Did you know that if you rearrange the letters of male men, it really pisses him off? I'm just luck. Hey, welcome back to our show with Drexel Corbyn. I'm Rick. You can follow us on Instagram, Twitter, or forward juicy content. Thank you to everyone who supports us on Patreon. Follow us on Twitter, Instagram, like button. Many thanks. Oh, Patreon peeps. Oh, Patreon. Oh, Patreon. You are the best. Today we got a game. What? Yes. Good. This is a guess. Guess that, Hindi movie. And it's from the stills, but it's, I believe it's the same guy that made the first one. He saw that everybody said it was too easy, and so he's made it. Too easy? Harder. It's what he says. I love it when you make it harder. Who? This guy? Any time, anywhere, anyhow. Any time anything is harder? Like when I woke up this morning. I don't get it. Explain it to me in horny detail. I had a boner. Ah! Okay. So, same rules as always. Yeah. And watch Corbin freak out because he's got to win. That's an inevitability. It's very American of you. Got to win. Well, at least I don't have a gun yet. True. They're doing the buybacks. Did you hear about that today? No. Yeah. If you bring in a broken one, yeah, California, if you bring in a broken gun, 50 bucks. If you bring in a working gun, 100 bucks. If you bring in anything that is in the assault rifle category, 200 bucks. Those guns cause a lot more than 200 bucks. Yeah, they do. They should probably consider a little more. That's what we'll do. That'll draw them in when they can sell them on the black market for ten times that. Yeah, yeah, yeah. Anyway. Stupid. Here we go. At least they're trying. Yeah, I guess. At least they're trying. Something, right? Yeah. Here we go. One point for guessing it right. Ready? Yes, the movie. One, two, three. Go! Oh, that's a... That's a... From last year. Yep. Great movie. Great movie. Love that movie. Yeah. That's 100% it. Yeah. One. Zero. Did you remember it? Could you have remembered the name? If you'd given me another 10 to 15 seconds, I would have. Cause I would have. Oh, yeah. I remember that movie. What was that we saw a while back? And then I would have gotten the color. Okay. Yeah. Here we go. That's Topsy. I remember that tattoo. Pink. Hold on, don't say anything yet. That is correct. Cause she's holding on to Amitabh Bachchan. Yep. I remember the tattoo on there too. That's Amitabh Bachchan's fingers, you know. That's her fingers on his arm. No. But she's in the courtroom. No. So yeah, that's pink. Yes it is. Great movie. Great movie. One of the first we saw... Very early on. Yeah, very early on. Very early on. Ready? That might be our first big B. Rule number one. It might be. Yeah. Here we go. Oh, geez. Oh, that's... That's... Rithic. Is this Deborah? No. No? Wow. I think it's Deborah. I think you're right. Unless it's like Chris that we haven't seen. No, I think you're right. I think you're right. I think that's Deborah. Yeah. That was a difficult one, though. That was. That was a good... That was a good one. Stars. Terrorists. The American ones? Yeah, but why am I thinking... I don't think that's what this is. I... No. Oh. Wait, was that Hindi? This one is stumping me. I know I'm going to hate myself when I see the title, though. Because it's familiar to me, but I... It's not that other one that I was questioning if it was Hindi. Yes. I'm sticking with stars, but I don't think I'm right. I'm going to go with... I can't think of anything. Oh! Nice. The... I knew we recognized that shot, but that's a good... That was a good choice. The Hindi Drishyam. Nice. Here we go. Lal Singh. No. I saw her, and then I saw him. Is that 3-0? 4-0? Yeah. Oh. What's the name of that movie? I call it... Yeah. Boo-boo. Yeah. I got the BB out first. You did. Give me this one. I will give it to you. Thank you. That was... How is that a hard shot from that, though? That's the iconic shot. That was... We got to throw one in there for Rick. 4-1. So, boo... Boo-boo-lya. Boo-lya. Okay. Here we go. 4-1. That's the Gersnatch. You're right. Good job. 4-2. Yep. Why isn't the name coming up? I don't know. Shit. This is... Sardarudam. No. This... I don't remember the name, but it's the... It's the military one. Where... That they have to travel up the mountain, and he dies. I know what you're talking about. Do you know what I'm talking about? I would never place it from that. I don't know the title, so I can't get the point, but... You were right. You can get the point for that. You don't have to have the exact title. You remembered the film. That's the point. You knew the film. It's okay. Weenie. 4-2. Here we go. No, I only have one. Street. Street. Yeah. 5-2. Great movie. Great movie. God, all I see is... How's that movie? I know. All I see is Benoad. I know. Now. Forever. Always Benoad. 5-1. I have one. No, you got two. I did. Oh, that's right. I got a back-to-back. You're right. Thank you very much. 5-2. 5-2. Oh, that is... Rossi? No. Highway. You're right. That is 6-2. It was not Rossi. 6-2. Oh, that's the one... Is this Sushant's last film? Yes, that's the one. It's the one about dying. Tara... It was a remake. Teremine or par or something like that. It was the remake. Yeah. Something like Teremine or par or something. I can't get the point because I don't know the title, but it's... Oh, we were wrong. That's from The Sky is Pink and that wasn't him. Anyway, great shot. That was a good still from that film. Would have never gotten that. 6-2, I believe, still. Oh, that's the burning one with Deepika. The girl who got thrown the acid on her face. Hold on. I think it starts with... I can see the poster. I think it starts with a G. This is... Golgall? Golgall? Those are just sounds, Rick. Golgall. Golgall? Yeah, something along those lines. But I got it. Again, why do we have to get the title specifically? We have to get it at least somewhat. But if you know the film by the still, that's the rules of the game. Know the film by the still. Chapa. That's right. We were both wrong. It's two syllables. 6-2. Oh, you're not going to give it to me? Nope. Fine. Loser. That's the one where he plays the guy. He's the main star and we saw that film. I know the title. I don't get it. It's English. No, it's not. Wait, is it English? It's small. Four letters. Like your mom. No, that's not four letters. What's the... It's his name. No. It's like his name. It's a... Anyway. Guru. I think that's right. It's Guru. You guys tell me that. I don't know. Because I feel like... Because if I can name something, like if I know it, but I cannot do the... If you could say everything about the film other than its title, for example. The first movie we saw of him where he's the starring in the role. It's a one-name thing. Start going on the plot line about him working in a company that he's trying to make successful and it doesn't work out. You think so? Yeah. So, Rithik and his friends go on a vacation and they're scuba diving and then they go into this place and he sees Kalki. And then that's the first time we saw him in Sira and Sean.  But I don't remember the name of the movie. I don't get it. Loser. Well, I don't like to give losers points. So... Very American. Fine. You can have it. Seven to three. That's the one with... We just saw it with Ali Abad. I'm going to give you a minute. Very... The title's really easy to remember. It's a two-word... I don't remember the title, but it also has... No, not Rasika. What's her name? From... Delhi Crime. Yeah. You are correct in the movie. I'm just... I know I know the title. I'm just trying to remember it. It came out last year. See, that's another reason that you should get it just from knowing about the film because I could have said all that information and then you just happened to remember well, you win. I gave you the title. I gave you the movie. Well, in game shows, that's how it is. You have to know the title. You can get it anyway. You can't just take... Oh, that... It's kind of like... Yeah, but this is not a game show. It is. It's a game. It's a game. Game? It's a game.  Those game shows have to do that because there's actual monetary value. I'm trying to remember the title, though. Yeah. It was Ali's first producing endeavor. It has an English word in it. Yeah. Okay. Whatever. You can have it. Seven to four. Darling's. Two syllables, not two words. Yeah. I wanted to die. I couldn't remember that. Seven to four. Oh, that's Creedie and that's Ayushman and that's... This is...  This is... What is the title? It's the rom-com we watched in romance month. I don't remember the title. Do I? Oh well. So I don't get it. Move on. Two seconds. That was more than two seconds. Yeah. Okay. There we go. Barfi. Barfi. Basically. Yeah. No, it's not Barfi. Barfi's different. Barfi's Barfi. Yeah. Barfi. Barfi. That's what I was talking about, though. Oh, that's... That's... Damn it. Hold on. Why am I forgetting all the goddamn titles now? Because I know these... These are great, great stills. Like, I know... It's... I didn't like it that much. Is this... This is the one with the taboo where they move. I'm forgetting all the titles now. I liked it more than you. I liked it more than you. It has the guy from... Yes. Whatever. Why am I forgetting all the titles today? It's an easy title to remember, too. We... This didn't have a carbonization or anything like that. No. It was an English title. Fuck. You remember? Well, I remembered the film. I mentioned it. Yeah. So... Namesake.  And all these have been English titles. I know. The namesake. Seven of four.  It's pissing me off that I can't remember these names. Oh, that's interesting. Because that could be a lot of things right there. I want to say that's the Vicky Koshel movie. Which one? Vicky Koshel, the one that we loved his acting in. Where he's playing the guy that burns the bodies. Mason? Yeah. Is that right? You think that's Vicky? It looks like Rithic, but that shot made me think of... Mason is what you're talking about. Yeah, although that really looks like Rithic. I don't know what it would be with Rithic. Exactly. That's why I think it's... Unless it's... It might... Luck by Chance? He wouldn't... He wasn't saying like this in Luck by Chance. I could be Farhan. I'm going to go with Luck by Chance. You want to go with Mason? Yeah. Wake up. That was Ran Beer sitting there? Yeah. Failure. Wow. That was a good shot. That was a great shot. That was a stumper. Oh. So does the Winning Street continue for... Yeah, no, he won. No, I definitely won. Yeah. This one pissed me off, though, because there's so many easy titles that I just can't remember the goddamn title of it. It pisses me off. Oh, well. Like Darlings or The Names. The Names. Easy names that I should know. Yeah, those are easy names we have in our head. But because it's the disconnect, so much of memory is linked to more than one thing contributing to the memory. So, therefore, if you're seeing something that is not familiar to you but you're trying to connect it to the thing that's familiar, you get brain freeze. Yeah, but then there are some other ones because I couldn't remember the title of Bargley, Key Barfee. Right. I can't remember the title of... Yeah, you need to know the title, though. Or else it's just... Except unless, like, the Debra. I can't pronounce the full name of Debra. No, of course. We've made it iconic. Or Stars. Yeah, you know what we're saying there. Gersnatch. But... Like if... We no longer call Bajira Mastani. Some pastrami mastanani. Yeah, pastrami mastanani. That's a classic. Anyways, thank you so much for making that game. Yes, more and more games. Please send us more. It doesn't have to be the slideshow. You can make it in video format. Anything. You can make it for any language and any kind of game. It doesn't have to be guess that many. Anything you can think of. It can be guess the audio, guess whatever you want to do. Once again, I just can't make them. So if you'd like to send us a game, please do send it to the email. Thank you for doing that. We really appreciate it because it's a lot of fun and I know a lot of people like it as well.  Juice!


What's up? Welcome back to the channel now today's video, I'm really going to be challenging you with how you think how you operate and a couple of things that I have been thinking about a lot because what I like to do is I like to look at the Successful coaches that we help that have come through our program And I like to kind of boil down. What are the things that they do that others aren't doing? Right What do they do? that maybe you're not doing and When I go through this, I don't want you to feel offended And if you do that's fine. You can just unsubscribe from from my channel.  But here's the deal When I look at across the board of coaches that we've helped that Have done very well, and I don't just talk about like financially, right? Yes, that's one of the pieces but when I look at you know, how happy are they with their business? Who are they training? What are they doing? Like are they living their mission and Then it's like have they reached their financial goals and are they on track to reach the financials? Those are the things I don't get it's not just about money. It was just about money, right? I know a lot of people have a lot of money who are miserable, right? Those people might not be happy Right, they're miserable. Why not happy? right So what are these things that these successful coaches are doing, right? so I have kind of a Very short list of things that are on my whiteboard here These are things that I see daily When I walk into the office These really helped me as far as getting more mental clarity with what I need to be doing during the day And how to better operate, right? And I wanted to share this with you because these are the things I have been teaching Coaches that are gone to our program that have done very well, right? And I'm going to just share a couple of these with you. So number one You need to take violent action Right. So for me, what does that mean? That means that when I have an idea I Figure out how to do I Don't ask myself should I do Right, I figure out how what are the steps? What's the manual how where where how? Okay, we got this boom We're working on boom. It's finished and a great example and and I I have this book here I'll show you in a second, but this is my favorite book for business, right? And it's called the perfect day formula now This is a great book, but it's not going to be a great book if you just read the first chapter Which is what a lot of coaches and personal trainers and business owners do is They start their business and they don't get stuck in They hesitate they wait they ask too many questions. They over analyze they are paralyzed by fear and They're not taking violent action for me like I know for a fact I'm not the smartest dude on the planet But I surround myself around people who are way smarter way more successful. That helps me a lot that has fast-tracked what I do Significantly, but the thing that that helps me is I take violent action ask yourself Do you take violent action? Like are you still talking about the idea of starting online business?  Why haven't you done it? So you're not executing you need to take violent action Another thing that that I have here that is very common with coaches that are very successful Is there it is? All right. It's embrace the marathon All right in 2020, right? I don't have the exact Number but I read this recently It was like if you go outside and you go drive and just throughout your normal day if you're watching TV or YouTube whatever I Think you see close to like 5,000 ads per day It's probably more than that now, right and a lot of these ads lure you in to distract you Right you get lured in you get distracted and then you don't go do the thing you say Right, and when you embrace the marathon you start to shut off These little distractions Right, and I've talked to a lot of younger Coaches that Have Been like, you know what I wanted I want to try to do this this this and this I've talked to a lot of older Coaches to guys in their 40s 50s 60s That want to do so many different things and They're not pointing it on the one thing Right because they don't want to do something for a long period of time that bores them That's something that that's not appealing Most people don't want to take 10 years to build a successful business That's just flat out and I tell anyone whoever joins my mastermind. Hey, you don't make a million dollars In 30 days like how a lot of these morons on on YouTube and Facebook and Instagram talk about Right that that doesn't happen. You have to work very very hard and there's no trick Right, there's no tricks. There's no gadgets. There's no button that I get depressed when I come in his office Where I press it and then me and Caldwell are sitting there laughing ha ha ha today We just made $25,000. We did not have to do anything. No doesn't life doesn't work that way business requires All right a successful business requires patience persistence and you need to embrace the maritime You need to know it's gonna take time, but you got to get stuck in you got to get stuck in if I'm not stuck In with this book.   It's probably the same percentage. How many people have a successful business? That probably lower right now another thing here and this is very important that I chose with you because You might be struggling with this right and it's be the best and let the results speak for themselves All right, how many people do you know?  It's like I just focused on putting out content I don't consume a lot of content But for me, it's like there's every time I've gotten online There's a lot of people who like to be the loudest in the room right, they like to Show off what they have versus who they hope right and This is this is an attention thing Right so many people at night.  Oh, I cannot wait until I check Instagram And when I check Instagram tomorrow, I'm gonna have a thousand likes. Oh I can't wait for that and they get high off this feeling right, you know, it's better than a Thousand likes on your next video or on your next post making ten thousand dollars that month Right zero likes How about that? Right So that's that's a question you ask yourself. Do you want to be popular or you want to like Make a difference in your finances Do you want to be this person that's really liked on social media? Like Guys, I'm telling you right now. I've talked to two coaches that have huge brands on social media and A lot of these guys Are not working with clients Hey Why would they be on the phone with me? Hey, if they were that big Why would they be on the phone with me? Right and fortunately? I've been able to help some of them some of them who realized wow, I could be doing a lot better Like I've been able to help them some of those guys. They want to be social media gurus Right.  I help their their digital footprint It is like a speck In the sand Right. It's a speck They don't they know it's not about them what they do though. And this is what I do as well We talk about our clients and we show their results And we are results based company The company is not based around me company your company is not based on you It's it's based around the success of the clients that you have that is different right that means that You don't care about yourself that means you care about your clients And you're only looking to get them results. I mean you do that you can build a machine and you're building a results Based machine That is the only thing that matters. So when you think about the things that I've talked about here All right, taking violent action. That means you execute. You're not thinking about should I it's how do I do? There's two different conversations. You can have it yourself All right, embrace the marathon.   All right one of two. It's I'm winning the ball right or I'm falling in Right and both of those options Have nothing to do with me being the one who is losing the ball or Me getting felt so I had an aggressive nature and you need to be like that All right with what you're doing with business. You're not getting sidetracked. You get stuck in To the battle all right and then we let the results speak for themselves and when you do that You're the best.  Don't need to do that right you need to focus in on your clients and a great example to think about One of my favorite mark marketing companies that I have studied Like like a hawk over the last decade is Beachbody All right, you don't know what that is go look it up They're there are the people who started P9 EX and insanity all these fitness related products and what they do better than most all right because everyone's copied them down is They show results they show transformations. You should be doing this with your clients. That's what gets attention That's what that's what puts dollars in your bank account All right likes and comments and feeling loved on Instagram. All right does not put dollars in the bank account Okay, promise you doesn't I know it doesn't I'm talking to people who have way bigger Followings than I do way bigger followings and they're struggling financially Right guys 50 to 500,000 followers. I've been talking to Why well it's about them. It's not about serving their clients It's not about showing results and I'm telling you the cold heart truth here and here's the thing if you were like Well, I want I really want people to like me. It's not about you. Your business is not about you My business is not about me. I'm here to help you Right. I'm here to help you. I am not here to be buds Her dogs with you now Here to help you I'm gonna tell you straight and That's why when you look at what you're doing if you're if you're having a problem executing With your business if you're having a problem making the changes Got to look at yourself in the mirror and think about the three things we said if you're not taking violent action Like and if you don't learn how to do that then the ideas are going to haunt you in your dreams All right. That's that's gonna happen. All right If you're not embracing the marathon, you're gonna have one foot in one foot out all the time and That's not gonna help you either because you'll get swallowed up By your competition by someone who's just more committed For someone who's more dedicated. They're going to be able to eat you alive right, and if you're this loony tune on social media and It's all about you Okay, you're going to quietly get eaten alive by someone like me that doesn't care about that I care about helping clients get results and this is why you will like I said this for so long on the channel When you do the opposite of what other people do you win? and You always hear people say that and and everyone at this point is like, oh everyone says yeah, but who to actually does it Who actually does it? Like talk to those people talk to someone like me. I do the opposite I went all all the coaches and trainers in my city were charging like $20 per session Right when at the beginning when I started my business, I was doing for free, right? Then I started charging $15 per session. All right. There was a there was a period where I Was doing private training is $800 month And I can tell you for a fact My software training program at that point was the most it was the biggest investment in the United States For a private one-on-one software training. I know that Right, so I did the opposite of everyone else did I wasn't working with Clients who weren't willing to invest top dollar. They weren't they they were going to pay pretty penny To train my in my program. Why it wasn't because it was expensive. It was because it was the best Got the best results. All right, let the results speak for themselves All right put hundreds of kids in it in the college that have gone scholarships those things have already happened All right, so this why you always had to do the opposite and you let the results speak for themselves so when you see this this is your brony online who's Yelling and get all this attention and they're in your city and they do the same thing you do do the opposite of them show More results. They're probably not giving results. They're probably just talking about themselves All right, that's it for today's video. I know if you commit to these three things. I'm talking about you're going to see a huge difference All right, the best way to get in touch with me You might help send me a text today at two one zero nine six zero five seven seven one When you do that, right? You're gonna get a response from me I don't have an automated messaging system that goes out. That is my number, right? And when you text me like treat me like a normal person, too Like don't just say here's what I can help with like tell me who you are tell me what area or what city or state here and then We'll have a normal conversation. All right, that's it guys I'll haul out you later. Have a great week And I hope you apply these these different lessons here. See you later


Hi, I'm Gail Gorman. Five and a half years ago I had bariatric surgery and I've lost a hundred and ninety-two pounds. And I'm her husband Ron, and I had surgery down in 2012, bariatric surgery, and I've lost a little over two hundred pounds, and I've managed to keep that up. I decided to have bariatric surgery when I started getting really, really heavy. My father died at fifty-two from a massive heart attack, and I was afraid that if I didn't do something drastic and permanent, I was going to follow in those shoes. And I weighed four hundred and twenty-six pounds. I was on four different blood pressure medicines. I had a very difficult time getting around, being athletic at all. And my doctor told me, he said, if you want to see sixty, if you want to see grandkids, you need to make some decisions. Bariatric surgery has changed my life drastically. When I weighed four hundred and twenty-six pounds, I was not healthy and couldn't do the things that I'm doing now. We own horses and we horseback ride, and now I have no trouble jumping up in the saddle and being able to do the things that I couldn't do then. We have done three half-marathons together. We've done many five K's. Getting down and playing on the floor with my granddaughter when she says, hey grandma, will you play tag with me? And being able to actually get up and run has just been fantastic. Having the surgery is the beginning step. It's a tool, but it takes a lot of commitment and a lot of time from you to go ahead and do the exercising and change the eating habits. And realizing that it's going to just make your life so much longer, so much richer. My advice to somebody that is thinking about it would be to get educated, go to some meetings and find out and then make some smart rational decisions about what you want to do. If somebody was considering and thinking about having the weight loss surgery, I would say do it sooner rather than later because you are missing out on some wonderful time of having the weight gone, having your body feel good, and just living life to the fullest that you should and deserve to have.


This is stock number 9C20B. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used car headquarters. Today we are taking a look at this super clean 2011 Kia Soul. From this HD video, you will be able to tell that this Kia Soul is extremely clean all the way around inside and out, considering the age and miles on it. Headlight lenses are nice and clear. Titanium Metallic is the color we shoot all of our videos in 1080p, so if you have HD capabilities on your computer tablet or smartphone device, turn them on right now because it is like you're right here looking at the vehicle with me and definitely your best way to check out the vehicle before seeing it in person. This one comes with the factory painted 18 inch alloy rims. In the front we have brand new Cooper CS5 Ultra 225 45R18 tires. These are brand new tires in the front. We put those on in our safety inspection. No denser dings on that fender. Headlight lenses nice and clear. Factory fog lights. I didn't see any dents. I didn't see any dings on the front hood there. Passengers side fender is in nice condition as well and the passenger side rim pretty nice condition. Not too bad. Down this side of the car, take note of how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down, you can still see the vehicle, hear the vehicle and have confidence in what you're looking at before you even get here so that when you do get here there's absolutely no surprises. Pretty clean down this side. Lower rockers look really good. Back rim pretty nice condition. Looks like it has brand new brakes back here and the back tires have about half the tread left on them. As we come around to the rear bumper pretty nice condition. No major dents or dings. Tailgate is in nice condition as well. And you got to unlock it to get in there. So we'll do that in just a second. But down this side of the car just as clean as that passenger side. And for full disclosures, back rims and okay condition, maybe a couple little scuffs on it. Down the rest of the side of the car very nice and clean power mirrors. Inside the Sport package gives you the black cloth interior. There are no rips. There are no tears. You get the red on the upper part of the seats and the red trim throughout. Power windows, power locks, power mirrors, sole factory floor mats with the red sole lettering. And you can see this vehicle has 106,836 miles. Steering wheel is in nice condition as well. No major scuffs or scrapes on that. Has audio controls on the left, cruise controls on the right and bluetooth controls on the bottom. Like the red accent throughout on this car. These front seats are heated.  You get an AUX and a USB jack down there. There are your heated seat buttons, automatic transmission, big speaker in the front, passenger seat is very clean as well. No rips or tears on that. The headliner is in nice condition. It does have a power sunroof and your map lights are right there. Has a compass display in the mirror and an auto dimming mirror as well. Looks like it has mood lighting, stability control, sport pedals and once again we have to unlock the vehicle to check everything out. Back seats just as clean as the front seats. No rips or tears back here. It does have the latch child safety system for your car seats. Really clean back here. Factory floor mats as well. These seats do fold down for extra storage. They go down really nice and flat. And we'll take a quick look at the back and then under the hood. So you do get quite a good amount of space back here. Looks like it does have the subwoofer as well. And you get more space underneath. So really nice. Really nice room back there considering how small these cars are. And we'll take a quick look under the hood. I would personally like to thank you for checking out the video today. Hopefully from this HD video you will have been able to tell just how clean this car is all the way around inside and out. And considering the age of miles I think it's in really nice condition. Two liter four cylinder motor 142 horsepower engine base. Very clean runs. Very smooth. This car has been fully safety to and inspected by our service shop has a fresh oil and filter change. All the fluids have been checked and topped off. The vehicle has been gone through mechanically 100 percent. Has brand new tires in the front, brand new brakes in the back and is 100 percent ready to go. To see more pictures of this car one of our other 450 new and used cars, trucks, SCVs, minivans, wranglers you name it we got it go to our website www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com and if you'd like to check out more HD videos you can go to youtube.com slash summit auto remember to like subscribe and share on this video and all the videos that you see there in fact in a second you will see a link to subscribe to our YouTube channel on your left a link to more used inventory videos like this one on your right if you have not been to our website on the bottom link to this vehicle on our website click those check us out and we really look forward to helping you with this super clean 2011 Kia Soul Sport thanks again


Welcome to the 16th session in the second module of the course Signals and Systems. We have been talking a lot of geometry in the last few sessions. So let us take the following example. We have a periodic signal x t, a square wave. I will show one period of the signal. The signal is 1 for the interval 0 to t by 2 and minus 1 for the interval t by 2 to t and this is one period and needless to say x t plus t is equal to x t for all t. So it is periodic with period capital T. Now we find out its decomposition at different frequency. So let us take first the 0 frequency component. The 0 frequency component is essentially the mean of x t over a period. Now you can see that mean is equal to 0 for this x t. That is because you can see that the function is symmetric about its middle as positive on one side of the middle of the period as it is negative on the other side. So the area under the function in one period is 0 and therefore there is no so-called dc component. There is no constant component. Now let us take the kth component. So the kth angular frequency that we need to consider is 2 pi by t times k and we shall evaluate the two components at this frequency. The first component is of course x t dot product with cos 2 pi by t k t multiplied by 1 by t cos 2 pi by t plus the inner product of x t with sin 2 pi by t k t and then again multiplied by 1 by t sin 2 pi by t. Now let us visualize how we are going to calculate each of these dot products and show them to you in two different colours. I will show this dot product to you first in red. Take one period, dot product over a period, do not forget. This is x and I draw cos. How does cos 2 pi by t k t look? So it is going to complete k cycle, k cycle over a period of so between 0 and t by 2 it is going to complete k half cycle and between t by 2 and t it is again going to complete k half cycle. How would this be? Take for example k equal to 1. So it would look like this. You see cosine begins like this, goes there and then rises up. This is k equal. Let me draw k equal to 2 as well but in dotted. So it is completed 2 cycles as you see over the entire period of t. Now you see you can carry this one. You can look at k equal to 1. You can look at k equal to 2. I have already drawn them for you. You can look at k equal to 3 and in each case you will see that whatever area is contributed on the positive side is annulled by the negative side. Let us look at these 2 cases to convince ourselves. So let us look at the k equal to 1. This part is integrated out to get a total of 0 air because whatever positive area is contributed from this portion is annulled by the negative area contributed by this and similarly whatever positive area is contributed by this portion is annulled by the negative area contributed by this portion. Therefore for k equal to 1 the dot product will be 0. The same thing holds for k equal to 2. You can see that. Whatever positive area is contributed by this portion is annulled by the area contributed by this and so too by this. Now you can visualize this. You see I have shown you the situation for k equal to 1 and k equal to 2. I encourage you to do it for arbitrary k. So what I am saying is the dot product with cos 2 pi by TkT falls to 0. So whatever positive integer k you take let us record that. So what you are saying is this dot product or this Ena product equal to 0 for all positive k. So we should now only focus on the second term and let us do that. Let us focus only on the second term. Let us therefore calculate the dot product. In fact you know that is also easy to do. I will show it to you graphically. I have xT here. I will show you for k equal to 1. You have sin 2 pi by TkT. I will show that in green. So sin 2 pi by TkT has an appearance like this. You can see that this dot product is definitely non-zero. And in fact this Ena product can be seen to be two times what you get on each half cycle. So this is from 0 to T by 2 and this is from T by 2 to T. Whatever you would get between 0 and T by 2 would be the same as what you get between T by 2 and T because positive multiplies positive here and negative multiplies negative on this. So 2 times the integral from 0 to T by 2 xT sin 2 pi by T times T. You are talking about k equal to 1. And of course xT is equal to 1 for that integral. So what do we have here? Very simple. We have 2 times 0 to T by 2 sin 2 pi by T T dt and that is minus evaluated. So minus 2 cos 2 pi by T small t divided by 2 pi by T evaluated from 0 to T by 2. That is minus 2 by 2 pi by T of course cos 2 pi by T times T by 2 minus cos of 0 and that gives us minus T by pi times minus that is easy to evaluate and therefore that is minus 2T by pi. So this is the component for k equal to 1. Now let me draw for k equal to 3 and you will see the pattern. So let me first show you the sketch. With k equal to 3 you are going to have 3 full cycles. So of course you know you had one half cycle and of course another half cycle and you see now in the other case you had just one. Now here you need to have 3. Well let me instead draw for k equal to 2. That might be easier to understand. So here for k equal to 2 I need to have 2 full cycles. How will 2 full cycles look like? You are going to have one cycle completed between 0 and T by 2 and one more full cycle completed between T by 2 and 2 full cycles and you can see that the inner product is going to be 0. Why is this true? Because whatever you can see that in each individual half cycle an entire cycle of the sinusoid has been integrated out. In fact you can see this will happen for all even values of T. You are going to have a 0 integral because each half cycle is going to integrate out full cycles, complete cycle. You know for example for k equal to 4 you would integrate out 2 cycles in the first half interval and 2 cycles in the second half. For k equal to 2 you are integrating out one cycle in the first half interval and one cycle in the second. And similarly you can go on constructing this. So for all k equal to even you are going to have a 0 component. That is very interesting. There are no cosine components. There are no even components. So what is left is only the odd components k equal to 3, k equal to 5, k equal to 7 and so on. And of course you can see that there always going to be a symmetry. For k equal to 3 for example you can construct the first half cycle, look at the inner product. If you focus on that first half cycle and you will see it is the same as contributed by the second half cycle. But what we will do is first to avoid any confusion we will just write down the inner product as it is. So I will write that down for you. So for k odd we have inner product is 0 to t by 2 integrated 1 multiplied by sin 2 pi by t kt dt plus integral from t by 2 to t minus 1 into sin 2 pi by t kt dt. And let us evaluate each of these terms separately. Now I leave it to you to show that this term and this term are equal, exercise. Show these are equal, this one and this one. And therefore I am just going to evaluate any one of them. Let us evaluate 0 to t by 2 sin 2 pi by t kt dt and multiplied by 2. And I leave it to you to work this out. It is essentially going to be 1 by k times the answer for k equal to 1. So we had this answer for k equal to 1, 2t by pi for k equal to 1. We will just divide it by 2. This is now 2t by pi into 1 by k. I leave it to you to verify this. And all in all what we have is xt is therefore summation k going from 1 to infinity 2t by pi 2k minus 1 sin, this is the complete expansion. I leave it to you as an exercise to verify this. So I worked out one example. I suggest you work out a few more. We will discuss a few more examples, just presenting them as exercises to you, but you must work them out on your own. Thank you.


Today we're going to finish on password entropy and spend our time on storing passwords. Password entropy is a formal way to look at the strength of a password or a password selection scheme. So we use entropy. Entropy is a general term to measure the content of information. How much information is in a particular message. We can use it as a measure of how strong a password or a password selection scheme is. We finished last week with looking at, okay, if we have a selection of 10 digits, 0 through to 9, how many bits do we need to represent one of those 10 possible values? Well, 3.32 bits and that is the log base 2 of 10 is 3.32. If we have the lowercase English letters, there are 26 possible values. So if you think in terms of how many bits are needed to represent 26 possible values, 4.7 bits. So this is our simple interpretation of entropy of passwords. The number of bits needed to represent a string. In this case, if it's a single letter, 4.7 bits. Most keyboards support about 94 printable characters. So ASCII characters, just in English that is. Uppercase, lowercase, digits and some punctuation characters. So if we have one character, there are 94 possible values. We need 6.55 bits to represent that in binary. Then we can use that to work out a measure of a particular password. For example, if you choose a password randomly, a randomly chosen password just of numbers, of digits, then each digit could be stored in 3.32 bits. So if your password length was 20 digits, 20 numbers, 20 times 3.32 is about 64 bits. So this is just one example saying, if you choose a 64 bit random value, it's about the same as 20 random digits, or 14 English lowercase characters, or 10 printable characters, 10 of those 94 characters. Because they all have an entropy of 64 or close to 64 if you do the calculations. So we can say a password of 20 digits is about the same strength as a password of 14 English lowercase characters. So we can use entropy to measure and compare. Of course, assuming they're randomly chosen. So not everyone chooses random passwords, but if they were randomly chosen, they're the same strength. And the strength is in terms of how much effort would it take for a password to be forced to try them all in order to guess it. If we have a 64 bit value, it takes 2 to the power of 64 operations in the worst case. If we have a 20 digit password, it takes about 2 to the power of 64 operations. If we have a 14 character English password, it takes about 2 to the power of 64 operations to get that password, a brute force attack. If we have 10 printable characters, about 2 to the power of 64 attempts. Because there are 2 to the power of 64 possible passwords if we have 10 printable characters, approximately. It's actually 65, I think. So we finished on that last week. Anyone have questions how to calculate entropy of a particular password scheme? If you want to remember a formula, look at, well, how many possible passwords there are, the entropy is log base 2 of that number. If there are 10,000 possible passwords, the entropy of that password or password selection scheme is log base 2 of 10,000. That's all. Unfortunately, we don't choose random passwords. Humans choose some structured passwords. It would be nice to be able to compare the strength of passwords chosen by people to say, okay, this type of password is stronger or better than this. It's hard to estimate or calculate the entropy in cases where you don't choose random passwords. But different people have done studies. And one of them, it's quite old, but it's a nice example. Some standards institute called NIST come up with the following data. Let's see how we interpret it. So there are some studies. If you want to see the details of the studies that's available online, it's getting a bit old now. But the way to interpret this is that in the right two columns are the randomly chosen passwords. So take an example. If the user can choose of 94 possible characters, uppercase, lowercase English, digits, punctuation characters, the way to read this table is if the user chooses a password of length 10 characters, then the entropy of that password is about 65.9. So 94 possible characters, if you choose 10 characters long, then 65.9 is the entropy of that password. That's for a randomly chosen password. Let's just confirm that. If we have 94, so the number of passwords possible, if we choose randomly 10 characters, 10 letters, from a set of 94 each time, then they're 10 to the power of 94 possible passwords. If we chose eight characters, what have I done wrong? Upside down, 94 to the power of 10. Sorry. If you choose one letter from 94 possible values, there are 94 possible passwords. If we choose 10 letters, there's 94 to the power of 10 possible passwords. The entropy of such a password selection is log base 2 of 94 to the power of 10, which is, I don't have my calculator, but I've calculated before, it was about 2 to the power of 65.9. Sorry. I better slow down. It's 65.9. You can check with your calculator. 94 to the power of 10 possible passwords, therefore we say the entropy is log base 2 of that, which is 65.9. If you have 11 character long password, then it's 94 to the power of 11, and the entropy is log base 2 of 94 to the power of 11. Where does 65.9... Where did I pull that from? Here. If we have 12 characters long password, entropy is 79. So that's just how to read this table. Going backwards from the right column. If you chose a random password using just a set of 10 characters instead of 94, for example, you chose numbers, maybe for your ATM, for to withdraw money from your bank, you must choose numbers. If you choose a pin that is four digits long, then if it's chosen randomly, the entropy is 13.3. So this column here is for 10 character alphabet randomly chosen. 13.3. 10 to the power of 4, log base 2 of 10 to the power of 4 is 13.3. So that's random chose passwords. The study done by NIST looked at what if people don't choose random passwords, but choose passwords based on information they know based on some structure. For example, if you choose the first letter in your password to be the letter T, then it's very unlikely that the next letter is going to be Q, because there are very few words in the English language that are T followed by Q. So they did studies, looked at, okay, given one letter, what's the probability of the next letter being a particular value? And they come up with these results and the columns, these four columns. A user chose a password based on some studies. If they chose from the 94 character alphabet, the printable characters on your keyboard, and if the user got to choose a password with no restrictions, then they come up with these approximate values for the entropy. If the user chose a 10 character long password, the entropy they calculated is about 21. Note, if the user chose a 10 character long password randomly, the entropy is about 65.9. There's a big difference in the entropy. That is, there's a big difference in the strength in that the higher the entropy, the stronger the password. If the user chooses passwords, it's much more likely that they'll choose passwords which follow some structure. They don't choose random passwords, and therefore there's much fewer passwords than an attacker would need to guess to find that password. So much weaker in terms of strength. So the lower entropy is a weaker password. Skipping the next two columns, if the user chose just numbers. So instead of getting a random pin for your ATM card, you choose a value. Then their study showed if you chose a four-digit value, the entropy is about 9. If you chose a 10-digit value, the entropy is about 15. Compared to randomly chosen or randomly generated, a 10-digit value, 10 numbers, random is about 33. Users choose much weaker passwords than random passwords. And I think we know that from... you think of your password compared to a random value, yours would have some structure. The last two columns, or the two columns we skipped over, are if the user was forced to choose a password following some rules. And I'd never remember the exact definition, but this dictionary rule was that they can choose a password, but it can't be a word in a dictionary. If they did, they have to try again. That makes it stronger, because they'd have to choose some different combination of letters. So a 10-character long password, the user gets to choose, but they cannot choose a word in a dictionary, gives an entropy of about 26. Better than if they get to choose any value, which gives an entropy of about 21. Because this approach requires them not to choose dictionary words. The dictionary and comp rule, what was that? I think they did some extra comparisons to some known structured words, and restricted even further. I cannot remember the detailed restrictions, but they say these things... these types of passwords are not allowed. Some rules to say they're not allowed. And that raises the entropy even further. This is all choosing a password 10 characters long from a 94-character alphabet, ranges from an entropy of 21 up to 32. If you chose randomly, the entropy is about 66. Much, much, much better. First it shows that user-chosen passwords are not strong compared to random-chosen passwords, and it gives a measure of that. And again, it's based upon some studies of how people choose passwords and how words are structured. Another way you can interpret this is if you want a password, which is equivalent to a random value, a random binary value of, say, 64 bits, then choose one that produces an entropy of 64. And you see a 40-character password, in this case, gives us an entropy of 56. So we need to be larger than 40 to get the entropy of 64. So if you got to choose your own password, to choose a password which is equivalent in strength to 64 random bits from this study, you need more than 40 characters in your password. So showing that to get strong passwords, that users choose, they need to be very long. Too long to be convenient. No one has 40-character passwords.  Maybe the main conclusion here, if you look at the typical length of passwords that people choose in the order of 6 to 10, maybe 12 characters, the entropy, when people choose them, reaches about 30, 34. An entropy of 34 means there's about 16 billion possible passwords. And a computer to try 16 billion possible values doesn't take long. That is, to stop an attacker trying to guess a password if it can use on a computer at any speed, then typical passwords chosen by users are not strong enough. Computers can guess them. Any questions on entropy to finish this topic, this part? How do you calculate entropy? Easy, log-based, two-of-what? The number of possible passwords. So if I say in the exam, here's a password scheme, a simple one. You must choose a password, a password is generated, a random password is generated, which is five characters chosen from uppercase or lowercase English. Five characters long, always. Uppercase, lowercase, you think, okay, five characters, uppercase, lowercase, gives us 52 possible characters. So we have 52 to the power of five possible passwords with 52 possible characters. Five characters in length, 52 to the power of five possible passwords. Therefore, the entropy of such a scheme is log-based two of 52 to the power of five. And you need your calculator for that one. So understand where entropy is used, that you can use it to compare password schemes, and understand how this table is interpreted. It gives some experimental data based on how people choose passwords about their entropy. One conclusion that we often can arrive at from this is that in most cases, people don't choose passwords which are strong enough to prevent a brute-force attack. If you choose a 10-character password with no checks, entropy of 21, meaning there are about two to the power of 21 possible values, which is two billion possible values. If a computer gets to check at one million per second, it takes 2,000 seconds to find your password, which isn't long for most cases. When we finish this topic and this course, we'll return to a few slides we missed at the start and then towards the end. The last main thing to cover is how do you store passwords? Why do we store passwords? Well, most systems need to store the password because what happens is that think of a website. You create a website and you allow users to log into your website. So what does a user first do? Before they can log in, they must do what? Sorry? Yeah, but which username and password do they enter? They must register first. So let's call this step. Before you can log in, you must register a username and password on that website. You choose a new account on Google. You must register first. Maybe select your name, your username, a password. So this registration procedure creates your username and password and then the system stores that, let's say in a database, whether it's a file or an actual SQL database, it doesn't matter, but in some data store. Then when later you want to first log in, you submit your username and password and the system compares your submitted value with the stored value. If they match, you're logged in. If they don't match, you have to try again and it takes some action to block you. So we must store the password in the system. So the users register and that information about the ID, your username, ID on the slides, and the password, or we'll see something related to the password, and maybe some other information like your first name, full name and so on. But the core information is the ID or username and password that must be stored in a file or database. So that later when you log in, you want to access the system, you submit your ID and password and the system compares your submitted values against the stored values. If they match, you're okay, you're logged in. Any questions about that? Maybe some of you have implemented on websites already. Well, you will in the future. Not just websites. When you log in to Moodle, when you log in to ICT server, when you log in to the SIT internet access system, same approach. You register a username and password, then you log in and the system compares the registered versus the submitted values. So what we want to look at is when the system stores your registered values, in particular when it stores your password, how should the system store it? That's what we're focusing on. We'll look at several options and arrive at the final solution after looking at the drawbacks of some of the earlier options. The first obvious option, how do you store the password? Store it in the clear. Store the username or ID and the password of the user in some database. And for each user that's registered, just increase add another row to your database. Let's see if I have an example. So first option. And who has the handouts with them? Let me just check the handouts and see what I provided you with. Towards the end of your printed handouts, at the end of the password slides, there's a printout of a document on passwords, hashes and rainbow tables. And some of the examples that I'll show are from that. So you have it in your printed handouts.  Bring it up so you can see. That's one of them that you have in the printed handout. Here's an example. So you've created a website, for example, and users register. And as part of that website, you have a database that stores registered usernames and passwords. So the database we can think of is some table where we have two columns, one column containing the ID or username, and the other column containing the password that the user chose, the registered password. So there's the first approach. What's wrong with it? If you store this in your database on your website, what can go wrong? So you've created your new website. Users, many of your friends and many people are registering. Thousands of people are registering. They're adding rows. Your website stores a database, adds rows to this table. What's wrong with this approach? What can go wrong? Okay, first thing, whoever has access to this database, maybe you and a few of your friends are creating the website. Whoever has access to that database can go in and see all the passwords of all the users. Well, is that a big problem? It's hard to stop that anyway. Yes, that's a problem to some extent in that, okay, let's say the three of you have created your own username and password, your developers, you can see the other person's password. Okay, so if you store the passwords in the clear, it's very easy for someone who has access to the database to go and see other people's passwords. But it's in fact hard to stop the developers from accessing the passwords. So if you create the website, it's very hard to stop you, the creator of the website, from being able to see the users, those that register a password. Okay, so that's something that's very hard to avoid. Another problem with this approach is that let's say you create your database, you have your website, it becomes popular, and then there's someone out on the internet that tries to break into your website through other means, some form of security attack on your website, and it turns out that you got a low grade in CSS322, and you didn't develop your website very well, and it turns out that some attacker can access your database. And if an attacker could access your database, so someone from outside could access it through some other security attack, then that attacker has now learnt the password of every user. That's a problem, and that's a real problem. So as the developer of the website, you don't want to have to assume that no one can get access to this database. Preferably no one else can access this database, but what if there's some other flaw in your website such that someone could get access to the database? If so, let's say your database was for Facebook. You have the tens of millions of users and their passwords stored in some database. If an attacker could get access to that database, they've now learnt the password of tens of millions of people, and that's a big security problem. So that's the main problem of storing the password in the clear. You can't store it in a form that people can easily access it. So from now on, we'll assume that there's some malicious user on the internet who can read your database. Even if you didn't intend them to, that somehow they've got other means to read the database. So if a malicious user can read the database, how are you going to store the password? Encrypt is the first obvious solution. You know if you want to have some data, and if someone can access that data, the way to protect that data so no one can read the contents is to encrypt that data. So let's go back to our slides. Make sure I may have a... Let's continue with this example to see what happens if we encrypted the password. So instead of storing the password, we stored some encrypted value, and I'll just write some random characters here. Some unstructured values. So this would be encrypt the password. And the second password would be some other random ciphertext, whatever the values are after we encrypt, and so on. So instead of storing the password, store the encrypted form of the password with the idea that if someone can now access this database using some other attack, they can see the usernames. They cannot directly see the password because it's not stored. They can see the ciphertext. So then we need to try and stop the attacker from being able to get from the ciphertext back to the original password. Now before we see what the attacker can do, when I encrypted the password, what did I use? What key? What key should we encrypt the passwords with? We must use some key. Anyone want to... different options? How should you encrypt the password? Whose private key? My private key. But everyone has my public key so everyone can decrypt, including the attacker. Don't encrypt with my private key. That doesn't provide confidentiality. What else could you try? Sorry? Encrypt with... What do you mean by an ID? An username. Let's say we encrypt and use the pass... The key to encrypt this string use the username. Okay. So the key is the username. But now if the attacker obtains this database, they can easily decrypt because the attacker has the ciphertext. They know that you used the username so they can quickly decrypt and they get the original password back. So the idea is that we want to make it hard for the attacker, if they get access to this database, to find the passwords of users. So no, don't encrypt with the username. What can we encrypt using? What key? What type of key? Sorry? Encrypt with the password. Okay. So I take the string MySecret as the plaintext and as a key I use the same string, MySecret. Okay. Now, fine. When... When you want to check when someone logs in. Okay. Now, John logs in. He submits his username and password. The system must check the submitted values against the stored values. How do we decrypt this ciphertext to get the stored value? Use the password that he entered. What if it was wrong? Okay. So if we encrypt the password and use that same password for the key, we get ciphertext and we can decrypt using the submitted password. Any problems? Who cannot retrieve? The entity that stored the password. If we store the ciphertext, how do we get the original plaintext back? Yeah. The idea is that if we... Let's write it down. We encrypt where the key is the password and the plaintext is the same value. We get some ciphertext and we store that ciphertext. So the value of C is stored in the database. And then someone logs in. John tries to log in and they submit their username and their password. So the system decrypts and what do they get as the output? The original plaintext. So there's the idea. Encrypt the password using the key which is the same. When the user submits the username and password to log in, the system needs to check. And the check is take the submitted value and use that to decrypt the ciphertext. It was encrypted with key, mic, secret, a shared secret key. Decrypt using the same value and you should get the original plaintext as output. Does it work? Does it decrypt successfully? I think it would decrypt successfully there. What if the user submitted the wrong password? They typed in the wrong value here. They typed in ABC. Then we decrypt the ciphertext using key ABC. What do we get as output? Some random text. So we can recognize that that's wrong in that case. Any problems? Yep. You're too advanced asking about MD5. I haven't got there yet. We'll cover MD5 in a moment. You're correct. Any problems? No. Assuming the algorithm is strong, then if you use the two different keys, you should get two different plaintexts. So assuming that's the case, that's okay. We'd have a problem if people used the same password. That would be a problem. It's likely that multiple users used the same password. That is, John and Daniel both used the same password. They don't know it, but they do. What would the problem of that be? It would be that the same value would be stored in the database. An attacker may be able to take advantage of that. The fact that two values are the same. Then if John saw the database and saw Daniel had the same ciphertext as he did, then he knows that Daniel has the same key and the same password as he does. So there's a small problem. What's a general problem with encryption and decryption? One is that in terms of performance, it's slow. The other problem, the key here. So in practice, we shouldn't use a short key to encrypt because if you're using, say, AES, your key needs to be 128 bits. So here the key is only the password length. So in terms of brute force attack, a brute force attack from an attacker, if they have this database, what do they do? Try all the keys. That is, try all the possible passwords. And generally that can be done quite quickly because the number of passwords is quite small in this case. If you have a password of, in this case, eight characters, we'll see the numbers shortly. You may consider what else may go wrong with this scheme. There are some performance issues. There's these issues if you have the same password. There's the issue of a brute force attack. It is possible if an attacker has this ciphertext finding the password is not too hard because the password is the key in this case. But someone asked, well, what about using MD5? What about using a hash function? So let's look at an alternative approach. Another way to do encryption, and I will not try and draw it, is to encrypt all of the passwords using some secret key that the server has. So instead of encrypting using the password, and it's an approach that works in some cases, encrypt the password using some long secret key. Again, that works until we need to store that secret key somewhere. And if we store that secret key, say, on our server and the attacker can access the database and the secret key, then they can decrypt and get all the passwords. So encrypting, if we use a long key, it needs to be stored somewhere and the attacker may be able to discover that value and therefore decrypt them all. If we encrypt with the password itself, then a brute force attack is very easy in that case because the passwords are quite short. Let's try another approach. If we encrypt the passwords with some secret key k, then we must keep that secret key secret, which is hard when we want to store it on the server to be able to decrypt all the time. Someone suggested using hash functions and that's generally the way to go and we'll see how they can be used. That's the page we want. Here's an extension of our previous storage. Instead of encrypting or storing in plain text, take a hash of the password. Store the hash value. Hash functions. What are two known hash functions? You said one before? MD5 and SHA. There are others. They're not the only ones, but they're the ones you may have heard of. So when the user registers their password, the system stores the username and takes a hash of the password and stores the hash value. Let's see what happens when a user tries to log in. A user logs in. So this is the database on the server. So let's say the client and there's a server. The login involves the user, the client submitting their username and password, sending it to the server. So John tries to log in. He submits his username and password to the server. This should be encrypted using encrypted communications. They submit it to the server. So this is the, let's call it, the submitted values of the username and password. The server looks up in the database. Now it takes the submitted value, John finds the row in the database where the username is John, takes the submitted password, MySecret, takes the hash of that submitted value and compares the hash of the submitted value against the hash value stored in the database. And you know based on our properties of hash functions that they should be the same. If we take the hash value of the two same values as input, we'll get the same hash value as output. So the hash of MySecret matches this 0, 6, C, 2, so on. Where this value was obtained originally when the user chose their password of MySecret. So compare the hash of the submitted value with the stored hash value. If they match and they will in this example, so the hash of MySecret equals that long value, then success, log in. If they don't match in another case, maybe that's an E, doesn't matter what it is. Maybe they make a typo when they type it in. They don't enter the right password. The server takes the hash of the submitted value and compares against the stored value and we'll see that they don't match in this case. And therefore fail the login. Why don't they match? Again coming back to our properties of hash functions. The hash of two different inputs should produce two different outputs. That was one of our assumptions. When we hash the original MySecret, we get one value. When we hash something different, even if it's different by a little bit, we'll get a different hash value. So when we compare the hash of this submitted password versus the stored hash value, they will not be the same and the login fails. And that works. If our hash functions are appropriate, we have this property, then it works. Any questions on how it works at the moment? What if the hash is not good enough? Good question. What if the hash function is such that the hash of one value produces the same hash value as some other value? That is that we have these collisions. Then yes, we can have problems, but still it's very hard for the attacker to find out which password to try to produce the correct hash value. They still need to make many attempts to do that. So yes, we should have a good hash function, but if we return to those properties, really, what do we have? One-way property, weak collision resistance and strong collision resistance is the one-way property and weak collision resistance that are needed in this hash function. Strong collision resistance is not usually an issue. So yes, we need a good hash function. What else can go wrong? What does an attacker do if they access the database? They know the hash function, okay? It's public. Let's say we know as the attacker the hash function used. What does the attacker do? Sorry? Yep. Okay, let's go back. One thing that hasn't helped here, remember John and Daniel had the same password originally. They didn't know that, but they just chose the same password. Still, the hash value stored in the password database is the same. What's the problem with that? It means if John can read this database, then he's immediately learnt Daniel's password. Okay, because John knows his password is my secret. He realises Daniel's got the same hash value as me. Therefore, Daniel's password must be my secret as well. So that's the first problem, but it's only a minor problem in most cases, okay? Although it may be possible for users to access this database and multiple users to get the same password, it's unlikely both happen. It's unlikely that John is the malicious user that gets access to this database. So it's a minor problem. Let's consider an example and add some numbers to see what an attacker would need to do. Let's say the hash function is MD5, which produces 128-bit hash value. And it is in this example that it's 128 bits in hexadecimal, isn't it? Remember the one-way property, which says it should be easy to calculate the hash of the password, but given the hash value, it should be hard to go back to the original input. That was our desired property of the hash function. And generally, to defeat the one-way property, the number of attempts needed is 2 to the power of the number of bits in the hash value. That is, if an attacker has this database of hash values, to take one hash value and go backwards and find the original password in a brute force attack on the one-way property takes about 2 to the power of 128 attempts. And it quite simply involves trying random inputs and eventually you get a collision, the correct value. Let's put some numbers to how long it takes. And I did some looking up on the websites about how fast we can calculate these hash values. Let's say we can do it at a speed of 10 to the power of 10 attempts, or generally, hashes, per second. That is, an attacker knows the hash values, they've got a computer, they download this database, they have a computer that can make 10 to the power of 10 attempts per second. Or calculate 10 to the power of 10 hashes per second. And that's about typical speeds of some advanced hardware that is available today, not very expensive. So in the one-way property, they may need to make 2 to the power of 128 attempts. How many seconds? Well, 2 to the power of 128 divided by 10 to the power of 10. I'll say the time to defeat the one-way property is 2 to the 128. That's how many attempts, divided by 10 to the power of 10. Anyone have a calculator? 2 to the power of 128 divided by 10 to the power of 10 seconds. And we'll convert that into minutes, hours, days, years. So the answer here will be years. 10 to the power of 21 years. It's not possible. So when we have 2 to the power of 128 attempts, even at this speed, if we tripled the speed, if we increased by a factor of 1,000, still it's going to be many universe lifetimes. So not possible. That's a raw brute force attack defeating the one-way property. But there's an easier attack. Suggestions? You have downloaded this database. You have the hash values. If you want to find the corresponding passwords for those hash values, what do you do? Don't try and break the hash function. We just tried to break it with the one-way property. It won't work. It turns out strong collision resistance doesn't help in this case. What can I give you? Let's make it easy. The passwords that everyone chose are all 8 characters long. Generate the hashes for lots of passwords, for common passwords to start with. Let's say we have a dictionary of words, 8 characters long, or combinations of common words. Take the hash of them and compare those hash values against the stored values. So take the hash of known words and then compare those calculated hashes against these if any of them match, we've found the password. In fact, we can extend that. If the character set is the printable characters, reasonable to assume, 94 different characters, 8 characters long, a brute force attack here would try all possible passwords. Let's see how long that would take. So a different attack. Let's draw it again. A different attack. This is a brute force on the passwords. But we need to make some assumptions. Let's assume that a password is 8 characters. When the user chose a password, they were restricted to having exactly 8 characters. And the character set has 94 characters. That is the printable characters on the keyboard. How many possible passwords? How many passwords do we have? That's correct. So the attacker knows that there are only 94 to the power of 8 possible passwords. All passwords are no longer than 8 characters and they are from the character set of uppercase, lowercase, English, digits and the 32 punctuation characters. So what the attacker does is just takes all possible passwords and calculates the hash of those passwords and then compares them against the known hash values. The time to do this for all passwords, so the worst case, the number of possible passwords to try, divided by our rate or speed, same as before, is approximately... Any guesses? Anyone calculate the answer? I think I've done it before. Let's do it on our calculator. That's the number of seconds, minutes, hours, days. Okay, so about 7 days it takes. Is that okay from the attacker's perspective? Well, yeah, in some cases that's fine. I can wait a week if I can get passwords for important people. They're going to return something to me from an attacker's perspective. I would like it to be faster, but 7 days is practical in some cases. That is, have a computer that takes this database and just leave that computer processing through, calculating the hashes of all 94 to the power of 8 possible passwords and you generate all the hashes and then just do a comparison where comparisons don't take much time. Let's compare the passwords, the calculated hash values against the known hash values and you'll find the password for all of those users. How can you make it faster? Any questions so far on how to get that attack? 7 days is simply the number of passwords divided by the speed at which I try to break them. How are you going to make it faster? I'm impatient. What if I had a slower computer? I couldn't afford a fast computer. Fast computer, this one cost me, I don't know, $60,000. I don't want to spend that. Any ways to make it faster? Okay, it's most likely that users, if they got to choose passwords, had common words. So it makes sense to try them first. But this system generated random passwords for users. Alright, didn't, but let's say it did. Then any other way to make it faster, apart from changing the computer speed, well, maybe get someone else to do it for you. Or, more precisely, someone does this once and then they save the results in a large database and then the next person who wants to break a password which is 8 characters long just reuses the database. They don't have to recalculate all the hashes. That is, the person, the attacker who just calculated across seven days, they create their own database containing password and hash value. And in there, they store for every password, I'll say P1, the calculated hash value, H1, the second password, the corresponding hash value. That is, the first time we do this, we take seven days and we generate for all possible passwords all possible hash values. And while generating them, store them in a database. Let's see how that helps. And we keep storing them. How many passwords goes up to P to the 94 to the power of 8? That's an 8. Draw it again. And all the hash values. So this is what the attacker does. They generate this database. Now, someone else later wants to do the same attack. They have their own database that they've got from some web server of hash values. They don't need to go through seven days to find all these values. They just reuse this table. And given their hash values, they just look up in this column, find the match, and they've found the password. This lookup procedure will be much faster than calculating hashes. Searching for a value in a database is much, much faster than calculating the hash of a password. Hash functions are generally slow compared to lookups and so on. So the idea is that because hash functions are slow, calculate the hash just once as the attacker, and then reuse this database. Because this database stores the hash values for every 8-character password. So any other website that needs a hash value for an 8-character password, we just look up in this database. How do I get this database? I'm the attacker. I've spent seven days generating this database. Maybe there's more than 8 characters. Maybe it takes longer. I generate the database.  You have some hash values. You want to find the password. What are you going to do? Ask me for my database. Of course you. I'll give you my database for a cost. And that's what happens in practice. Someone generates these hash values, stores them in a large database, and then sells them to other people who wants to use them. Because once you have this database, to look up a hash value is very, very fast. To calculate it may take seven days, but the lookup may take a matter of minutes, maybe hours worst case. You can find websites that will sell you such databases. Just the hash values with different hash algorithms of many different passwords. And that makes the finding of the password much, much easier for an attacker. Understand the concept so far? Questions? Okay. Ready for an exam question about passwords? What, next week? Yes. Take the same hash function in our example md5. So I took the first eight character password. You know. A, A, A, A. Eight A's in a row. Calculate the hash with md5. I store the hash value here, whatever it is. Take A, A, A, A, B. Take the md5 hash. Store it here. Just do it for all possible passwords. Store all hash values. Now, it comes to me and they say I have a hash value such as 5 fc2 bb and so on. What's the password? Then all we need to do is just search through this column looking for the hash value. Once we've found it, we've found the password. Which is very fast compared to calculating hash values. How big is the database? Let's say no compression. Just the raw data. How big is it? Well, look. There's a table. How many rows are there? The number of rows. The number of possible passwords. In this case, 94 to the power of 8. Two columns. How big is the first column? We said it was an 8 character password so let's say it's 8 bytes. To store it, we need 8 bytes. How big is the hash? This md5 produces 128 bit hash value which is 16 bytes. So in fact we have 24 bytes in every row. And how many rows? 94 to the power of 8. How many bytes is that? I've calculated before about what? We have a problem. For the attacker to do this in this very naive approach to store all of these values they need a set of disks to store 146,000 terabytes. Who has that? Well maybe some organizations do but my option, go and buy 146 or 40,000 disks and store it in 7 days. We haven't gained much here. The storage space here is too large to do this. But this storage of the actual values without any compression is very naive. You can actually compress some data. And it turns out there are algorithms or data structures for storing this information in a very, very compressed form. That is all of this information and data structure that condenses it to be much, much smaller. And I did some lookups on you can go to websites and download or buy these databases and this one's about the data structure is called a rainbow table. And we don't need to know how they work but you may have heard of them. And this amount of data stored in this compressed form this rainbow table data structure takes about 576 gigabytes much more manageable. One disk can store all of this. So it's just a specialized data structure for storing passwords and hash values in a very compressed form. So really designed for storing this information. So the first attacker they generate this database this rainbow table, takes them seven days. They store it on one disk one hard drive. Someone else comes along and they pay them 20,000 baht to get this hard disk from them. And now the next attacker can reuse this rainbow table for any hash values they need to look up and find the password quickly. So really this is a trade-off between storage and processing time. The first person who generates this takes about seven days but once it's generated we can store the information on a disk for example and then once we have it stored and have it accessible the lookup time is almost insignificant minutes, hours in worst case. So now as an attacker given a hash value takes me tens of minutes to find the password. Rainbow tables you can download them or you pay some money you can download them or people will send you a disk with their values on it. Again tens of thousands of baht to buy one of these. With different hash algorithms with different lengths of passwords but of course if we add one more character to the password to make it nine instead of eight we multiply the number of rows by 94 so effectively the size increases by a factor of about 100. So instead of half a terabyte we're up to about 50 terabytes and that becomes again more expensive. 50 terabytes on disks is not something that is going to cost a few thousand dollars. And these are being used in the past. So we're going to continue this lecture for another hour and a half. Anyone have a lecture this afternoon? No we will not continue but we'll spend five minutes just finishing this topic, this part. Don't worry only joking. I'm as tired as you are, don't worry. But let's just lead to the point what's the next step? So now just to summarize if we store the hash of the password depending upon the speed of our computer the length of the password still an attacker can sometimes find the correct password. So in our example about seven days but to be even faster from the attacker's perspective once someone has generated this data they store it and then just reuse that because they don't have to generate it again and looking up the values is much much faster than calculating hash values. So the next approach in storing passwords and we're not complete it we'll just introduce it is to add some salt and the examples from our handouts is here. So we don't store the hash of the password we introduce a new piece of data. When a user registers we store their username the system generates a random value just a random number we call it a salt we add a little bit extra so this random value is just this column the salt column is just a random number I've just written it as printable characters and instead of storing the hash of the password we combine the password in this random salt and hash them together and we store this hash value now the when the user submits their username and password they submit their username John their password let's say MySecret the system combines the submitted password with the stored salt calculates the hash and compares to the stored hash value if they're the same everything's okay what advantage does a salt give us? there's one small one but one major one maybe you'll see the small one up there remember John and Daniel yeah now John and Daniel before they had the same password and therefore the same hash value now using this random salt they'll get a different salt the system chooses that for the user therefore they'll get a different pass a different hash value so there's a minor benefit but not the major one what's the major one you're an attacker you have this list of hash values you have the list of salts you've obtained this database how do you use the rainbow table I've generated a rainbow table okay and since you're nice I'll give it to you for free I spent seven days creating it it's that 576 gigabytes you're another person you come to me and say can I have your rainbow table yeah okay here what's the problem when I generated the rainbow table I did it for one salt value in fact originally I didn't use a salt but in the first case I would use one salt value let's say I chose all zeroes as the random salt when you come to me asking for a rainbow table you must get the rainbow table for every salt value let's say A4 H star 1 which means I must have generated that if you're going to get it from me quickly you have to wait for me to generate it again there's no gain there of using the rainbow table so to use rainbow tables in this case it requires the person who generates them to generate one rainbow table for every salt value these salts I think I chose to be 32 bits almost done for today the salt length let's say is a 32 bit random value it doesn't look like 32 bits here it's just some printable characters but it's 32 bit binary value how many possible salts 2 to the power of 32 which is about 4 billion now what I would need to do as an attacker is to generate rainbow table 1 using salt value 1 32 zeros for example and it would be our 576 gigabytes and I'd need a second rainbow table with a different salt value another 576 gigabytes or about and I'd need our 32 different rainbow tables with each salt value covered if I did this if I've already created all these rainbow tables what you do is you come to me and you say I want rainbow table for salt A4 H star 1 you come to me I say I want this rainbow table and I go through my rainbow tables and I find it and I find the disc with that and I give you the disc and then you can find the password quickly that would work what's the problem so I'm one attacker I've generated all these rainbow tables then you come with the salt and the hash and you need to find the password and the problem with this is I have to store those rainbow tables and before I store them I must create them remember it took me about 7 days to create the first one we calculated one takes about 7 days to create so to create 4 billion takes 28 billion days so it takes us almost a billion years to create all of these and if I had a billion years to create them each one is half a terabyte so we need 2 billion terabytes to store them we cannot create them and even if we could we cannot store them so from the attacker's perspective there's no way to create these 4 billion rainbow tables so that you could come to me and ask me for one of them in theory I should create all of them because I don't know what the salt will be that you need to look up we cannot predict what it will be because it's random and that's the main benefit of a salt is that such that an attacker cannot use pre-stored or pre-calculated hash values and the way to store those hash values is the rainbow table so rainbow tables are ineffective if we use a salt if we don't use a salt to store the password someone can use a rainbow table to quickly find the password and this is the recommended way to store passwords and this is the way that when you go create a website you create an application that has some user login you will store passwords you always store a random salt long enough if 32 bits is long enough it can be longer, it can even be shorter in some cases and you don't store the password you store a hash of the password concatenated with the salt and when someone logs in they submit their username and password, the system combines the salt and the submitted password calculates the hash and compares to the stored hash value if they match, log in if not unsuccessful this is secure against rainbow table attacks of course there's still other problems with passwords but it's the recommended way to store them and I think that should do us for today but some questions to finish okay so you use many websites so the question is how do you know that the website is using this approach to store passwords you don't you could ask them how do you store your passwords maybe they have a security policy that they publish and say we've been audited and our auditors say we store the passwords correctly but in theory you don't know how they store them okay you must trust them so most attacks on passwords or many attacks on passwords have been on some attacker has got access to a website and obtained the database of passwords and unfortunately that database was not stored like this it was stored either the hash of the password and nowadays easily defeated or even worse just the password in the clear which is immediately defeated okay so many websites still do but you want to look and see what their policy is and maybe find out in any other details if you want to trust them let's stop there we've gone a bit longer today so that we don't have to do so much on Thursday we'll summarize then we'll talk about the exam on Thursday I don't think we'll go into any more detail about passwords just summarize on that topic and that will finish for the course