"a$$word" LITERALLY SAVED PayPal

"a$$word" LITERALLY SAVED PayPal | Prime Reacts

Рет қаралды 263,925

10 ай бұрын

Recorded live on twitch, GET IN
/ theprimeagen
Article link: max.levch.in/post/72428945714...
By: Max Levchin
MY MAIN YT CHANNEL: Has well edited engineering videos
/ theprimeagen
Discord
/ discord
Have something for me to read or react to?: / theprimeagenreact
Hey I am sponsored by Turso, an edge database. I think they are pretty neet. Give them a try for free and if you want you can get a decent amount off (the free tier is the best (better than planetscale or any other))
turso.tech/deeznuts

Пікірлер: 306

@eyondev 10 ай бұрын

So, literally "It works on my machine"

@NerdistRay 9 ай бұрын

That made me laugh out loud lol

@hariacharya2534 9 ай бұрын

Yea literally, 😂

@Ikxi 3 ай бұрын

im crying

@JustinLietz 3 ай бұрын

a$$word

@demolazer 10 ай бұрын

Great article, what a writer that dude is. Even better having it read to me as a bedtime story.

@rotteegher39 10 ай бұрын

Especially when you are Ukrainian. Literally me who stumbled upon this video before goin to sleep

@NithinJune 9 ай бұрын

@TomRothwell 6 ай бұрын

Also came across it going to sleep 😴

@ianbelletti6241 3 ай бұрын

More like a woman on crack telling a story. Too many irrelevant details and sidebars. Just get to the point of the story. I don't need to know your mother's father's brother's wife's maiden name for you to tell me this story.

@batatanna 10 ай бұрын

3am at a darkened cubicle is never how you want to start a story ngl

@robmorgan1214 10 ай бұрын

Unless... it's instructions on how to escape the backrooms!

@kyay10 10 ай бұрын

Ik the math looks very complicated, but basically it uses the cool fact that a polymomial of degree N is uniquely defined by N+1 points. In other words, if you give me N + 1 points on an N polynomial, I can reconstruct the whole polynomial and evaluate it for *any* value I want. For instance, a line is uniquely defined by 2 points. Similary, there's only 1 unique quadratic that goes through any 3 points you choose. So what the secret sharing thing does is it gives all 8 people their own unique points on a quadratic function (degree 2 polynomial), and basically any 3 of them can then completely recreate the function and find the key (which is, by construction, f(0)) Edit: the original explanation in the article is good in the sense that it tells you exactly *how* to generate such a shared secret, but it doesn't explain well as to *why* it works

@homelessrobot 10 ай бұрын

very cool

@davidjohnston4240 10 ай бұрын

Yes. Pretty much exactly that. I've held a key share before (for a now decommissioned CA). In the form of a card (holding the actual key share) and a personal password for the card. Keep in mind the polynomials are extension fields of GF(2) so that the whole thing can be represented with bits because it's on a computer and bits are kind of handy.

@jamesnewman9547 10 ай бұрын

Thanks for this explanation!

@hakooplayplay3212 10 ай бұрын

Oh...cool, now I see

@Wacl0mirHavvk0 10 ай бұрын

This is a much better explanation

@dromedda6810 10 ай бұрын

The guy that wrote this deserves a fucken award for that article, the storytelling, the twists, the characters, a$$word, everything was top tier

@AdrianBawn 8 ай бұрын

To answer the question at 14:55 "what would happen if 6 out of your 8 people were on the same plane" When you implement systems like this, you make sure that never happens. If you need to send more than 5 people from that group to the same place, at the same time, you send them via different airlines, trains, cars, whatever, spaced far enough apart that the chances of a crash involving all of them is essentially zero. If you are implementing a system THIS secure, chances are you have the budget to deal with this kind of invonvenience.

@NickSteffen 4 ай бұрын

Yea, even outside of this most corporations have general limitations on the number of people who were allowed to ride on one plane. One company I worked at, it was 6 VPs and 25 normal staff.

@skarlock5257 2 ай бұрын

As soon as I saw the word "Solaris" in the article, I immediately began to suspect I would blame Solaris. I wasn't disappointed! 10/10 would read again.

@timothycallahan7956 4 ай бұрын

There needs be a website dedicated to “bringing production down” stories. They hit you in the feels. SO HARD.

@gownerjones1450 3 ай бұрын

Nobody in the world would ever expect password inputs to be SECRETLY truncated. This is insane. Who programmed that?

@musashimiyamoto9035 13 күн бұрын

This was a while ago, so fair enough.

@complexity5545 10 ай бұрын

This should be acted out as a skit and distributed amongst all computer science undergrad classes. Really entertaining. My bank did something similar. Unknown truncating is a problem. You can't read all of the manual.

@robinator18ps3 10 ай бұрын

Probably one of the best articles you've reacted to! Well written and a damn good story!

@maxlife459 10 ай бұрын

Solaris messed up big time back then: WTF were they doing truncating passwords!

@benb8075 10 ай бұрын

Would have been fine if the program told you the pw was cut short. Silently accepting a system modified pw is pretty bad form, regardless of how cool, neat, or useful solaris devs thought it was.

@TheArrowedKnee 10 ай бұрын

@@benb8075 Regardless it just sounds completely insane

@Yorgarazgreece 10 ай бұрын

@@benb8075 that's still not good. there should be hard validation

@taragnor 10 ай бұрын

@@benb8075 Well it's a C function that returns a char *, it has no way of notifying the user that it was truncated. It can basically either return a null pointer or it can return some string and that's it. Like most classic C style programming it puts all the responsibility on the person calling the function to be aware how it works.

@zokalyx 10 ай бұрын

@@benb8075 EXACTLY. A single f-ing printf and that's it

@SashaInTheCloud 10 ай бұрын

You have to use more than just people in a multikey encryption setup like this. You use things like a backup set of keys in separate lock boxes at banks in different countries, with two keys per lock box, and then another backup setup with copies of books at everyone's nana's houses, there's always a way around the plane crash problem!

@superitgel1 10 ай бұрын

I want to see a movie of this. Great plot 😄

@vaisakhkm783 10 ай бұрын

😂 i am going quit programming and start learning animation just to make this a over dramatic animated movie

@homelessrobot 10 ай бұрын

coming soon to a theater near you "PayPalia: Secret of the Lost a$$word"

@alexhiatt3374 10 ай бұрын

would watch.

@vborovikov 9 ай бұрын

there is a guy who narrates stories like this. I bet he's going to make a video out of it. channel name is Kevin Fang

@AnirbanDas5000 9 ай бұрын

I want Christopher Nolan to direct this. Like Oppenheimer.

@sharpfang 3 ай бұрын

Silently trim the password to 8 characters. What an amazing security feature!

@Turalcar 10 ай бұрын

0:10 Adi Shamir is obvously S in RSA.The others are Ronald Rivest and Leonard Adleman.

@MMLauritsen 8 ай бұрын

Shamir secret sharing is unironically the coolest thing ever. I highly recommend reading the original paper 'How to share a secret', it's only 4 pages long!

@bimsherwood7006 10 ай бұрын

This is why 'availability' is one of the pillars of security, along with confidentiality and authenticity.

@unowenwasholo 10 ай бұрын

If there was ever a story that highlighted the importance of debugging skills. (Well, at least until the post-script, lol. Also the importance of always having a rollback plan whenever possible.) Being able to take a single working case and derive further understanding about the problem from the diff of that and the non-working has been so much of my programming career. “Why did _this_ work?” is often just as important as “Why isn’t that working?”

@cericat 3 ай бұрын

Also test on all platforms you're intending to use in your deployment environment. It's precisely why I'll probably never launch anything with an Apple version, don't have nor want the hardware under my roof.

@volbla 8 ай бұрын

So if paypal is using just a single password again, we can go back to beating it out of someone?

@Lambda.Function 6 ай бұрын

I've learned through several horrible mistake stories like this that it's better to be a little insecure and make redundant backups until things are working than otherwise. It's saved me a few times when I've accidentally RIPd things and had a sigh of relief that I had backups.

@Catterjeeo 4 ай бұрын

Well, a paper copy of a key hidden in a safe is not the least insecure

@oderchannel426 10 ай бұрын

Oh man I agree with this so much, I totally watched this 27 minute video in 16 minutes and I understood all of it. I loved it when "a$$word" literally saved paypal!

@TechBuddy_ 10 ай бұрын

In 7 years since the creation of my account on KZfaq this is the second video I ever liked. The article, the delivery and the emotion was just perfect ❤

@ThePrimeTimeagen 10 ай бұрын

@allahnbirkulu6942 10 ай бұрын

what's the first one?

@TechBuddy_ 10 ай бұрын

@@allahnbirkulu6942 too embarrassed to share that 😂

@JustATempest 9 ай бұрын

What was the first one?

@TechBuddy_ 9 ай бұрын

@@JustATempest NO!

@Yupppi 5 ай бұрын

What a breath-taking story. Like the best adventure stories for kids, the dude had been smarter than himself at every turn possible, both in making sure it was safe and that he could not fuck it up. A bit of like reading one of those Artemis Fowl stories where the kid just has planned every possibility before and rehearsed the alternate paths.

@holmybeer 10 ай бұрын

"Language interpolation" f**ing killed me

@MNbenMN 3 ай бұрын

Here it had me thinking ZZTop and that shack outside "language"

@razt3757 10 ай бұрын

This demands a movie, I would actually watch it. Great writing!

@thehibbi 10 ай бұрын

Such a great article, and you reading it makes it even better!

@cheaterman49 10 ай бұрын

8:39 I mean it _is_ an accent aigu, and I'm honestly impressed you managed to put a name on it :-)

@arsenymun2028 10 ай бұрын

I love Stencil Law Men. My favourite Sci-fi

@exception05 4 ай бұрын

It's probably about method of Solaris stores pass phrases. One of the features of DES is that it uses keys of a fixed length - 56 bits, which corresponds to 7 characters (if you count 8 bits per character, taking into account that the 8th bit was often used for parity). As a result, even if the user enters a longer password, DES only processes the first 7 characters. In the context of storing passwords, this means that if a system uses DES to encrypt passwords, it will only honor the first 7-8 characters of the password, greatly reducing its security. SHA-1 and MD5 are hashing algorithms and do not have such a limit on the length of the input data. They generate a hash of a fixed length regardless of the length of the input message. This makes them more suitable for securely storing passwords as they do not limit password length and provide a higher level of security.

@Delfigamer1 3 ай бұрын

PSA: do not use SHA-1 and MD5 for security. They are considered too weak for modern computers. Use SHA-2 with the hash size of no less than 256 bit. PSA 2: do not use a hash function on the password directly. Don't even use it with a salt. There are algorithms designed directly for the purpose of storing and using passwords securely, called "Key Derivation Functions". The one you should use by default in 2024 is PBKDF2 with a 6-to-7-digit "number of iterations". PSA 3: also, in general, "don't roll your own crypto", but also be aware of the X-Y Problem. E.g. when you build a site and want to let people register accounts in there - don't google "hash functions", don't even google "password storage" - google "user authentication" instead (or "how to verify the person is actually who they claim to be" in normal people's language). The result will be that, for an online service, it's better to not deal with passwords at all, and instead rely on OAuth-ing accounts from other services, like Google, Twitter, Github, etc. Then they can do all the security that's considered appropriate at the time (passwords, 2FA, retina scans, whatever else we will have to deal with in the 2070-s cyberpunk dystopia), and your site will just have most of this security just trickled down by delegation.

@exception05 3 ай бұрын

@@Delfigamer1 Good advices, although my original comment was about the PayPal case that happened when MD5 and SHA-1 were pretty new.

@MeriaDuck 10 ай бұрын

Halfway in and commenting something you are probably going to say. This seems like a procedure you need to rehearse regularly. I once worked somewhere where the database had a master and slave setup and the slave taking over master role was tested every month.

@randomnobody660 10 ай бұрын

just want to quickly point out Adi Shamir is in fact the S of RSA

@core36 8 ай бұрын

Murpys law is a thing. Always expect your little project to not work the first time you try it on the actual system it’s going to run on. Hey maybe don’t let a script overwrite critical files before you are absolutely certain that everything else works? The printed masterkey in the letter was a good call tho. Guy knew what he was doing, just got a little confused.

@TankorSmash 10 ай бұрын

This is a fantastic story. Loved the video

@davidyoder5890 9 ай бұрын

This has been the best article so far. What a ride!

@Ataraxia_Atom 9 ай бұрын

This legitimately made me LOL, dude a$$word must have been such the meme at PayPal

@Gomace 2 ай бұрын

Rule #1 of coding: It doesn't work on the first try. Even if you check the syntax, double check the syntax, double check what it's supposed to do, and even used it before, there's always some number that is in the wrong place, one semicolon that's missing, one letter that's incorrect, a spelling mistake in a variable name, or it does the complete opposite.

@htx80nerd 3 ай бұрын

Story about Paypal being wildly incompetent. This checks out.

@ccgm_harpy 3 ай бұрын

I once locked myself out of a remote windows server machine. I changed the password using cmd and didn't realize that my password used an escape character. When I tried to log back in my password didn't work. After a lot of confusion, removing the escape character solved the problem.

@TheFlutterQueen Ай бұрын

does escape character refer to a character that escapes other characters or a character that needs to be escaped?

@robmorgan1214 10 ай бұрын

Man, that was a whiteknuckle sphincter puckering read. I felt it in muh feelz.

@wizardscrollstudio 10 ай бұрын

That story brought a tear to my eye. All I remember is something something and a bad word.

@EgonFreeman 4 ай бұрын

Stanisław Lem - I sure hope you at least know _of_ him. He's written a ton of hard sci-fi, some of it (socio)political commentary. He was a publicist, a philosophist, a futurist, and a Nobel prize candidate. Philip K. Dick couldn't believe that the varied works could all have been penned by the same writer, so he actually wrote a note to the FBI that he believed "Lem" to be a Soviet provocation. xD He predicted ideas that eventually become handheld e-book readers, audiobooks, smartphones... sometime in the 1960s. :D If you've seen "Solaris", that's based on his work (though he himself didn't like that adaptation). If you've played the game "The Invincible" that recently came out on STEAM - that's also based on his work. ;-]

@cericat 3 ай бұрын

Not really predicted as extrapolated from then existing tech and focuses on continuing research, ie the first design for a tablet PC was done in 1968 by Alan Kay as a college student based off tech then being worked on he was aware of. Doesn't detract from his ability, he was simply far more observant than many of his contemporaries and able to see potential ideas to a logical conclusion, audiobooks weren't new in that they did exist at the time and had since the 30s (one of the first tests was an excerpt from Helen Keller's biography so you know part of why talking books were seen as valuable even then), digital storage was in its relative infancy though comparatively easy intellectually to see there'd be a drive on reducing physical size and increasing capacity compared to the RAMAC 305's storage of 1956. A lot of people don't know Lem these days precisely because he was a Polish author, which is weird compared to the 70s when he was one of the widest read sci-fi authors in the world. but that's what time does to us. RIP to all the greats who are gone now and becoming largely forgotten.

@alexhiatt3374 10 ай бұрын

thank you for writing this great article prime

@jeffreybritton3338 10 ай бұрын

I loved this story and presentation. How did you not recognize SSS at the very end though. Shamir Secret Sharing.

@Burgo361 6 ай бұрын

I really felt the stress of this situation this storytelling was amazing

@abhatem 10 ай бұрын

What a roller coaster of an article 👏👏

@lashlarue7924 3 ай бұрын

This is pure nightmare fuel, but Prime reacting to it with the happy ending (rawr) makes it all worthwhile.

@yaghiyahbrenner8902 9 ай бұрын

wow incredible journey. dramatic story very well articulated.

@manuelschneider224 10 ай бұрын

Absolutely amazing article

@taylrthegreat 8 ай бұрын

Literally beautiful example of sometimes short passwords are cool

@StrengthOfADragon13 3 ай бұрын

"What if 6 of your 8 are on a plane together" this is an eventuality that has to be considered, you can't have more than 5 of them in 1 place or unavailable at any given time

@user-qd8cz8sw5v 9 ай бұрын

This article gave me some serious Silicon Valley (TV Series) vibes. A password Big Head would use...

@HardcoreGamers115 10 ай бұрын

YOO why did I just realize Max fuckin' Levchin wrote that lol 10/10

@fuzzy-02 10 ай бұрын

This served me content of greater quality than a million novels

@kzalesak4 4 ай бұрын

To solve the people on a plane issue, we are actually implementing this in an organisation i work for, where you split the keys into physical copies, that are tamper-proofed, and then you hand them out to people to keep in a safe place of their keeping

@monster2slayer Ай бұрын

companies i've worked for have explicit and enforced rules that make sure key people can not fly on the same plane

@jimdiroffii 8 ай бұрын

I once deployed a new package to a single node to test it. That update went to every single node instantly, slamming the entire network, and grinding operations to a halt. Luckily, the update was successful, and everything came back on its own. Some mistakes you will never make twice.

@daw5268 10 ай бұрын

bruh your reading of this was phenomenal

@yarbarbar 9 ай бұрын

Lagrange interpolation is the basis of Reed-Solomon codes, so would be fairly common knowledge to people in computing at the time.

@olbluelips 2 ай бұрын

This was incredible

@mollistuff 2 ай бұрын

On the edge of my seat here. A real crypto-campfire tale

@zperk13 10 ай бұрын

14:40 Bus factor? Nah! Plane factor!

@dennismuller1141 10 ай бұрын

there is also the term truck number

@glennmorrow2755 4 ай бұрын

That’s gotta be one of the best stories ever! 😂😊

@bobDotJS 10 ай бұрын

Listening to this dramatic reading gave me nerd PTSD

@max_ishere 10 ай бұрын

Dude got RTFM'd hard

@noredine 8 ай бұрын

That story reminded me of online recipes where the author always tells you their life story

@hypergraphic 10 ай бұрын

That is such an epic story!

@tmerb 3 ай бұрын

this needs to be a movie

@alurma 10 ай бұрын

So good! Thanks

@abz4852 3 ай бұрын

This has to be the best article ever. Literally could be a movie scene.

@fuzzy-02 10 ай бұрын

Aaannnnnnd saved, under dad stories for future dad meetups.

@zzyzxyz5419 10 ай бұрын

When did youtube start to update the view counter live? I can see it moving up.

@triplea657aaa 10 ай бұрын

This article is the kind of thing that made me get a Math degree.

@ccgm_harpy 3 ай бұрын

Who would have thought, a bad password saving a company.

@DUDA-__- 3 ай бұрын

Oh it thought about Shamir secret sharing for a key to my PW Database. I like the concept.

@martin7462 Ай бұрын

This article is an absolute fever dream

@tylercornett2022 10 ай бұрын

That was as entertaining as it was terrifying lol.

@JGComments 3 ай бұрын

This guy made a real Schmess of things.

@macctosh 10 ай бұрын

What a beautiful story! Wow

@TheNewton 10 ай бұрын

My main thought about this situation is should throttling for password submissions be behind the same password. And why would you not do this in a repeal and replace fashion running a dev/slave version to validate it over time in production before risking the actual production.

@lezzbmm Ай бұрын

this is fkn amazing lmfaoo

@ThePrimeTimeagen Ай бұрын

It's my favorite article of all time

@quelchx 10 ай бұрын

Id love to hear some when I got back from vacation stories....

@cericat 3 ай бұрын

7:58 Filk is a musical genre that mostly grew up in fandoms since the 50s, with much of the distribution in the 80s and 90s, so yeah a geek party is exactly where you'd expect to hear it. If you ever get around to reading Poul Anderson he actually wrote at least one piece of Filk as well according to his wife. 16:10 Cymeks are from Brian Herbert's follow up Dune books, they were humans turned into thinking machines. We're talking about pre Dune history here, the Butlerian Jihad. Abslutely nothing to do with the Tleilaxu, gholas or face dancers. Your chat was messing with you.

@Mossyblog 5 ай бұрын

Just tbc. What won me over the most in the video.... 'push-it' by Salt-N-Pepper scene setting. I can almost smell the room they were in from the 90's all the way back to present.

@porky1118 3 ай бұрын

2:07 Oh, are you also responsible for all the other bugs at Netflix? Like after watching advertisement, audio and video aren't in sync anymore. Or when watching on web, I first have to start playback before the "Back to main menu" arrow appears. And I don't know how to get the season and episode list, but sometimes it just appears when reopening a tab where I was watching a show.

@ragectl 6 ай бұрын

I remember having to look at Solaris being able to have long passwords and longer usernames. Totally wild the system is built to restrict everything to a length of eight characters

@pv2b 5 күн бұрын

Hey, that's cool, I have something in common with the protagonist of this story, in that my father also translated Stanislaw Lem (into Swedish).

@smtsjhr 10 ай бұрын

you are such a perfect character (and good person) x333

@spyroninja 10 ай бұрын

Tom wouldn't have made that mistake...

@zbot2123 3 ай бұрын

We call the designated survivor problem a "bus factor" how many engineers on the same bus crash would result in business losses. Low bus factors are pretty dangerous