In this video, let's try to look into what is standard password, and so in the previous video, we
have seen no password and code, which clearly indicates there is no encryption or encoding or hashing
mechanism inside it, and the passwords will be dealt using plain text.
So I would say standard password encoded is the next advanced version.
So you can see ENCODE Method will internally call some encode helper method to help with this standard
password encoder will follow algorithm at such a 256 and it has two types of constructors.
One is you just call without any arguments.
That means it will use this as such a 256 algorithm and without any sort of secret.
And the other one is you can also mention a secret associated to your password that is a 256 algorithm
can leverage when generating cash value for the purpose of secret outside in hashing mechanism or encryption
mechanism is it will add more complexity to the hashing mechanism so that whatever attempts that hackers
will do to decode your password will get delayed, like a contrast to my user to not to have some simple
passwords like one, two, three, four, five.
But whoever is doing the importance of brute force attack hackers will try all possible most common
passwords and they can easily check whether my hash existing in database is matching to one, two,
three, four, five hash and they can easily decoded and assume, OK, one, two, three, four is the
password of this user.
Because what the hackers have written are what hacker how already for one, two, three, four, five
is matching with the hash that is present in the database.
Since we can't just treat our users to have only such complex passwords to guess what we can do in such
scenarios, we can add in the backend inside our secret to this password provided by the user.
So that's the purpose of the secret that we are seeing here.
So in such scenarios, we will generate some random secret or whatever we are passing to.
The this constructor will be included in the hashing of the password that we share and while decoding
until since the secret value is stored inside the hash value of the password while decoding.
Also this algorithm will try to extract sort of secret associated to that hash.
And the same secret will be applied to the new password that we are going to share through UI and once
the hashes in return it will try to back.
So that's where you can see here in the matches.
First, it will try to decode the encoded password and from the decoded value it will generate assault,
which is already store Bozak.
It will try to compare what we have password after digesting it with all the data stored value.
But here you can easily see that reversible is possible here since this is not a one way hashing mechanism
like decrypt or script password encoders.
So due to that reason, this used to be used in the legacy applications.
But this is not recommended for these days because now the processes of the servers that attackers are
using are strong enough to detect.
What is your password for such weak algorithms like SSL 256?
So due to this reason, standard password encoded also duplicator and spring security people also clearly
highlighting this is the best password and coding is not considered secure.
Instead, use and add up to one function like password in order or a script or any password encoder,
which is one way hashing function.
So due to that reason, we should avoid using the standard password encoding also.
But I'm just giving details about it because still there are legacy applications which are developed
in years before they still use users.
So we should be aware of this thing.
So let's try to look into what the other password encoders provided by Springsure in the next.
Thank you.
And by.