AP Cybersecurity 4.2 Authentication: Websites Never Store Your Password — They Store This

No website stores your password — they store a mathematical fingerprint they can check but can't reverse. That single design decision explains hashes, salts, password spraying, rainbow tables, and MFA: the whole of AP Cybersecurity 4.2. In this video you'll learn: Why websites store hashes — never plaintext — and how login really verifies you Hash anatomy: MD5 to SHA-512, the 4 properties, collisions, and why MD5/SHA-1 are deprecated Salt: the random bits that make identical passwords hash differently Online vs offline attacks — and why lockouts can't stop an offline attack Password spraying, credential stuffing, offline hash-cracking, rainbow tables The 4 authentication factors — and what actually counts as MFA Login settings: complexity and minimum length Timestamps: 0:00 No website stores your password 0:10 The stolen directory 0:30 What you'll be able to do 0:43 What a hash is 1:03 The algorithm lineup + repeatable 1:27 The collision intuition 1:48 The four hash properties 2:11 Deprecated: MD5 and SHA-1 2:27 Never plaintext + the login comparison 2:54 Salt 3:32 Online vs offline attacks 3:44 The offline escape + full rights 4:02 Reuse + password spraying 4:17 Credential stuffing + default creds 4:36 Offline hash-cracking 4:57 Rainbow tables + salt strikes back 5:18 Factor = proof of identity 5:32 The four factors, one by one 6:02 MFA: separate factors or it doesn't count 6:31 Login settings: the two dials 6:47 Practice: 3 exam-style scenarios 8:26 The AP trap: four lies to unlearn 8:58 Check yourself 9:24 Next: Securing Spaces Topic: 4.2 Authentication | Exam skill: Mitigate Risk Next video: Securing Spaces — where physical access beats every password [link] Full playlist: AP Cybersecurity — Full Course:    • AP Cybersecurity   Exam: Wednesday, May 5, 2027 #APCybersecurity #APCyber #APExams #Cybersecurity #Authentication