sum of two squares, so that saves us a lot of effort, we don't have to commit the square. But in this example, it's a repeated, it's a repeated irreducible quadratic. What does that do for the template here? So what's gonna happen is we're looking for things of the form ax plus b over x squared plus four plus cx plus d over x squared plus four squared, dx. This is the template that we have to look for. Because the quadratic is repeated, we need to have a partial fraction for the first power, and the second power. So we need to have two of those things. If we clear the denominators, we're gonna get x cubed plus x squared is equal to ax plus b times x squared plus four, and then we have cx plus d. Now if you want to, you can try to use annihilation to help us here, but it's gonna get really messy really quickly, it doesn't work super well. I would recommend just to foil these things out and try the systems of equations.  And so let's combine some like terms here. If we take an equation for x cubed, x cubed, you get a one on the left hand side. On the right hand side, we're just gonna get an a. So that's actually pretty nice, right? We already know what a is if we take the system of equation approach. And if you try x squared, on the left hand side, you're gonna get a one again that comes from this term. If you look for x squared on the right, you just find a b, in which case you get one equals b. So we already know what b is, that's pretty nice. If we try the x term on the right hand side, left hand side, there's nothing there, so you get a zero. On the right hand side, we're gonna get a four a and a c. So you get four a plus c. But I wanna admit that we already know what a is. a is equal to one. So this is actually, that is to say zero equals four plus c, which says that c equals negative four. That's not so bad at all. And then finally, if you look at the constant term, same basic idea, the left hand side doesn't have a constant, so that means it's zero. And for the right hand side, you have a four b and a d, so you actually get the exact same situation, zero equals four b plus d, and since b is one, this will tell us that d is equal to negative four. So even though we had a linear system with four equations, four unknowns, we're actually able to solve it very, very quickly and get one, one negative four and negative four. So what that tells us for our integral, so we had the first one had the denominator of x squared plus four, dx. And this is the one that was ax plus b, so it's just gonna give us x plus one. And then the next one, we had a coefficient, this is the one where you had a x squared plus four squared on the bottom. And this is the one that had negative four, so we're gonna get negative four x minus four dx like so. And so you can factor out the common, that common divisor negative four on the second one. So actually, I'm gonna write this as, get rid of that, get rid of that. We're gonna write this as negative four x plus one, like so. And so now we have the partial fractions here. And now the whole point of partial fractions is to get something that's more comfortable for more comfortable for the integration, how we can integrate this thing. So now we're gonna do a u substitution right here, because when we have these irreducible quadratics, we start with a u substitution. X squared plus four is our u. And so du is gonna equal two x, and that's it, two x dx. And that's gonna be the same u substitution we use here and in here, right? And so we want a two x in the numerator, so we can accomplish that by times e by two, divide by one half. This one already has a two, so we can kind of borrow it. We have a two right here and then a two right here. That's gonna give us one half, the integral of two x. If you distribute this two, of course, we don't want the two. So we have a two x dx over x squared plus four. And then we're gonna have a, well, you distribute the two, but there's also one half here. It's just gonna become the integral of dx over x squared plus four, like so. So the second one, we're gonna get negative two times the integral of two x dx over x squared plus four squared. And then the next one, we're gonna have negative four times dx over x squared plus four squared, like so. So we break these things up. So now the first two, sorry, I shouldn't say the first two, the first one and the third one are perfect for u substitution. So what we've seen already by the u substitution we did right here, this will look like, this first one would look like one over u. This one over here is gonna look like one over u squared. And so by u substitution, we're gonna get one half the natural log of x squared plus four, we get that one. Then for the second one by the power rule, that would become a negative one over u. So we're gonna get plus two, plus two over x squared plus four. So we can take care of those ones just fine. Now what do we do on this one right here? I told you in a previous video that we're gonna want to try to memorize anything of the form dx over x squared plus a squared. The anti-derivative looks like one over a arc tangent of x over a plus a constant. And so you just wanna use that one right here because it exactly has that template. And so we end up with, in this case, a is two, so we get one half arc tangent of x over two. And then the last thing we have to do with is this one, this four integral of dx over x squared plus four squared. Now this one we don't have it memorized. We'll actually just wanna have to do a trig sub right here. And so kind of going with that, whoops, going with this one, our trig sub, much like it's the trig sub we would have done for this thing if we went through all the details here, we would take x to equal two tangent theta, which then says that dx equals two secant squared theta d theta. And this also tells us that the square root of x squared plus four equals two secant theta, which means that x squared plus four equals four secant squared. All right, so plugging those into that expression, I'm just gonna deal with just this for a moment. Put it here. The dx, remember, becomes a two secant squared theta d theta. This, it's above x squared plus four, which is gonna be four secant squared theta. But then we're squaring that. So canceling some terms, there is a secant squared that's gonna cancel. And then you have a coefficient of one eighth when you're all done here. So we have one eighth the integral of just secant squared on the bottom. Now, since we just have a secant squared in the denominator, it's gonna be my recommendation. It's gonna be my recommendation you replace that with us just a cosine, right? Because secant on the bottom is a cosine on the top. So this would become one eighth the integral of cosine squared theta d theta. And when we have just a cosine squared, you wanna use a half angle identity. So remember that cosine squared is the same thing as one half, one plus cosine of two theta d theta, for which case we can quite easily anti-differentiate that. The one eighth and one half come together to make a one sixteenth. Anti-derivative one is theta and anti-derivative of cosine of two theta, that would be a one half sine of two theta. And then there's a constant right here. Now, when you have the sine of two theta, we wanna relate this in terms of theta, not two theta. So we're gonna write this as one sixteenth theta plus sine of two theta is the same thing as two sine theta, cosine theta. So you get sine theta, cosine theta plus a constant. The two cancels with the one half that was there. I never actually drew the triangle this time, but remember our triangle diagram would look something like the following. And so we have theta right here. Our original substitution remember was x was equal to two tangent theta, which is to say that tangent theta is x over two. So that's opposite over adjacent. So you get x over two. The other side will be the square root of x squared plus four. And so putting all of those together then, we're gonna get one sixteenth. For theta, we actually will get arctangent of x over two for sine and cosine, right? Sine is opposite over hypotenuse. Cosine is adjacent over hypotenuse. So that ends up giving us a two x over x squared plus four. And so this is our anti-derivative of that very final integral. Let's take a look at what we had before. So there's an arctangent and there's a x squared over four part that shows up. You'll notice that we also have a arctangent of x over two and we also have a two over x squared plus four. So we make those substitutions, make sure you times this answer we just got by negative four. When you plug those in here, I have to kind of do it down here. When you plug those in, we had this one half the natural log of x squared plus four. We had this two over x squared plus four, remember? We had this one fourth arctangent of x over two. And then finally we then got this and I'm combining some light terms right there. And then maybe I shouldn't go too far ahead then. Let me back up a little bit. So remember we had a one half arctangent right there. So let me just copy that down, arctangent of x over two. And so from this red part, if we insert that into the problem, we can distribute these things through. We end up with a one sixteenth that I get my coefficient right there. And then I feel like something might be off. We get a one sixteenth, my spider sense is tingling, but we'll come back to look at that in a second, x over two.  Like so, I feel like this shouldn't be a 16. I feel like it should be much smaller than that. Let's come back to the red area. What was going on there? So we had a one eighth that's in front. Oh yes, I know what the issue is. I forget I forgot the one fourth and the negative one fourth that should be there as well. So these two guys, that's where my mistake is. These two guys right here should have a negative one fourth that sits in front of them. Negative fourth, of course, times by a sixteenth gives us a negative one fourth like there. And so as we then distribute these things through, we're gonna have a one, looking at just the arc tangents, we have a one half arc tangent. We have a negative one fourth arc tangent. So if you subtract that, that's gonna give you a one fourth. So one half natural log of X squared plus four. We end up with positive one fourth arc tangent of X over two. And then how about this? We have this here. This is gonna be a negative one fourth. Two cancels with that, so it actually gives us a two. So we get X over X squared plus four. There's two down here. I could upgrade this to a four by putting a two down here. And so then combining them, we end up with four minus two X, I'm sorry, just X over two times X squared plus four. And then there's a constant right here. So that was a little bit of a challenge. We were able to work through it. Oops, kind of wrote over my answer there. We were able to get through it. Again, it took a little bit of effort. A trig substitution was involved in this one for that repeated quadratic factor. And that's the main thing I want you to get from this exercise right here is that if you have a repeated quadratic factor that's irreducible, your template has to adjust. So to this thing right here, that your template has to adjust. So you have one for each of the factors. Now in this situation, I kind of did it similar to how we had irreducible quadracks in the previously. But one recommendation I might make to you is that with this thing right here, you might be like, you know what? Partial fraction, decomposition, go away. I'm just going to do a trig sub. I'm going to start off with x equals two tangent theta just on this bad boy right there and go from there. It does turn out to be a lengthy calculation. It's computation intensive. But if you compare it to what we did in this example, it might be that partial fractions was not the most effective way on this one. A pure trig sub would have worked out perfectly for this one. And again, that's kind of leading to what we're going to see in lecture 16 is that as we've learned these different techniques of integration, what's the best one to use when someone's not telling you what to do? And there might be options. This one was successful using partial fractions, but we could also done it from a purely trigometric substitution. And again, it is still a messy one, but it would turn out to have been a little bit cleaner, a teeny bit cleaner. You know, we rolled around the mud for five minutes as opposed to rolling in the mud for 15 minutes. And so that's where we're going to end chapter 15 and think about strategies we can use in the next section. See you then, everyone.


this video I'm going to be going over how to find your Facebook business page URL or address. So basically whenever you come into your Facebook page a lot of times they'll be over here in your shortcuts area. So you just click on that and it'll take you straight to your Facebook business page and then up here at the very top at the address bar you just right click and then copy that address bar. Another way if it's not in your shortcuts would be to go over here to the menu which are these the nine circles and then right over here to the menu. Now make sure you don't click on the create over here that's going to create one and it should have pages right here. Now if pages is not right here you could also go up here and type pages. Click on pages and then right here will show you the pages and profiles you manage and then you just click on the page you're wanting to find the URL and then here it is up here. Now you will notice from here to here is where the URL is after your username which is right here this rest of this stuff you don't really need. So this is your Facebook business page URL.


Alright folks, before we get started, today we're going to finish up authentication. Then we're going to have a little review time for whatever time is remaining.  And so we have the midterm on Tuesday, so we'll be able to talk about it then. We'll talk about it next Thursday, so in a week. So just so we can get a feel of the room, who thinks they have definitely not signed any adversarial keys. Your certificate authority is not sure. I'm sure everything's on the list. I have been sure that's on the list. Some of you feel good about it, you feel pretty confident. Are others of you not so confident because you know you've definitely identified a key that's fake, that you've signed, or because you just think you didn't verify all of them correctly. If you use your own key to sign it, so the server doesn't count your own key signing anything, so that's not counted in the signatures. We uploaded it, we're specifically looking for everyone else's public or adversarial key is the valid signature. If you sign somebody's adversarial key with your adversarial key, yeah, that would be you, definitely, because you're vouching then for their identity, right, even if it's your fake identity.  Yeah, why would that count? Well, because how would they know? I mean, how would you know? I would like, even when we go to signing the actual key, right? So we, I believe we talk in class like that, public, your actual key and adversarial key, for signatures on that, you shouldn't have to validate for people signing your key, which is which, right? The only need to know is this signed by a key that's used in the class, right? So you could get signed by other people's adversarial keys and that's fine with your public key. But you should never sign an anybody's adversarial key, right? That's the whole point. You don't know who an adversarial key is. That's the point. Well, the point is, when signing, you need to verify that it's actually the person's identity. But on getting signatures, you don't have to verify their identity to get a signature. If the adversary doesn't care. But you care. The point is you doing verification. The point is you verifying before signing. But why would the adversary verify? So you're basically giving someone trust. Yeah, because you're giving them trust even though it's... They're not classified as a trusted source material and it should be like a hacker or something. Yeah. But I'm a hacker too. I'm trying to break the system. Correct. You get your key signed 25 but all 20 of those signatures are adversarial keys. Does it count? Yeah, it's totally fine. It doesn't matter. So your public key, the signatures, both public or adversarial, it doesn't matter. That makes sense. But I'd sign people's stuff with your adversarial key, especially when you knew it was adversarial. Right. So you're trying to give each other trust, right? But, I mean, you could... If you wanted to make sure you had a conversation about this at the start. If you wanted to, you could all sign everyone's adversarial keys, right? If you all made like this suicide pact that was like, we'll get more and extra credit than we would get points taken away. Which is fine. I mean, that's kind of a similar thing. We take a little hit by signing each other's things, but then hopefully we'll be able to get enough other people to sign our keys that that way it actually looks legitimate, right? What if an adversary was signing everyone's key so that they looked more legitimate? That'd be a thing. That's a thing. I don't want to put their regular key as only their adversarial key. What? There's someone left? I don't want to put their adversarial key. They never actually did anything with their actual public key. If they don't get anything with their public key, they're going to get like, most 20 points, maybe? I don't know. Like, not a lot of points, right? Because that's like, literally missing the sign that everyone's key with their public key, right? That's like the entire assignment from the adversarial part to the little part. All right. Cool. All right. Let's get started. All right. So, salt. So, we talked about salt on Tuesday. What is a salt in the context that we're talking about and why did we want to use one? What did it actually give us? What is a salt? Well, you would, let's say, you know, so the attacker, when they get, let's say, a database dump or something, they have the hashes and the salt, right? But the point is, even if we have the same passwords, we have the same A values, right? Because there's different salts, the hashes will be different. So, you won't, even if you break one password, right? And say, okay, I know this person's password is password, you can't actually look through the database to find out what other ones also have the same thing as password unless they had exactly the same salt. So, why do we use... So, you use salts to defeat rainbow tables because the point of a rainbow table is you're able to pre-compute what the hash would be, but by altering what the default hash would be, you can no longer do the lookup, you have to recompute the hash with every salt, and then try to do something else. Definitely. Yeah, so, the key idea is we want to add some random value, some salt to the password before it's hashed. The salt is public and known, and it is unique, well, not unique, but it is different for each user, right? So, each, every single user has a different salt associated with their hash. And therefore, the idea is every password hash will be unique, right? So, if we have the same passwords, they won't hash to the same value because there's different salts being used. And thinking about this, when we thought in terms of our model, the idea here is this actually creates a different F function for however many, however large your hash is. So, if your hash is 2 to the 8, is that 65,000? I should have just gone with it, and you would have believed me. That's not right. What's 65,000? Sure, whatever, it was like the tenth or something like that. I don't know my powers are 2. Anyways, it doesn't matter. So, the idea is to use 8 bits, then it would be, yeah. Okay, that makes sense. 8 bits would be 256 different F functions. And as you go higher and higher, you would have more and more different F functions. So, that way, an adversary can't pre-compute. It would make it computationally infeasible and space infeasible to compute all of these different rainbow tables for all of these different F functions. One other thing when we talked about countering password guessing, so we talked about actually trying to increase the time to compute the F function, right? Because we talked about, yes, a lot of systems will actually add delay. If you log in and get an incorrect password, it will delay by half a second or something, right? But that's not quite good enough because now if somebody accesses your hatches, they can hatch as fast as their hardware can allow them to go, right? They're not constrained by any delay you put in the login function. So, the idea here is one of the actual counter-vegers is to create some kind of a slow hatch. So, to create a hatch that is purposefully slow. And usually this has a controllable work factor. So, it's actually part of the algorithm of the hatch function is having this notion of how slow do you want this to be. So, early versions of this would just take MB5 or some hatch function and would do that like a thousand times. And that would maybe take the password instead of just hatching it once. They hatched either a thousand or two thousand or four thousand or five thousand depending on the work factor. So, whatever the work factor was, that would tell you how many times to do this computation. And again, now the work factor is not a hidden value. It has to be stored for every password with the hash and the salt. So, every user should have a hash, a salt, and a work factor. But it turns out that actually just doing a hash function fast is not really good enough because adversaries can actually create dedicated so they can use FPGA boards which can calculate these things very fast. And so, that's actually not...  So, BCrypt was one of the first ones designed to be slow. And you can read the details up. It has a Wikipedia page and a paper from... I don't know the exact date. It was like 99 or somewhere in like late 90s. And so, the idea was they would purposefully reuse parts, pseudo-randomly reuse parts of old computations so that that way, and I believe it's called BCrypt because it's used the blowfish encryption algorithm but made modifications to it. This is actually used on the submission server so submit, you know, all of your passwords are stored this way so if any of you actually broke into the website calculating one of these hashes on the server takes 300 milliseconds. And the server, I mean, it's an Amazon EC2 instance so it's not necessarily the fastest but at 300 milliseconds per try with unique salts per each user that's going to take you a long time to try to brute force people's passwords. There's actually a new version or a new type, kind of the latest in this area is called sCrypt and the idea is the memory usage that BCrypt forces you to use is actually fairly small so it doesn't take up a lot of memory so sCrypt was actually designed to use a lot of memory because memory, when you're building custom pieces of hardware memory is expensive, right, and fast memory is expensive but in a general purpose CPU system you can get 50 mains or 100 mains or however long it takes so the idea is sCrypt then actually forces the hashing function to use more memory. Now there's always the risk that we've talked about is somebody finds a cool shortcut that basically gets around these and actually does the hashing faster but to date these have not been known to be broken and so in that way so you have to hash them kind of the same way that the server does. Any questions on this? So this is important when you start going out there and you start developing a system and have to design a login functionality you have to think about how do we actually store passwords in our web application, in our application, in our API endpoint you should, I think actually there's pretty good general advice to just use sCrypt, like that's a good way to go I believe, yeah so anyways that's what I use, it's a good that's a good approach to say slow hashing is going to be slow, yeah What is the idea of using like you aren't using your own password system you're using someone else's password system to get access to your site would that be a better method? Possibly, it depends on your organization so we're actually talking about it later so you probably use, does anybody use a service where instead of logging into that website there's like a login with Facebook or a login with Twitter button you click on those and it goes to everybody who uses one of those something like that, that read your hands please most of you so the idea is you're essentially delegating the authentication to a third party service right saying there's a specific protocol it's called OAuth2 that allows this handshake to happen where they will go on Twitter and then Twitter will tell you back yes or no whether they're authenticated or not and there you need Twitter IDs so that you can link that up the drawbacks there are you now have a you are kind of losing your relationship with your customer depending on what information Facebook or Twitter gives you you may not even have their email address you may not have other ways to contact them so it's kind of, it's definitely a trade-off that you have to make as a business but it is important to definitely to know and for a lot of these even if you have that option very few of these will require that to be the only authentication method you can usually create an actual account on these things and then they have to deal with the password problem the passwords you have you have one main password how many, well you have to say exactly like on the order of three variations as we said but one password, three variations they may have like ten different passwords that they use that are all like really different I use a password with a different variation for your website you use the word password with different variations now you have to say that that was something I could say that even if you do, you could just tell us no and then take it yeah so what services, so what services in general do you use your passwords for? so what kind of passwords do you have just in general? I know you all have ASU passwords right? what else? laptop passwords what was that? laptop passwords your password to your physical laptop? phones phones pin code maybe finger print, other methods what else? bank well I guess I don't care about that yeah it's online banking now is so convenient that it's actually, I get really upset when I ever have to physically go into a bank like it's ridiculous like what am I doing here explaining this line to be able to do this through my phone let's say there are city public services that you need passwords for what else? it's a particularly tricky one would you use the same password for your wifi in your house that you use on your bank account? why not? you give out your wifi password to people right? one of the things social media, twitter, facebook are those important things to you? does anybody have their accounts taken over by I know somebody who had their instagram account taken over by a russian hacker but links in their bio to russian sites that were probably doing crap by downloads and stuff has anybody ever heard the stories of people will well there's a couple different variations but one thing is they'll break into somebody's social media account usually like facebook or something figure out who parents or grandparents are and then send them messages like oh my god I'm traveling so and so I'm stuck in this country I need you to wire western union me money like now so I can get out of jail or pay this bribe or whatever the story is that they come us with they only have to hack into your social media for that you can search for me and my dad and my grandfather and you can have all their family and all their spouses everything how do they contact you? they have a phone number right there oh yeah I mean if you can get it so actually this is another problem with phone calls it actually happens more with grandparents because they'll just call them like crying or whatever and then they'll get information out of them about who it is this also happens a lot on social media so yeah I mean all these things are important what are the passwords? the passwords that you use retirement accounts fidelity all of these some of you may not be thinking about that at this point you're still students but yeah investment accounts Schwab fidelity right he's going to have massive I mean what are we doing right good amounts of money in there you might have a family passphrase that you have to do if you have like a lot of things going on a what say it again family passphrase what is that? like if there's a dangerous situation you might have like a specific thing you say and you could have like a code word or something with your family so are all of these so you actually talked about it a little bit but are all of these sites all these equally important to you what's being most important? money so security email email why email? there's so many of the sites these sites we care about have email made a recent password whatever they can compromise that one and then they can search your email and find what accounts you have and probably what the usernames are and some sites will actually email you the plaintext username and password so that could be in your inbox in your multi-gigabyte Gmail archive yeah so bank accounts are a little bit trickier usually email won't give you access to a bank account it depends on the bank because some of that will require calling but the question I guess is could you impersonate could somebody impersonate you over the phone to a bank using all of the information in your email account an answer for me is definitely yes I don't know about anybody else so it's important to think about so if you use different passwords based on what's what the site is more or less important we already said we don't use the same password for our wifi that we use for our banks hopefully because we share our wifi password with people and we probably do not share our bank account password with people so if you use different passwords for different types of sites so I used to have three different passwords that are a similar kind of one was like a super easy one and other ones were more difficult variations with more special characters from that base password so I would use the super secret one the top level one for email and I should also use different bank accounts and the other ones I'd use depending on what I thought about the site so I guess the real question is how many of you use the same password in more than one place for more than one site I think I still do try not to a lot of people so are all those places where you're using a password to equally secure a new field what does that mean equally secure how the service is storing your passwords so part of it is how it's storing your password is the server as we saw is it actually using a good salted hash to store your password or is it storing it plain text some websites don't use each other some websites as we see as we'll see don't use HTTPS so they actually do submit your password in the clear so if you're on an open wifi network on a coffee shop anyway sniffing that network can see your password in the clear yeah how likely or often someone would try to hack into the server now what's the likelihood of that company getting hacked I mean it's hard to put a number on it but I think we can all agree a company with let's say 10 employees that sells clothes generally is more likely well the likely to be hacked is tricky let's say is more likely to have a security vulnerability that could allow a hacker access to it then maybe let's say Google or Facebook which have billions and rather than anyone have dedicated security teams that look at these things also the likelihood someone trying to hack it is also a lot lower correct that's why I didn't want to talk about likelihood yes the likelihood that you think Google, Facebook have much more targets right because they're much more valuable target they're probably getting tested constantly whereas this small company may not be but in the age of automated scanning hacking tools this actually doesn't really apply if you do a large scale scan of the internet for all of for a lot of different vulnerabilities so what happens if one of your passwords is leaked what happens next what's the impact let's say the simplest case in the first place somebody hacks you a website all the passwords are stored in plain text so what is also likely there in addition to your password your username your email address anything else possibly your phone number any information you give into that website could be in that leak right so you're an attacker you break into some website you get the list of all the username, passwords, email addresses what do you do next is that it? do you just profit off of that yeah so you know their email address so you see who has a Gmail address there now I have their email address their Google account so that's what they use on at least one site so if they reuse that password for their Gmail account I will log into their Gmail account and get access to their account but others are likely that they do not and the important thing is it really doesn't matter what the importance of that at first website was you could actually even if you wanted to be super malicious just create a startup or a company that just has people sign up for things and then record everyone's email and just try each of those values out in Gmail and you will definitely get some accounts get access to their email you can actually look up other websites so let's say basically oh I forgot my email okay we'll send email excuse me I forgot my password we'll send the password reset to your email as long as you're sitting on that email account at the time do the password reset and delete the email so they don't see it to be in their email like actually logged in all you need to do is get in once and typically what they'll do is add a filter that will silently redirect all incoming email to their another email account that they control so then they've logged out they only ever logged in once and now that's good because now they have access to all of your new emails which can get all those emails that they wanted to do recon on you they could then try to do iMapper pop to try to pull down all of your old emails and so what's the enabling what's the problem here why does that cannot happen likely to succeed yeah because it's the title of the slide we reuse passwords we literally use passwords so you gotta think about we talk about threats we talk about threat modeling I don't think one thing we've touched on quite yet is the tax surface so could we talk about that so we use kind of our go back to our old house analogy let's say 10 storey huge house has a lot of different ways that an attacker could get into it because there's a lot of windows a lot of doors, a lot of different entry points so the tax service there is really large whereas let's say a house that's like underground with only one elevator entrance in and out the tax service there would be a lot smaller to most threats because there's only one point of entry and progress so the attack surface there is a lot smaller so the idea is every place you reuse a password on a website or any service you're now increasing the attack surface of any of that so think of it as a union a set union if any of those websites gets compromised you can kind of consider that all of them will get compromised so now rather than just ensuring that your data is safe on one website you have to worry about every time this password is reused across multiple websites that could potentially be a huge security problem but do we need to worry about this or are passwords ever leaked? 2013 it actually just came out who first tried to say there was only quote quote 1.25 billion 1.25 billion accounts that were leaked then it turned out this year that they actually were incorrect 3.5 billion Yahoo accounts that were stolen and leaked so these are definitely email addresses I don't know the specifics of all of these about how the passwords were hashed or what they were hashed with I think in this case it was pretty bad in 2016 402 million adult friend finder accounts were and released and I'll assume that you're not familiar with this so this is a network of sites where the purpose is to find partners to commit adultery with was the purpose of these sites so what would you do with this if you're an attacker blackmail which happened actually a lot you could use the names and the email addresses find information about people like we saw then you could blackmail them see if they had spouses or were married if you find that information out and blackmail them and say you're going to tell their spouse they pay up and this actually happened a lot from the results of this leak Adobe had 152 million accounts released ebay had 145 million released this happens constantly all the time your password is if you were using these sites at these around these points your passwords were probably out there and if your password is something that could be group force and found then it was probably found in your password I understand that Adobe hack part of the problem is they actually put username and password next to each other and their actual data tables you actually in which one in the Adobe hack so where they store the password the username and password are right next to each other so basically if they got the table they got everything so actually look at this so the Adobe breach there's just one case study to illustrate how bad this problem is and Adobe actually released a statement saying that hey this is not you know it's a big deal obviously but it's not that big of a deal because we encrypted the passwords did you feel safe for that news or unsafe unsafe why they just said that encryption is right next to you yeah so why why should you how do they encrypt it how did they encrypt it why didn't they say they salted and hashed it like normal people and tell you exactly which hash function they used because that's what a good security person would say is the password or salted and hashed with a leading edge hash function and so we think obviously it's a big deal but we don't think people with strong secure passwords probably don't have a lot to worry about so Adobe said that they encrypted it I don't think I have the details here it turns out they were using like triple desks to encrypt it with a key that was not leaked so the key itself was not leaked but what's another thing so we talked about what things are in that you give to a website so you have your ID, your username your email address, your hashed password what else do you give to websites so what's another way what's another way when you forget your password that they give you access to the account phone number possibly what's that what's a security question yeah what's the concept of a security question right so it's another piece of information so when you create an account they ask you these questions like what's your what was your dog growing up what sports teams do you like which in theory are things that only you you gave to the website and you initially created an account just like the password but they don't ask you for those information every time they only ask you for the password and if you say ah I forgot my password they'll say okay then tell us prove that it's you the same person that initially created this account tell us your dog's name tell us whatever other information that they have asked you these in general I guess we're what we're talking about now they're in general incredibly poor wife so not unique what else a lot of the questions answered a lot of the questions answered by looking at facebook so if I want to get into your specific account I can either just get you to friend a random fake facebook account that I created or I can try to hack into and break the passwords of any of your friends on facebook to get access to their account to then be able to look at all your information or maybe make all that information public that's definitely another one so what about so the password reset so how would you actually implement that if you were writing that so we talk about how to do passwords right how about hatching, salting what are these security questions often people store this in plain text they don't actually hatch it which it seems like a crazy thing but the security perspective it makes slightly more sense when you think sometimes when you use these you're going to a person so the person wants to verify that you know basically what's in there not necessarily exactly what's in there so a human could do that what about does do anybody using windows 10 what information did it ask you when you created an account password country did you supply a password hint I can't remember what windows 10 does that I believe so so you could write a message that will show up whenever you enter your password incorrect so Adobe had this and those password hints were stored in the same table as the user ID, the username, the hash password and the email address can you probably guess what this person's password is from that password hint can anybody read that it says try colon space qwerty123 and that's a terrible password already b, putting that in the password hint it's not actually a hint it's just giving you a password and it's stored in plain text so the people and I've included a link below that I took you can just run, they actually have a nice in-depth analysis of this dump and so the password dump so you can look through that for all the technical details the idea is so they looked at the password they saw it as base64 encoded base64 decoded all the passwords and then put the hash values and so what they looked at they wanted to try to figure out how was this being done so they looked at the password data and they looked at the password hint and they saw that they were all at least I don't know how many let's say 32 bytes I actually don't know so based on this so a do you think that it's hash based on this no why not different sizes right so if they were hashed they'd all be exactly the same length and they did this by using an Instagram and seeing that the password length how many of the password data size and you can see they all had roughly 8 to 16 so they did some digging they figured out it was using D triple desks which is desks three times like we didn't go into this it's not really I'd say because it's not really used anymore but clearly that's not necessarily the case so the idea is then they wanted to actually try to see okay these look like they're encrypted right but how are they encrypted so one of the different types of ways we can actually use encryption different modes that we started studying it is this like I don't know the exact terms that refer to where you encrypt everything every value encrypts to the same thing as opposed to feeding your encryption back in on itself so that yes so ECB versus CBC so ECB mode so A if this was CBC mode there need to be an initialization vector block so you would have no one block elements so that's a first sign that it's not the second sign is you would look and see how many of these blocks are duplicated right because duplicate blocks would mean that they are the same password hashing of the same value which is exactly what they did so they looked at and found that this block was used in 1.6% of passwords which seems like a small percentage except when you realize it's 143 million or how many million right so 1% of that is still a million people that's crazy right and then they were they what they did they actually use previous data so they use a password breach that I didn't talk about because it was smaller and we focused on the top ones so gocker media was leaked and I don't know if it was plain text or not but they were able to get of the 180,000 passwords that were released they were able to identify the top 8 well 6 most used passwords 1, 2, 3, 4, 5, 6 password 1, 2, 3, 5, 6, 7, 8 which is funny because 1, 2, 3, 5, 6, 7 is not on here so Y is up to 8 more life hack is one that so life hacker or life hack is one of the blogs so that's probably why that password was used so they basically use this as kind of a base to think okay we can think that those are the passwords and remember now this is something they can't they don't necessarily have the DES key that was used to actually encrypt all these things so they don't have that key so they can't just brute force things but they can do is put all these password blocks together right group them see what all the password hints are and so you get something like this so you can start writing passwords so you can say that this one the most frequently used password in their list was 1, 2, 3, 4, 5, 6 which you can easily tell by the password hint this looks like a program this is a very bad person because they should know better numbers 1-8 which is actually a little bit better a little bit slightly more cryptic 8 digit this one is pretty bad the password is password actually looking at these you can see that they probably had a mechanism to make sure that the password hint is not exactly the same as the password right which is why many people probably can't use a way to do this so this is one so this is how you can still breach you can still break passwords even and leak people's information and you know these are passwords these are all have associated email addresses with them right I mean this isn't a bad just curious currently there is like well recently like with facts like you can leave a bunch of social securities I don't I didn't want to talk about them there hasn't been enough details released about specifically what data has been leaked so I didn't want to go over that but yeah aqua facts is a huge recent one but next time I teach this I will definitely probably talk about that so how do we fix this right so as end of so A1 problem is as a website owner it's actually difficult to prevent your use right because you're only one site one authentication mechanism so the what I do is I actually have random past like I have unique random passwords for every single website that I use and I use a password manager so the idea is keep track of passwords and generates random passwords per website so if you were to ask me what's my ASU password I literally don't know like I never type it in I don't know what it is so what's the so the pro here should be pretty obvious right the pro is hey you're using good unique passwords for every single website so you don't have to worry if that website is ever compromised because what do you care your password is something random that's not used on any other websites what's the con manager then they get everything else if they break into the password manager they can break into all my passwords the password manager like you have no way to access your accounts if you lose your password to the password manager yes the one thing we're going to talk about is usually the way most of these work is your password database is actually encrypted with your master password so you do have to know and memorize one really good password and that unlocks the database so different there's all different types of doing this I actually I mean I use last pass which I'll talk about in a second the way they work is they actually don't even store your passwords they store the encrypted database in your passwords your extension or your your iphone app hold down that encrypted database and when you want to use it you type in your master password so even if somebody were to break into last pass and steal all the encrypted passwords they shouldn't be able to derive and break any of those passwords because they don't have my master password what are some other cons we had some people in this course set up a certificate authority would you trust them to set up a password authority a password manager you can be honest I see people taking their heads would you trust the I wouldn't trust I don't know enough about crypto exactly I mean not to fault you guys or anything right it's about um so they can't yeah do you have a comment I was just going to say it kind of goes back to when they were securing our house obviously they're coming and they can break into the house I want to use them someone out there whoever administers this password manager knows they're a single password they're going to be right so yeah you want either cryptographic guarantees that they don't do that I mean even though I know that last pass doesn't store the encrypted version there's no nothing that says that they don't so I enter my master password and just send that master password back to them you could definitely do that technically right there's nothing stopping it from doing that the only thing stopping it is the company and their reputation and the only reason I do this is that I trust in them that they will actually do this so it really comes down to who do you trust who do you trust to do this um and so you can the idea is you should think about this problem and understand the scope of it and understand the who do I trust versus not trust um you get different there's different usability and security tradeoffs so there are some things like I believe uh it was a key pass well there uh key pass I believe allows you to have a local encrypted copy and key pass is also open source so you can analyze it and you could convince yourself whether it's secure or not whether you have the expertise to do that or not hiding anything there that's another thing but you could start from the source analyze it you could compile it yourself on your machine so you know that they're not adding any backdoors to the compilation process um I believe key pass uses a local encrypted database so it stores a database encrypted encrypted with your master password but it never touches their servers uh at least I believe that I think that's true um and so you just kind of have to make if you want to know this route you can you have to make your own decisions and your own um ideas about whether that tradeoff is worth it so for me I use last pass because I want to use the same pass manager on your phone and on my browser and uh to me that's much more useful having that syncing feature than having the security just having a local database um I also another thing you want to think about when you think about these things is what's the incentive of the company so like last pass actually you can use them for free you can use them for free as soon as I started to use them I was like no I'm going to pay them money to do this because I want to keep them around right I don't want them to have and I believe it's insanely cheap I think it's 12 dollars a year for um a last pass subscription and they have additional cool features like you can share passwords with people so if I wanted to give you access to my Netflix account or some other account um I can share that password with you if you're using last pass and then you don't actually know the password because the auto fills it in so I can just revoke that through last pass I can be relatively confident that you'll know the password right um there's probably still technical work around but assuming you semi trust people that's kind of uh the honest but curious adversary anybody use password managers nice anybody use anyone that's not in this list that they want to plug Google Google has a password manager yeah that's the problem I've been really giving Google everything anybody use anything else Google literally already has a lot of my stuff so so there's a lot more about you know and if usability is you think is a problem I can tell you that I've gotten uh both my mom and my dad to use last pass and to actually use it um it does require some tech support phone calls that are once in a while but not a lot but the security benefit here is much uh much more proof uh okay so we actually talked about this so we um we talked about password recovery right this is another important part of password based self dedication what happens when you forget your password right it's really easy for us as security people to design things and trust that the user will always do exactly what we tell them and instruct them to do right I've created at least four or five passwords for people in the class who forgot their password um and so the idea is are you completely locked out of your account at that point is there nothing you can do sometimes you know because it's a terrible business decision right because if the business relied on you using your password they would let you choose the easiest password ever because they just want to do business with you right um so we talked about most of them will send an email to your email account with a link to reset your password or a new password or so what does it mean if a website sends you an email with your username and password when you say most likely they're in storing it in plain text yeah the only thing could be if they're storing it kind of like the adobe thing where it's encrypted and they can decrypt it but as we've seen that actually causes a lot of problems because they're not doing a good insulting and hashing method right so that definitely causes problems cool so an important component of most types of security so we've looked at passwords right so which type of authentication mechanism something you know it's something you know right so the idea is well to increase the security of that right should I ask you two things you know should I ask you three things you know or four things you know you can is it improve the security over just asking for one thing you know significantly on the inside no right because I mean I guess it kind of does depend a little bit on how you do it right so if I ask you for it so let's say you had I asked you when you signed up um what's your favorite dog or what's the name of your favorite dog and a password and then every time you logged in I would ask you what's the name of your favorite dog and I'd ask you for your password and only if those were two were correct I'd allow you to begin right well in that case the name of your dog is essentially part of your password now right it's basically equivalent the way it could get interesting is if you let's say you signed up for like five different things and they randomly asked you one of those things in addition to your password so in order for somebody to break into your account they need to wait until they saw and knew the answers to all those pieces of information but really the way we like to think about it is if you're asking for multiple things that they know right that doesn't really significantly improve the security of the system so if somebody is asking you about two factor authentication and you talk about passwords and security questions that is not two factor authentication that is a single factor of authentication because the factor here is we're talking about the authentication categories that we talked about right so it needs to be something that you know and what else something that you have or something that you are right so this would be so anybody use two factor authentication on google you should definitely use this mmm yeah so this is so A we just talked about your emails probably one of your most important accounts you saw me use do a security for ASU ASU student workers or anything like that yeah I know it's annoying but so is bringing your keys with you everywhere because you're going to get locked out of your house if you leave your keys at home right or you lose your keys right yes it's annoying but it proves that hey not only do you know this person's password but you have access to their phone so for instance I can show you my google authenticator so for those that haven't seen it I will briefly wave it at you I will definitely not record it so I have google drop box in the last pass all up here on two factor authentication so you can see that it's randomly generated some sick digit numbers and these numbers are only valid for I think a minute you can't see it in the lower right there's a timer counting down for each of these and that's the length of time that this security token is valid so why can't I show this to you A it's going to change so it's just changed right now so you've had to use it in that time period that I showed it to you what else do you need you need my password you need my google password like I told you I don't even know what that is it's something long and random I am very confident that I can show you these and none of you will be able to break my account now let's say that I was not so savvy and I was like we talked about reusing passwords on multiple websites right so I have my password of 1 2 3 on account site A, site A gets hacked it's called Adobe for A gets hacked it has my email address they find out that's my password, they try it on gmail and let's say now I'm using two factor authentication so now what happens to the attacker do they have access to the account what do they need to access the account yeah my phone well technically my phone or the way these things work is so the other reason why I can show you these is these numbers based on the current numbers you cannot predict the next number so it's a pseudo random sequence and it's all based off of a starting secret key so the server knows the secret key it transmitted it to this phone the QR code that you scan and so that way both the server and my phone know the secret key and so they can keep infinitely generating keys that are completely random but the server will be able to check that that random value is one of these values so what this means for authentication is I can only log into Google or Dropbox or LastPass if I have this phone what are the downfalls there what else is on the downfalls if someone steals your phone somebody steals my phone what can they do depending if they already know your passcode you get in or if you have weak security to open up your phone now they have your phone so when they ask for MFA they can just open up the app yes so that's good so but it requires that somebody who steals my phone also knows my password so this is where the two factors come into play so I think we can agree that it may cost some value for somebody to steal my password it may cost some other value to the attacker to steal my phone but for somebody to do both they have to actually do both and pay both for that cost so it's definitely possible it doesn't completely protect me but it does kind of add an additional layer of security and additional I'm much more sure about my password to my account you could also do so who has fingerprints enabled on their phone is that two factor it's just a replacement of a one factor exactly it's replacing one factor your pin code with your fingerprint hopefully you can see that these kind of simplified models don't necessarily always translate 100% because most phones if you restart it or if your fingerprint fails three times it will ask you to pin code so it's a little bit it's using different factors but it's not necessarily requiring two factors I mean even Google even the ASU, the Duo Security stuff I can tell Google to remember this computer for 30 days which means it won't ask me for that second factor again for 30 days on this computer which means that if somebody steals my factor and logs in for another computer they'll get challenged but if Mahler is executing on my machine and goes to Gmail it can read everything and see everything because it has the token and if my machine is compromised well the attacker could see me typing the password and see me typing in that six digit code for my authenticator anyways so I'm kind of screwed hopefully if I don't trust this machine questions on two factor and then two factors obviously just said NFA so that would be multi factor authentication that would be more than one so this would be if I had to do a fingerprint scan and have a token and have a password I highly recommend you look at your stuff, look at your online world and think about signing up for these things because these are really important and actually do I think this is an easy step that you can use to measurably improve your digital security whoever faced a capture before I don't have a good transition for these yeah what is it, what is the capture improve your data robot so captures are completely automated public terming test to tell computers and humans apart this is what it stands for if you've ever seen it you see something like this right so the idea is to proceed you need to type in what those words are this is an inquiry to be able to proceed so talk about that in a second is capture authentication are humans authentication proving that you are someone or that you are the someone that is trying to access something well you tell me you studied authentication that's with my definition of authentication this would be because you're not proving you're you're not proving you're someone to access something specific you're getting past you're proving that you are a someone well I guess it would be more akin to having to get past a door right the door is not necessarily locked but you still have to get through interesting it's not proving who you are proving at least is what you're not proving proving what you're not in the sense that you're not in this case you're proving you're not a robot but it's not proving that you are who you tried to log in as I would argue that you can use authentication interesting yeah Carlos do you have any opinions on this it's a tricky question I think you could maybe try to twist authentication into especially when you start thinking about groups maybe you just want to authenticate that you're a member of a group of humans or something like maybe your system doesn't care but yeah no I definitely agree I mean I kind of I would say yes it's not really authentication because it's not identifying you right this is something that literally any human should be able to pass or any human that looks like knows English so how do you break this are from recapitia which these the overall some inquiry examples oh no I just gave the robots the answer those words actually come from scanning books so you're actually performing OCR and digitizing books by correctly answering these values so it's actually can be a good thing in some sense so it's using this not just as an annoying thing but as a good but how would you break this yeah so you could use natural language processing use computer vision, use machine learning any of these techniques there's actually a lot of work that's been done on breaking captures, a lot of research it used to be fairly simple you could easily chunk up the characters and use image recognition or machine learning to identify each character so that's why you get these kind of wavy things so it's harder to chunk up each characters Ticketmaster so they have I wouldn't say they probably still have a big problem with bots and people automatically buying tickets to then later resell on the market I was reading an article and it turns out that one of the people who who did this and automated this breaking in captures they actually only had like 60,000 different captures so they figured this out they downloaded every single capture image and then broke it by hand and kept that in a table and just hashed the image and then figured out which one it was and they looked at it and that's how they broke it yeah can you just say that this recapture of broken widget thing crowdsources digitizing books yes some of the things like google's line uses like house numbers and other types of things from the google street view of the google and that thing stuff usually what they'll do is they'll that's why they have two words so it's one that they know the answer to so they can check and then another one to then test you on basically and then over time they see obviously answers will be much more correct than other ones other ways to do this that you probably don't think about so if I'm a bad guy and I want to break a capture because I want to do some automated thing against your system what they do is they either just pay humans to do it so they can use something like mechanical Turk and just send the image to somebody else get the answer back and then you put that answer to continue or they will create a let's say an enticing website that tries to get people to visit and see the content to that website but they will put captures before you're allowed to see the content and those captures aren't their captures they're actually captures from whatever system they want to break or use so they'll go see a capture because they're doing some automated crawling or scanning then send that to their other site which is on an illicit or I think enticing content it's probably the best way to put that and then they'll throw that capture to a human who really wants to solve it they'll solve it, send the answer back to the original one so you can think about it as like capture it in the middle of passing captures so additional things we have talked about token based authentication which is kind of what we talked about with two factor authentication so these random tokens can be hardware based so actually I believe Google just released this like Google advanced security for accounts where they ship you a special key that looks pretty interesting a dress based authentication and then we talked about let's say restrict so your company restricting access to the VPN or some server if you say okay I will whitelist and only IP addresses that I know of can access this site so you can restrict kind of a sense of address which could be physical or physical in the case of location based authentication this is actually super cool so oh I don't have my key I should have brought it so my car key actually when I'm close and when I open the door I'll actually unlock the car door when I'm close so you think that should be pretty easy you share some secret you exchange something to prove that you're there the problem is when I'm here at ASU I don't know that one of you isn't standing with a big antenna to talk to my key to then transmit that signal either wirelessly to somebody else in the garage or something else or over some other beam to identify that signal so it gets from the car to my key so they actually have a whole bunch of location based authentication so that actually keeps time into account so that the server sends a challenge and time stamps it and you have to reply with literally like within the physical timeframe it takes from light to travel to the car to the max distance and back and if you don't reply that time then the server will drop and will not do it and you can't do these extension attacks which are super interesting biometrics as we talk about fingerprint, voice, face there's a lot of future research to be done in the area of authentication this is not something that's a solved problem I mean you're even seeing this now with the rise of two-factor authentication tokens things are constantly changing one thing we talked about continuous authentication so rather than just verify the user once and give them access to everything you either authenticate them constantly or you choose different areas Amazon is usually really good about knowing who you are and log in so you'll go to Amazon and they'll say hello whatever in the upper right but when you try to look at your task orders it will then ask you for your task order so you can try to think about the different levels of security for different parts of your functionality maybe some things you require two-factor authentication some things one factor is okay there's a whole push to try to replace passwords as we've said it's the worst system but it's better than anything else we've tried yet so FIDO if you want to look this up is a cool authentication mechanism where it's done 100% transparently and keys are stored on a physical device so you authenticate to the device and that allows you access to any website so if you authenticate you it's a really cool protocol and as we talked about access slash authentication delegation so OAuth 2.0 actually you'll see this of ASU's online services so anyway use the Outlook the OWA Outlook Web Access or ASU so when you go there you go to Microsoft server you go to Outlook.Whatever ASU password it redirects you then to an ASU login page where that logs you in checks your password with ASU's database then tells Microsoft yes this person's authenticated and this is who they are so you think about that is this way is great for Microsoft because they don't want your ASU username or password they just want to handle your email and get money from ASU for doing so they don't want your passwords because they want ASU to deal with that any questions on this? 2 minutes for any minutes or questions go


Hello, everyone. I'm Gabrielle over here at Oxmer Toyota. You guys, I wanted to do a video on a new 2023. This is a Toyota RAV4. This is the limited. So you guys, this vehicle has a ton of features and we wanted to show it off. Now that exterior color is in the Wynn Chill Pearl. Absolutely beautiful. You are going to have the LED headlights, daylight running lights. You do have that nice gray front grille. Now there's going to be 19 inch alloy wheels. Now if you look at the top of the vehicle, you are going to have the black roof rack rails. And with this, you are going to have the black badging.  And then you do have your dual exhaust. Now going into the interior, this is really where this vehicle shines. Starting with that door panel, it is going to be in a nut mag interior color, but you are going to have a two memory seating. There is going to be a 12.3 inch screen right here by your steering wheel. And then you are going to have a 10.5 inch LCD screen. There is going to be heated and cooled seating. There is a wireless charger. You are going to have a heated steering wheel. There is going to be different driving modes. There is a beautiful sunroof. I mean as you can see, there is just a ton of features. And that nut mag color is really gorgeous. And in the back, you are going to have multiple charging ports. And you are going to have a 60-40 split. And also throughout that vehicle, you are going to have all-weather floor liners. All right, you all. So if you have any questions on this beautiful limited RAV, feel free to let us know. All of our contact info is listed right here. All right, guys, have a wonderful day and I'll see you all soon. Bye.