11–20 of 92 posts
The article is a bit miss leading. The so called security flaw does not reveal the e-mail address directly, but a MD5 hash of it. Sure it can be cracked, but it doesn't mean that it will get cracked.
And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.
In all our worry about NSA taps, the simple fact is that gravatar and now disqus allows anyone NSA, your health insurance company, groups who dislike your group, etc., to track your blog comments, help desk comments, any comment you make around the net. Your comments to gay rights groups, anti-gay rights groups, cancer support groups, aids support groups, abortion groups, democratic politics, tea party groups, gun ri…
Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person. If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?
Yawn. A rainbow table can be used to determine str in MD5(str). News at 11…
The article is a bit miss leading. The so called security flaw does not reveal the e-mail address directly, but a MD5 hash of it. Sure it can be cracked, but it doesn't mean that it will get cracked.
Actually, yeah, it will be cracked, by someone . And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.
(of course, my real name can be extrapolated from my HN username)
Old olllddd news, almost every Wordpress blog uses Gravatar, same issue...
In all our worry about NSA taps, the simple fact is that gravatar and now disqus allows anyone NSA, your health insurance company, groups who dislike your group, etc., to track your blog comments, help desk comments, any comment you make around the net. Your comments to gay rights groups, anti-gay rights groups, cancer support groups, aids support groups, abortion groups, democratic politics, tea party groups, gun ri…
Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person. If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?
"Email (required) (Address never made public)"
MD5 leaks of my email address into web pages is in fact making my address public.
Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress has been leaking your md5 address all over the place.
Earlier quoted context omitted.
Actually, yeah, it will be cracked, by someone . And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.
My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing. (of course, my real name can be extrapolated from my HN username)
Earlier quoted context omitted.
Actually, yeah, it will be cracked, by someone . And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.
My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing. (of course, my real name can be extrapolated from my HN username)
Earlier quoted context omitted.
Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person. If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?
If I go to comment at a wordpress site it says this: "Email (required) (Address never made public)" MD5 leaks of my email address into web pages is in fact making my address public. Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress…
So wordpress - not disqus or gravatar (which I'm aware is owned by wordpress) - is lying to you. Let's put the blame in the right place.