Researchgruppen seems to be in violation of the Disqus terms of service by harvesting personal information and also disclosing this in other mediums.
So what? I doubt they're bothered if Disqus bans them from using their service.
Disqus cracked – Security flaw reveals users’ e-mail addresses
41–50 of 92 posts
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#42Anything requiring third-party cookies, AND requesting an e-mail address not only stinks of spam-oriented advertising revenue, but also total disregard for user security. Even more telling were the options to sign in with services like Facebook Oauth. So from the beginning, I think it was always obvious that Disqus had no interest beyond the bare minimum in casually protecting user privacy. This prompted me to avoid…
You think Disqus is selling your email address to spammers?
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#43Another reason to not use your real name or email address when commenting across the web.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#44Earlier quoted context omitted.
Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person. If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?
If I go to comment at a wordpress site it says this: "Email (required) (Address never made public)" MD5 leaks of my email address into web pages is in fact making my address public. Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress…
No it doesn't. You need to know the email address up front in order to generate the hash.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#45If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising.
Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen.
The slippery slope is
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#46Earlier quoted context omitted.
The rainbow table would just need to include alphanumeric letters + '@' for up to 30 letters. I think your emails are in nearly every rainbow table in existence.
Just the 1-10 character lowercase alphanumeric rainbow table from freerainbowtables.com is 297 GB. Of course, you can generate rainbow tables with various parameters and tradeoffs so it's not trivial to compare them. Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?
EDIT: “nearly any email rainbow table”, i.e. 1-10 characters cross joined with all domains for a given tld.
You’re correct that brute force with an entropy of 3 per bit would still be too big for rainbow table usage (like 10^15 PB too big).
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#47I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.
> I don't get it, if your email address is so private then why you share it with 3rd parties?
How would you use it otherwise? My backyard is private, but I share it with a few 3rd parties. That doesn't mean i intent to share my backyard with the entire world.
There is an element of trust with particular 3rd parties that is being violated. Why is that so hard to understand?
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#48[deleted]
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#49Surely any hashing would be susceptible? Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made. Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still…
In general, what you're asking about is called a "salted hash". I don't understand enough about Disqus's system to say it would definitely have prevented this vulnerability.
A salted hash only slows down brute-force attacks and dictionary attacks. The salt is still stored with the hash, so you could still eventually match the email address with the hash. Instead of hashing each email address once and comparing it with all of your collected hashes, you'd have to hash each email address using every salt until you found a match.
Re: Disqus cracked – Security flaw reveals users’ e-mail addresses
#50Earlier quoted context omitted.
The rainbow table would just need to include alphanumeric letters + '@' for up to 30 letters. I think your emails are in nearly every rainbow table in existence.
Just the 1-10 character lowercase alphanumeric rainbow table from freerainbowtables.com is 297 GB. Of course, you can generate rainbow tables with various parameters and tradeoffs so it's not trivial to compare them. Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?
Using MD5 means that CPU/GPU is cheaper/easier than a rainbow table. Or you can use both. Generate 33.1B hashes/s and start with a rainbow table.