Isaac Sesi: Thank you, really happy to be on the podcast. I am Isaac Sesi, a software engineer (dunno if I should call myself that yet.), an entrepreneur, and an embedded systems engineer. I run two startups in the Agric Space and I’m interested in Education and Agriculture. Really happy to be here today.

Sam Moorhouse: My name is Sam Moorhouse. I’m a British software engineer and I run a program called Global Code, an annual summer program based here in Ghana. This year we are teaching computer programming in Cape Coast and Legon and KTU in Koforidua.

Before I launched this podcast, I used to record my conversations with developers on certain topics in tech. One thing that kept me from releasing the audio files on my site for the podcast was the simple urge to build a real-time commenting system first. It took me a very long time to figure out I didn’t really need that feature because people were just concerned about accessing the content. That’s a bad way to approach building anything. So today, we’re going to talk about an Agile method called YAGNI.

Sam Moorhouse: So YAGNI is You Ain’t Gonna Need It. It was popularized by perl developers because of the nature of their programming language, who invented/popularized what we would now call Design Puns. And YAGNI was one of them. Effectively, what it boils down to is this: Don’t build code that you don’t need. There’s a whole class of Software Engineers that we call Architecture Astronauts. When faced with a problem, they try to build the structure and framework for solving the problem instead of solving the problem directly. Sometimes it’s a pitfall junior developers fall into. And it’s definitely something that you find senior developers fall into. As a developer, if you keep YAGNI in mind, it forces you down a path of solving the problem you have.

Isaac Sesi: I’ll look at this from a different perspective. In my third year in University, my friends and I set out to build an app that helps students get access to past examination questions on their phones to prepare for examinations. We were so obsessed about building new features that for a whole year and a half, we hadn’t actually launched the app. Along the line, we learned better software design principles which enabled us to build a Minimum Viable Project (MVP) upon which other features could be added as needed. That’s my first experience with YAGNI: we were building stuff no one was going to use. It saves a lot of time, money, and sanity to build stuff you need incrementally as time progresses.

Do you think that adding that semi-formal structure around your development processes forced you down a path where you have to release?

Isaac Sesi: In the beginning, that was true. But as time went on sometimes there wasn’t really anything to release. But as soon as there was something significant to release, we did.

In a Nutshell, employing YAGNI helps you to

• Deploy quickly
• Better Test/Feedback driven development
• Gives that self-fulfillment of being able to deliver on time
• Create more value with less code
• Reduces amount of rework

Is it just a common pattern with self-taught developers, or is there and underlying fundamental trait of perfectionism in people that makes them violate YAGNI often?

Sam Moorhouse: I don’t know. I’ve been an enterprise software engineer for 10 years. I’ve got a very classical software engineer’s education: I had a computer science degree, went into a job where I worked as a programmer for 10 years. I worked with mentors, I paired with people, we did TDD, and now I’m an instructor so I teach people how to write code. I was self-taught for about two and a half years before I went to the university but I barely remember that. However I’ve seen the pattern of developer writing code they don’t need for all kinds of reasons GOOD and BAD. A bad reason could be “The more code I write, the more valuable I become.” Good reasons like writing the interface for a new class in Java with all of the public methods just in case you may want to abstract certain parts during the course of your development period. A couple of things I think have helped with YAGNI include

• Refactoring tools for developers and IDEs have made it easier to create interfaces or abstractions of different classes.
• The growth of usage of dependency injection frameworks that have made it much easier now to abstract the contract identifiers from the implementing class
• Ease in creating new releases for projects and progressive strides in Continuous Integration and Continuous Deployment

Isaac Sesi: I think when people are self-taught, they don’t get the kind of training software engineers get. They usually just learn to code. That means they lack some of the information that goes into good software building. A lot of people are programmers and not necessarily software developers. That’s why it’s important to find a mentor when you want to learn on your own. I don’t think most people deliberately ignore YAGNI, they just don’t have access to that type of info.

What advice will you give to a newbie who wants to get started with YAGNI. How do they determine what they do not need?

Sam Moorhouse: A solution that works the best is to build a Spike which is a cut down version of the MVP that allows you to follow one path through the system from one point to the other, up and down. It allows you to test the connectivity in your infrastructure, and every layer of a layered application. And with each Spike you are certain one type of user request/feature works.

Isaac Sesi: While building based on recommended features may be good, it is also prudent to decide early on the minimum that allows you to test your value proposition and focus on that alone. Users can also flood you with so many self-biased features you may not need. Keep a log however of those feedbacks and ideas on Github as issues or Trello as cards or whatever while you are still validating the reviews.

Sam Moorhouse: Sometimes as developers we think the compiler is our only audience. Just remember your audience when you are writing code.

“Every line of code we don’t write is dollars we didn’t spend, and time on the calendar we get back for free.”

– Tim Evans-Ariyeh

I’m a full stack developer, particularly fond of node.js. Right now the CEO of DotLearn here in Lagos where we have developed a technology called Vectorized Videos to make online learning and video learning fast and affordable in emerging markets. Outside of that I’m just a nerd, just like anyone else.

Early Life

My parents are originally from India, but I was born on a very very tiny island in the Caribbean called Grenada. After the US invasion in 1983, my parents had to evacuate the Island(my dad has a photo of himself handshaking Ronald Reagan). At age 5 my family moved to the US. I studied mechanical engineering in college, I didn’t study anything to do with code or programming because I wanted to work on robots. Specifically, I was fascinated by space robotics like the Mars Rovers.

After college, I started a pHD program in robotics, but fell out of love with it halfway through. So I dropped out of my pHD program and decided to do social work for several years. I joined the US Peace Corps… and moved to a rural village in Mexico. That’s where I got the idea for DotLearn. There was a connectivity issue with online education which made it nearly impossible to take any classes online so I decided to make it free and widely accessible. 

I was living with a host family in Mexico, my host father run this NGO for people with disabilities where he made prosthesis out of scrap metal that he would find around. Given my background in robotics, I started working with him to make 3d printed prosthetic legs and In about a year and a half we had built a full workshop and we had printed 5 prosthetic legs for people. It was something I wanted to run as a full enterprise but I had a purely technical background so I applied to an MBA program and went to MIT for 2 years….

Passions and Aspirations

I like a lot of things, programming is one of my favorite things to do. I want to see this DotLearn project become a success. If and when it becomes a success story, I’d like to go back to the prosthesis project that I mentioned, aside that there are people with other awesome projects that I’d like to support whether with my own time or with my money. On the side I also love studying languages. My wife is Mexican, and I speak Spanish with her all the time. I’ve also been learning Mandarin for about 10 years now and I am at a point where I can fully give my business presentation and pitch in Chinese which may end up being useful if I ever had to talk to Chinese investors (finger crossed).

What is a file, what are file formats and why did you need to create one?

I like this topic because it’s so close to what I’ve been working on for the past few years.

The idea of having your own file formats seem very strange in 2018, but back in the earlier days of computing, this wasn’t a strange thing at all. Most people are familiar with typical file formats like .mp4 for video, .mp3 for audio, .pdf or .docx for documents. Those seem quite fixed and most people have never found weird file formats unless you use specialty software.

So what does it mean to have a .ai file? What does it mean to have a .stl file. 

At the end of the day it seems like this incomprehensible thing where only big organizations or huge companies can create their own file formats. Files are just ways to store information. And a file format is a schema or a pattern for storing information in a certain way in a certain type of file. And so if I open any type of file with an extension, I can read the file and read a certain type of data in a very specific format.

File formats were very common in the earlier days of computing. Nowadays, we’re too used to word software and SAAS platforms that we kind of forget that information from software services need to be stored somewhere. If you’re using the MEAN stack it could be in a MongoDB database hosted somewhere on a cloud server.

If you open a .docx file with the right program on Linux for example, you’ll see that .docx files are just zip files which contain text files with text in xml format. And you’ll find that most file formats in the world are either text files with text written in a specific way or zip files with text files or if you’re dealing with media files (audio, or video) it’s a bit different.

If you go on wikipedia and download a .svg file. I encourage everyone to do that. Open it with a custom program: a text editor like notepad or  gedit, you’ll see a bunch of xml encoded text things. SVG images are text files organized in xml format according to the SVG standard published by W3C. 

Click this link to download an SVG file

Note the file may be saved as .svg.png. If that's the case, rename it to a .svg extension after downloading and ignore all warnings.

If I put a circle tag in xml, I could specify r=50 and color=#f00. It should make a circle with radius 50 that’s red.

It’s just a text file, and you rename it with an extension SVG and image programs are able to load it as an image.

Same with word docs. It’s not substantially different from the way Google drive stores information in MongoDB objects in the cloud. But in this case you’re storing it in a file format on a certain user’s computer.

In the era before web services and databases, a lot of the data was stored offline as file formats. So that’s kind of why in 2018, if you’re new to computers you just assume that file formats are fixed. 

Back in the day it was a necessity.

Our company DotLearn created its own file format .lrn and if you open it up, you’ll see it’s just a zip file with JSON encoded text inside.  Pretty much, any other file format is like that. You have to open it up and view the contents of the file because they are all just text files. And sometimes zip files with text files inside.

Method

File formats are especially useful when you need some kind of data to be stored offline in a standardized way on someone’s device. Examples of companies that have created file formats are people who create video editing software like photoshop or a lot of open source software for audio and video editing. You can save project configurations as files. If you use Webstorm or some kind of IDE, sometimes they create their own file formats to preserve their own data in a way that’s custom to that software. For example, let’s say you wanted to create your own code editor and you wanted to store your users’ configuration in your own config file, you could just name that config file project.myawesomeextension.

If you’ve used web development for example, you’ll see custom file extensions like .yaml.

If you create you own software which needs to store data offline, creating your own file format is the easy way to do it. All you’re just saying is these files are meant to be opened with a specific set of programs.

The caveat is that, just like software, anyone can create one, but no one will find it useful unless people find some kind of underlying use case for it.

Exclusives

Demo at 29min mark

Download Demo File Here (CHM-8012.vvsf)

Controversial Statement at 37min mark

You can comment on any file formats you’ve created and I’ll check it out

I’m Laud, I became a developer because as a child, I was always curious about how things worked. I spent most of my time reading books and trying to put things together. But I was met with the frustration of constantly struggling to get access to physical hardware. That put me off a bit. I came across computers which opened a world of new possibilities to me because all I needed most of the time was software. This ushered me into the world of software and programming in general. A lot happened along the way, I got a bachelor’s degree in physics from KNUST, spent a lot of time trying to figure out what worked and what didn’t. I got into web development and got fully involved since 2013 and did a number of projects at hackathons. I took my experiences to the Meltwater Entrepreneurial School of Technology to build my passion and push forward a startup. Afterwards, I try to contribute my skill to the local community and Linux Accra is one of the areas where I am doing that: taking up projects that help the community.

What’s a Server?

It’s a powerful computer, that in traditional sense, can host your website, serve responses to your requests. A server could sit anywhere and people could communicate with it over a network. But what the Linux Terminal Server Project does is that it adds a thin-client support to linux service. You could have a less powerful computer connect to the server and have access to the server’s resources. You could be in a home or office and have all your computers connected to a central computer that has specific resources that your other computers do not have. Usually in an office environment, each computer will have a full setup for each computer, so almost all the computers might be on the same level. In this instance, the thin-client is actually less powerful, with less system resource. But when it’s connected to the server, it becomes as powerful as the server is. That is basically a simple overview of the LTSP. In our implementation, the raspberry pi is the thin-client.

Applications and Benefits

The first obvious one is the cost. You don’t have to buy a bunch of really powerful computers to set up your office if your already have less powerful computers. You could spend all that money on a very powerful Server and spend very little on adding thin-clients to the server. So it allows you to repurpose very old computers at a very low cost.

With that also comes other advantages like security. Since you have a lot of control over the network, you could set custom applications to run on your thin-clients. You need to mostly worry about making the server more robust, but also the thought of viruses on a Linux based thin-client is virtually non-existent given how effective LTSP has proven to be.

You can also benefit from it being open source because you needn’t pay for licensing. There is also great community support and the fact that you can also contribute a feature or a bug fix is amazing.

It also requires low maintenance. The thin-clients are somewhat expendable. It is easier to maintain a single good computer that a lot of them.

There are lots of interesting use cases in our part of the world.

This could be a low cost network-computing solution for almost an kind of institutions that we can think of. We could have these setups in schools or project groups. You invest in a good computer, and get thin-clients setup to use your server’s powerful resources.

I’m working on something along those lines.

Due to a few issues about business and the proprietary nature of the setup Laud is doing, I cannot release full details on what he’s doing with this project without getting us in trouble. But he’s helping setup a lot of these cost-effective solutions for certain companies in Ghana. 

What Does the Future Look Like For This?

The truth is a lot of other countries have moved ahead with this. With us in the emerging markets, there is a different situation on the ground. The way we would implement them will differ a little. The infrastructure will also largely depend on what works for us. It goes without saying that the future is very interesting. There are a lot of talented guys that I’ve encountered, and you’ve encountered. AND YOU ESPECIALLY ARE VERY TALENTED. (Thank you Laud, you rock!) As we, collaborate and motivate each other, we’ll be able to boost the ecosystem, not only to let it survive, but to flourish. But I’m exceptionally very hopeful. 

For exclusive content, play the audio.

I’m Adam Sauer from Columbus Ohio in the United States where I’ve been since my childhood and now I’m working in the Tech Space. I studied Electrical Engineering and Since Graduation I’ve been focusing a lot on data visualization in 3d environments. I also have a big interests in travelling with a purpose and learning.

What is data? What types of data are you working with? What is a spatial environment, and how do these combine in the ecosystem you are creating

Data by itself might be a chart or a series of numbers or something that just give information. It could be your bank account budget, or the different turns you took to walk from one destination to the next, or even your social media profile. Usually it’s just a bunch of numbers and text that’s stored in a spreadsheet or some kind of table on a computer in a very boring grid-like form that isn’t fun to look at.

It’s really hard to look at all these numbers on a screen and try to figure out how to take something meaningful from that. Our brain is wired to perceive this whole environment around us and basically figure out how to navigate in this 3D space. So much of our brain is trained to process that type of information.

So what is really cool is, when you think of infographics or other ways of displaying data, if it’s part of your job to look at all that data every single day then it is so much more useful to basically take all that boring data and put it in this 3D space so your brain can interpret it properly, and visualize certain information in a more efficient way.

It’s just about creating a connection between you and your data especially with this emerging technology field of Augmented Reality, Virtual Reality, Mixed Reality.

This is for sure the next iteration of how we interface with technology, or communicate with computers in general.

Can you highlight some more advantages

I think the biggest impact that this has is the ability to communicate more context of a situation to somebody. Say if a smart city transportation system or power grid or something was designed, the engineers and developers and planners who put together a lot of thought into how a system should function at some point in the development process will have these spreadsheets and data that they can interpret when they are going through it because they’ve spent several hours training on this information. But when you take an outsider who needs to understand that(eg. Data from a natural disaster), then you need other experts to interact with this data to make sense of it. But if you are able to show them a 3D map of this situation, everybody can just get on the same page faster. That’s just one example, but think of things like a general text message or phone call. I’m texting friends and sometimes you don’t know if you’ve sent the right emoji that captures your expression. The fact that I can talk to you and see you here adds so much more ability for us to understand the context of each other’s situation. So the beauty of immersive experience is how it makes these kinds of connections deeper in all fields.

Think about education, would you rather read a textbook on chemistry or rather witness electrons spinning around a nucleus in a 3D environment that you can interact with.

You now run a company that uses data to create immersive experiences for organizations. Tell us about some of your projects.

Circaevum

I had a job out of college working at a car manufacturing company. I was in charge of the power coming in through the grid toward the service panels. But I had this crazy… dumb idea for how I thought of time in my head since I was a little kid. I would visualize the earth’s orbit around the sun and I started building that in a studio world, then a friend of mine introduced me to the 3.js javascript library…

So I started thinking more about the geometry and the physics and mechanics of how that work was working. Creating that in a virtual environment was my crash course into virtual reality. From there, that developed into a calendar project. It’s still continuously evolving and on one version I am able to get your schedule from calendar events and visualize those in that 3D world.

The Bonsai Data Tree

There’s also a project we built that we call The Bonsai Data Tree. In Japanese culture, a bonsai means a dwarf tree in a bin. They take a branch of a shrub and then put it in a bin of soil and call it a Dwarf Tree. When they grow well, it actually looks like a really large tree, but shrunk down. The idea here is to create a minimized tree structure that you are trying to keep small.

So we took that concept and applied it to these datasets. Initially you start with your hard drive, we take that and make that the trunk of a tree. And then each subfolder you have is a different branch. And the amount of data in each of the subfolders correlates to the thickness of the branch. So if I have a lot of data in my videos folder, that branch is going to be thicker than that of my pictures folder which has very few pictures. As you go into these nested folders, those will be further broken apart branches with files as leaves and fruits. We haven’t yet built the leaves and the fruits.

We took this to the Smart City Hackathon to figure out useful ways to work with the data they had collected. So we took all the annual budget data for the past 8 years and we made a tree for each one of those. So you could see how as the years changed different people in charge had their ways of categorizing the budget. You could look at all those branches of departments and see actually where all the tax money goes. That actually went well. And we are trying to figure out different ways to use that for all the political, and other budgetary perspective.

Starting such a project at a hackathon is a pretty cool component of hacker culture where you could make it open and accessible. 

What do you think about this quote by Om Malik

Augmented reality is the 'boy who cried wolf' of the post-Internet world - it's long been promised but has rarely been delivered in a satisfying way.

I have met a lot of people who have believed in this idea for at least 20 years longer and I think the actual idea took a while to grow and if you think about the idea of the smartphone,  there were somewhat predictions of what the smartphone should look like, but it had to go through several failed versions before apple successfully came out with the iPhone. The timing was right for people to be open to it and accepting. There are lots of people who put their heart and should into this 20 years ago and didn’t make it out the other end. It’s definitely a boy who cried wolf. But I have to say, the amount of focus that a lot of  the top tech companies are putting into this alone tells me that it is definitely going to happen. I have seen a lot of projections that show how the different iteration of tech can pay back so much more in customer/media/entertainment value. From the tech that’s being showcased right now, I think the boy is crying wolf, and we should run because this time there’s a wolf.

It is laying a foundation for the future. Especially in this community, a lot of people that are pioneering this technology and coming up with new ideas are people who are very in tune with what it means to be a global citizen and the idea of this global society, that we need to be connected, and supporting that idea. And with everyone that I talk to in this community, it’s weird how naturally our conversation goes to the United Nation’s Sustainable Development Goals.

At this point the podcast had officially ended, but we spent the next couple of minutes talking about other things you might find interesting. Play the audio to gain access to the exclusives.

My name is Emil Bay. Online I use the handle emilbayes, I’m very active on twitter and Github where I create a lot of open source software especially in the space of security and applied cryptography. I also built a password security module that I maintain using the best practice as at now for developers to use especially on the web where secure authentication is required. I also speak about security topics at conferences. I’m also an independent contractor who works on different software projects. I love reading, traveling, and cross country running when I’m not coding. But I do a lot of coding.

What is a password?

This is a topic that’s pretty dear to me; I spend a lot of time thinking about this, and working with password in different ways. Basically, everyone has a password. If you look at it from a cryptographic point of view, a password is like a key that people get to choose themselves and can usually remember, which is not very good from a security point of view; making password security very tricky. That’s why a lot of research has gone into protecting the passwords that people get to choose themselves. Because people choose things that are easy to remember, and may have a personal connection to the passwords they choose. Which makes it sometimes easier for an adversary or sometimes an attacker to guess what password a specific person used if they who the person they are trying to attack is.

In more simple terms a password is like a symmetric key you use when you sign up for a service and each time you want to authenticate yourself, you prove that you still have that key with you. Normally in cryptography, when people talk about keys, you have a much stronger notion of its randomness or predictability.

If a password represents my identity, why not use the same password everywhere?

That’s also the issue I mentioned earlier; when people get to chose their passwords themselves, they tend to pick one or very few passwords that they keep with them for a long period of time, and they reuse these passwords over and over again on different services (computer systems) online.

The problem is that these different computer systems often have different security properties. To say that in a nice way, some of them don’t use best practices for storing these passwords safely. If one or the weakest link (service) where your password is stored gets compromised and your password is stolen, it doesn’t matter how good the other services are at keeping your password safe.

The way that passwords work today is that they prove you as a single person. If you go to a service online, they cannot see your face or verify who you are physically. That means if an adversary gains access to your password, they can easily impersonate you everywhere.

Solution?

From a user’s perspective, you always want to have a unique password for every single service that you use online so that if one service gets compromised, the adversary won’t be able to impersonate you everywhere. But not many people use unique passwords. I keep an encrypted blob on my computer where I store all my passwords. In order to gain access to that you will need to hack my computer and hack the encrypted blob to find out what my password is.

From a service provider’s point of view, you need to protect your users as much as you can. It is your moral obligation. You can either eliminate all bugs and security holes from your whole service which includes software that you write and software that other people have written that you depend on which I think think is realistic because we still haven’t figured out as a field how to write bug free software.

Instead what you could do is figure out a safer way to store passwords. That is also one of my motivations to write software. For node.js there is this module called secure-password that I wrote. It’s like a high level wrapper that’s more familiar to developers but employs the most cutting edge cryptography underneath. Safe Storage is where we can do something as developers.

What do these companies have in common?

• Adobe
• Bell
• Comcast
• Dropbox
• LinkedIn
• Sony
• Tumblr

The issue is that none of these companies really knew how to store passwords in a safe way, and also they got compromised which is the worst that can happen to you as a service provider.

Proper ways to store passwords?

The first thing I did when I started out and wanted to mimic what I saw online when I started out was to store it in your database as plaintext. When you talk about security, always think about a threat model. There isn’t anything being done to secure your password in this threat model. A random person on your site won’t be able to glance through your database and see the passwords. But if an adversary should try, or if your database should leak online, then you’re exposing your users. And since most people use the same passwords everywhere, you will have them compromised across multiple service; that’s really bad for you and really bad for your user too.

The first thing that you can do is to hide what your password actually is. I’m not talking about encryption because to encrypt, you will need to have something to decrypt with, you could do something like that but cryptography has come up with a better technique called a hash function.

You give a hash function input and it will scramble it up and give out a fixed piece of data that is guaranteed to be very very unique and cannot be reversed. The good thing here is that even system administrators will not be able to take these hashes and figure out what the actual input was.

Making hash functions also requires a lot of extremely complicated math. We are talking about a set of specific hash functions called cryptographically secure hash functions. You can also have non-cryptographic hash functions which people use when they want something to be very very fast but often non-cryptographic hash functions are somewhat easy to reverse. It’s possible to find what different values will give a possible hash. So it is very important to talk about cryptographically secure hash functions when you want to obscure passwords.

You mentioned cryptographic hash functions are irreversible, how then did md5 and the others get broken and what's the best method developers should use?

Cryptography is also a field that is getting easier to understand what’s going on, but for a very long time, I feel that cryptography has been such that you had to be part of a ‘Holy Group’ else you were not allowed to touch it. You had to understand all the math and analyze all the algorithms. That’s something that I’m actively working against because you end up with all these developers who are the one building the systems but don’t know how to handle the cryptography so they do whatever is most convenient like storing passwords in plain text or read blog posts where people still recommend using md5 which was broken about 20 years ago. I am working on a lot security focused modules where you don’t really need to understand any of the math, you just need a contract or guarantee that they are one way and that there is no shortcut. You have to spend a lot of computation time.  [Play audio from 19:00 to learn more].

In 2013, a bunch of cryptographers gathered for the Password Hashing Competition. The winner was an algorithm called Argon 2, which secure-password is also using. Which is resistant against GPU attacks and resistant against Large Scale Computing attacks. That’s what all cryptographers recommend now as the most secure algorithm.

How does Argon 2 resist GPU attacks given how fast GPUs can run?

Normally when you lay out a threat model, perfect security from a mathematical point of view is almost never practical. (In cryptography, can be referred to as perfect secrecy which means, even if you have an enormous computer the size of the universe, it doesn’t matter how big it is, you can never break the security, but that’s not really practical in the real world.) Instead you go for something called computational secrecy. Which means you can break this, but it will cost you too much money and take too much time.

The goal of these hash functions is to make it so expensive to brute force these algorithms that there would be no point in trying. In a threat model, you know that you are not going to get perfect security but can you make it so expensive for your adversary to attack you.

Argon 2 has two parameters that make it immune to GPUs. You can control how much memory the function is allowed to use, and you can control how much computation time taken to make a hash. A CPU usually has a lot of memory but a few cores. A GPU has very little memory but thousands of cores. Argon 2 dials up a lot of memory that you can only do about 4 or 8 simultaneous Argon 2 hashes on a single GPU which makes it too expensive to try and crack. In secure-password, I’ve taken the values that Frank Denise who made sodium which it’s built on figured out. It’s within the bounds of an interactive service like a website can afford to create reasonable security without slowing down. To hash a password, you need about 16 or 32 Mb of memory and those parameters can be controlled in Argon 2.

Would you store your password in a browser?

I don’t think the Save Password feature in a browser is a bad thing, but I use a password safe to store my passwords and I’m more comfortable with because it uses a master key that I only know. I can also be fairly sure that the password safe is reviewed. It’s a different thread model with the save password functionality you get from a web browser than it is with something like storing it with service provider…

What are salts?

I don’t think the Save Password feature in a browser is a bad thing, but I use a password safe to store my passwords and I’m more comfortable with because it uses a master key that I only know. I can also be fairly sure that the password safe is reviewed. It’s a different thread model with the save password functionality you get from a web browser than it is with something like storing it with service provider…

Play the audio to get access to exclusive content