31–40 of 49 posts
Earlier quoted context omitted.
…or without installing anything: $ echo -n 'my@email' |openssl dgst -sha256 d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2
Or, with the cryptically named 'md5'... echo -n 'my@email' | md5
$ echo -n 'my@email' | shasum -a 256
d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2 -Fuck. What the fuck did I even need a Gawker account for? (Thanks for making this. I was going to download the torrent, but assumed that I did not ever visit their site, much less make an account. Wrong!)
I didn't know Gawker == LifeHacker, on which I have commented in the past.
Earlier quoted context omitted.
Or, with the cryptically named 'md5'... echo -n 'my@email' | md5
md5 != sha256 $ echo -n 'my@email' | shasum -a 256 d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2 -
MD5 is what's used in the linked spreadsheet's email address fields, which is what I thought we were talking about. SHA-256 is used in jedsmith's lists.
Earlier quoted context omitted.
md5 is a hash function, and hash functions are designed to have two properties: 1) they are hiding . You (theoretically) can't reverse the function by any method other than brute-force. 2) they are *binding. You (theoretically) can't find any other input that hashes to the same output by any method other than brute-force. Any tool that "decrypts" md5 hashes most likely does so by generating what is called a rainbow t…
Okay thank you for the explanation. Let me try and apply my rudimentary knowledge here... So a hash function is used to encrypt data by translating it with a certain rule set--I've learned about a simple key%b type function before. But with md5 this hashing function isn't the same each time a new code is created? How is the system able to decode it then? _Something_ out there has to know how to translate that back in…
Wrong. Password hashes are meant to be one-way and chosen specifically so that getting plaintext (readable string) from the ciphertext (hashed gibberish) is very hard. When you create an account, the plain text for your password is hashed and stored. When you want to subsequently login, the system only needs to use the exact same hashing steps and see if they produce an identical hash to the one stored.
Things are done this way specifically so that if a compromise such as the one at gawker happens, it is harder for the attacker to get people's actual passwords.
This is the primary difference between encryption, where you want to be able to recover the plaintext and hashing, where you want to make it very hard to recover the plaintext.
Fuck. What the fuck did I even need a Gawker account for? (Thanks for making this. I was going to download the torrent, but assumed that I did not ever visit their site, much less make an account. Wrong!)
I don't mean "trust that they won't compromise it" (though in this case it's a salted DES password -- on the gradient of exposures, this one isn't terribly high for anything but ultra-simple dictionary tests like password), I mean "trust anyone working at or for Gawker".
That's the point of these releases that really surprises me: People get paranoid because they use the same password everywhere...yet they provide every agent at every one of those places with their credentials and assume its safe.
What's the point of these tools that let you know whether Gawker's database held my email address? It's no secret that I have a Gawker account, and a Twitter account, and a Facebook account... What I would like to know is how likely it is that my password could be compromised. How were the passwords stored? Hashed? Salted and hashed?
What is the point of including the domain tied to the address? It just decreases the anonymity of what you've hashed, and actually does a disservice. There are corporate domains in there and the namespace of what to search for becomes a lot smaller. In addition, my domain is my name. I saw many others in the file that this was the case for. It's not a big leap to compute my e-mail from 'jedsmith.org', and I'm sure it…
What's the point of these tools that let you know whether Gawker's database held my email address? It's no secret that I have a Gawker account, and a Twitter account, and a Facebook account... What I would like to know is how likely it is that my password could be compromised. How were the passwords stored? Hashed? Salted and hashed?
Because some of us don't remember if we have an account on the site and might not be able to download a ~500mb torrent to verify if we do/did.
Earlier quoted context omitted.
Because some of us don't remember if we have an account on the site and might not be able to download a ~500mb torrent to verify if we do/did.
Just go to Gawker site and try the link "Forgot Password". If your email is not registered with Gawker, it will tell you the same.