Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disqus cracked – Security flaw reveals users’ e-mail addresses

cornucopia-en.cornubot.se

Post reply on HN
Print view View original

31–40 of 92 posts

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#31

Post by gabriel34 »

eterm wrote: post #29

Surely any hashing would be susceptible? Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made. Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still…

you could salt the hash twice. One (large) you store the other you throw away. This way to compromise a specific account you would have to steal it's stored hash. If there was a leak of the hashes you would need to bruteforce all the hashes which were thrown away

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#32

Post by pathy »

f055 wrote: post #25
pathy wrote: post #21

Earlier quoted context omitted.

It gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism. The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.

Yeah well, the person has himself to blame. Either be identifiable or anonymous. Don't use private email and expect to be untraceable. That's just mad.

At least some of the emails weren't even private. I saw an example of one of the politicians who got their identity 'leaked'. The email she used for the Disqus comments was listed on her official municipality contact page.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#33

Post by jessaustin »

eterm wrote: post #29

Surely any hashing would be susceptible? Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made. Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still…

In general, what you're asking about is called a "salted hash". I don't understand enough about Disqus's system to say it would definitely have prevented this vulnerability.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#34

Post by RyanZAG »

eterm wrote: post #29

Surely any hashing would be susceptible? Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made. Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still…

It's possible to prevent this. Disquis could create a service limited to their network that could store a unique id for each registered email address and hashed with the email, or used instead of the hash. This obviously adds additional computation, latency and storage to their system though so it's far from free but it is definitely possible to prevent this type of hash lookup.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#35

Post by jessaustin »

Asdfjgori wrote: post #30
gabriel34 wrote: post #24

Earlier quoted context omitted.

Even better, you can be certain a great number of users reuse their password

True. A percentage of the union of Adobe and Disqus users will use the same password for both services.

But if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#37

Post by Asdfjgori »

jessaustin wrote: post #35
Asdfjgori wrote: post #30

Earlier quoted context omitted.

True. A percentage of the union of Adobe and Disqus users will use the same password for both services.

But if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?

You don't want to try 150 million Adobe logins on Disqus. You want to identify which ones to test first.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#38

Post by aparadja »

Jakob wrote: post #19
hrrsn wrote: post #14

Earlier quoted context omitted.

My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing. (of course, my real name can be extrapolated from my HN username)

The rainbow table would just need to include alphanumeric letters + '@' for up to 30 letters. I think your emails are in nearly every rainbow table in existence.

Just the 1-10 character lowercase alphanumeric rainbow table from freerainbowtables.com is 297 GB. Of course, you can generate rainbow tables with various parameters and tradeoffs so it's not trivial to compare them.

Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#39

Post by patio11 »

hrrsn wrote: post #14
Sae5waip wrote: post #11

Earlier quoted context omitted.

Actually, yeah, it will be cracked, by someone . And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.

My email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing. (of course, my real name can be extrapolated from my HN username)

Given 10^6 possible first names (that's really generous but, hey, I like my dictionaries to be cosmopolitan in character) and 10^6 domains (again, generous) exhaustive search takes 10^12 hashes. My laptop can do 10^7 in a second. This means you have about 10^5 seconds until your email is broken given that the MD5 hash is divulged. That's plus or minus three hours.

Your call on whether "An adversary can only defeat my security given three hours and a hardware investment of $1,600 2010 dollars" is an acceptable security bound for your users. If it isn't, don't use MD5 for crypto purposes.

Post reply on HN