Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: md5('240610708') == md5('QNKCDZO')

3v4l.org

Post reply on HN
Print view View original

61–70 of 185 posts

Re: PHP: md5('240610708') == md5('QNKCDZO')

#61

Post by userbinator »

masklinn wrote: post #50
VMG wrote: post #40

Earlier quoted context omitted.

Same goes for the `0E` prefix with an uppercase E The likelihood of generating a hash value with that kind of prefix is 2 in 65536. Finding a collision `hash(a) == hash(b)` with this "weak" equality comparison is approximately 1 in 256 if I'm not mistaken.

> The likelihood of generating a hash value with that kind of prefix is 2 in 65536. The prefix is not sufficient though, the suffix must be entirely decimal otherwise it's not a valid number in scientific notation.

Which means the probability of generating a hash value of the form 0[eE][0-9]{30} is (1/128)(10/16)^30 or 5.9e-9.

It certainly reduces the strength of the hash (and MD5 shouldn't be used anymore in any case), but still a roughly 6 in a billion chance of someone choosing e.g. a password and it happening to be exploitable in this manner.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#63

Post by tragomaskhalos »

shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

There are a couple of things we have learnt in our collective 50+ years of software engineering:

1. Code is not English: Nice try COBOL, and someone had to try, but a failed experiment. Bizarre holdouts: SQL

2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly. Bizarre holdouts: PHP, Javascript. Honourable mention: Excel (no Excel, that is not a f&@cking date, I will tell you if I want a date).

Re: PHP: md5('240610708') == md5('QNKCDZO')

#64

Post by TeMPOraL »

Meekro wrote: post #5

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

> They were put in so that things would behave the way a novice expects them to (3 == '3')

It's a very wrong approach. It may look like newbie-friendly, but in fact it makes it much harder to learn and use. Any novice will be constantly attempting to form a mental model of what's going on and how the language interprets concepts. Refusing to do things like 3 == '3' is simple and makes sense. Assuming a programmer is an idiot and trying to outguess his mistakes makes the language so complicated, that the novice will not be able to form a coherent model and will most likely assume that "this thing is magic".

Re: PHP: md5('240610708') == md5('QNKCDZO')

#65

Post by imakesnowflakes »

vog wrote: post #41

As a rough generalization, all PHP code that involves "==" and "!=" should be considered broken. PHP introduced "===" and "!==" a long time ago, and every programmer should know that they have to use that, without any excuses. Also, don't use "in_array($a, $b)", but use "in_array($a, $b, true)" instead.

>without any excuses...

Oh yea? How about this,

http://www.reddit.com/r/PHP/comments/2zhg6z/how_true_is_this...

Re: PHP: md5('240610708') == md5('QNKCDZO')

#66

Post by TeMPOraL »

tragomaskhalos wrote: post #63
shubhamjain wrote: post #14

PHP's type coercion is nothing like I have every seen in any other language. Its horrendously messy, ugly and completely inexcusable. Strings type-casted to integers are 0. Seriously? Take a look at this, > $arr = array(0, "was", "invented", "in", "india"); > var_dump( in_array("Hello", $arr ) ); and yeah it is TRUE because "Hello" got coerced to 0. I blogged about a major bug, I faced, in PHP, where column name "10t…

There are a couple of things we have learnt in our collective 50+ years of software engineering: 1. Code is not English: Nice try COBOL, and someone had to try, but a failed experiment. Bizarre holdouts: SQL 2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly. Bizarre holdouts: PHP, Javascript.…

> 2. People are not idiots, and will not collapse into a gibbering heap if their programming language insists that 0 and "0" are different things and must be managed accordingly.

This. People are not idiots, they're learning. By making your language assume programmer is an idiot you're making it more difficult for said programmer to form a coherent mental model of what's going on.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#67

Post by rimantas »

DoubleMalt wrote: post #54
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

Yeah, documentation is for pussies.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#68

Post by sarciszewski »

DoubleMalt wrote: post #54
dietrichepp wrote: post #6

I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…

Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.

> I used an MD5 hash as session id

> Never used PHP for anything important since.

The problem here isn't PHP, the problem here is you.

Re: PHP: md5('240610708') == md5('QNKCDZO')

#69

Post by tellor »

This is well-known PHP-trick. Use === to right result.

  php > var_dump(md5('240610708') == md5('QNKCDZO'));
  bool(true)
  php > var_dump(md5('240610708'),   md5('QNKCDZO'));                                                                                                                                                    
  string(32) "0e462097431906509019562988736854"
  string(32) "0e830400451993494058024219903391"
  php > var_dump(md5('240610708') ===   md5('QNKCDZO'));                                                                                                                                                 
  bool(false)
  php > var_dump("0e462097431906509019562988736854" == "0e830400451993494058024219903391");
  bool(true)
  php > var_dump("0e462097431906509019562988736854" === "0e830400451993494058024219903391");
  bool(false)
  php > var_dump(md5('240610708') ===   md5('QNKCDZO'));                                                                                                                                                 
  bool(false)
  php > var_dump(md5('240610708') ==   md5('QNKCDZO'));                                                                                       
  bool(true)
  php > var_dump(md5('240610708') === md5('QNKCDZO'));
  bool(false)

Re: PHP: md5('240610708') == md5('QNKCDZO')

#70

Post by sarciszewski »

Meekro wrote: post #5

PHP's == has a lot of oddball effects. They were put in so that things would behave the way a novice expects them to (3 == '3') but would confuse more experienced programmers, or those coming from other languages. Unless you're deliberately taking advantage of automatic type conversion and whatnot, you should probably use === by default.

And in C we can do this to get TRUE:

    return (33 == '3');
:P
Post reply on HN