EP2 | Are your passwords visible?

Your passwords may be sitting in your database in plain text, and anyone with a copy of the file can read them. In this video we fix that: salted, slow hashing with ASP.NET Core's PasswordHasher (PBKDF2), plus a safe migration of the existing users. This is Patched, episode 2. Episode 1 (SQL injection and broken access control): [   • EP1 | Can someone login to your app withou...  ] CODE GitHub: https://github.com/fnezhadian/flordev... Tags: patched-episode2-before and patched-episode2-after show the app before and after the fix. CHAPTERS 0:00 Quick question 0:22 Intro 1:25 The problem: plain text passwords 2:58 How hashing works 4:41 Fixing it 8:47 Test it 11:15 Recap 11:43 What's next WHAT YOU'LL LEARN Why plain text passwords are a problem even if "nobody will get the database" What a hash and a salt are, and why the salt isn't a secret Using ASP.NET Core's PasswordHasher (PBKDF2) Migrating a real database safely: backup, transaction, drop the old column How to test it: five test cases, including the SQL injection from episode 1 NEXT: Episode 3, moving LabShop from raw ADO.NET to Entity Framework. Build it. Test it. Secure it. #dotnet #aspnetcore #security #passwords #hashing #csharp