Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disqus cracked – Security flaw reveals users’ e-mail addresses

cornucopia-en.cornubot.se

Post reply on HN
Print view View original

21–30 of 92 posts

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#21

Post by pathy »

f055 wrote: post #17

I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.

It gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism.

The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#22

Post by iamabhishek »

f055 wrote: post #17

I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.

you are absolutely right, we have public email addresses, and also the spam filters. But then still, information needs to be protected. There are people who dont want their email addresses public or in some list which is being sold over and over again to marketing companies which then flood your inbox with spams. It is irritating at times even if there's spam filters.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#23

Post by cubehouse »

MD5 hashes of emails is very common practice for Gravatar etc. - although it's fairly sucky, I'm assuming this is in the API specifically for things like showing Gravatar images.

I reported a username -> plaintext email vuln to Disqus earlier this year and they were very prompt in patching it, I wouldn't criticize them for this at all as this a very common issue across most blog comment systems.

Would be nice to change how Gravatar works, but it's fairly fundamental. I think if you want your email to be private you should probably be registering temporary ones or using the + aliases like gmail offers to avoid these kinds of hash-cracking attacks.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#25

Post by f055 »

pathy wrote: post #21
f055 wrote: post #17

I don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.

It gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism. The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.

Yeah well, the person has himself to blame. Either be identifiable or anonymous. Don't use private email and expect to be untraceable. That's just mad.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#26

Post by gabriel34 »

So, what would suffice to maintain anonymity AND the ability to send the user email notifications?

I'm guessing Hashing (not MD5 though) + Salting + throwing away the salt and bruteforcing it every time you need the plain email (you will lose the option to mass mail your users)

Even then the whole concept of anonymity AND email bound account seems kind of silly. Even if the user uses a secondary email address just for this, he still has to trust the email provider (and if he uses a throwaway, what is the point of collecting it anyway?)

This crack is proof that services that provide a fake sense of anonymity can do a lot of harm.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#27

Post by nkuttler »

subsystem wrote: post #15
dutchbrit wrote: post #8

Old olllddd news, almost every Wordpress blog uses Gravatar, same issue...

So why do you feel compelled to post when you know what you are saying is old news? You just adds to the noise and make it off putting for anyone else to post that actually knows about this event including your obvious point.

Now I'm confused.. why do you feel compelled to reply? You just add to the noise.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#28

Post by timbro »

f055 wrote: post #25
pathy wrote: post #21

Earlier quoted context omitted.

It gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism. The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.

Yeah well, the person has himself to blame. Either be identifiable or anonymous. Don't use private email and expect to be untraceable. That's just mad.

That's the point.

95% of the population has absolutely no clue about how technology works and how it will be used against them, sooner or later.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#29

Post by eterm »

Surely any hashing would be susceptible?

Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made.

Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still be a "large" set in a real world sense.)

As long as the hashing algorithm is known then it would be weak to finding comments made by known authors. If the hashing algorithm is unknown then it falls under security by obscurity.

So is there any way to implement a decentralised pseudonymous but ID-based system where the ID is tied to email but cannot be generated from email (or rather is generated from email but with some added entropy that prevents going in either direction in the future.).

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#30

Post by Asdfjgori »

gabriel34 wrote: post #24
Asdfjgori wrote: post #9

Get 150 million e-mail addresses from Adobe hack. Match vs Disqus users. Profit.

Even better, you can be certain a great number of users reuse their password

True. A percentage of the union of Adobe and Disqus users will use the same password for both services.
Post reply on HN