Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disqus cracked – Security flaw reveals users’ e-mail addresses

cornucopia-en.cornubot.se

Post reply on HN
Print view View original

81–90 of 92 posts

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#81

Post by gamblor956 »

draugadrotten wrote: post #45

If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope…

The difference is that in Europe, free speech is not as expansive as it is in the U.S. Hate speech is defined more broadly east of the pond, and is generally a crime in itself in many European nations. In contrast, in the U.S. only hateful acts are crimes (speech itself is not enough), though hate speech can be a a tort (a private action, i.e., for emotional distress).

The crack was done in cooperation with the Bonnier Group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites.

Exposing politicians is a time honored practice in all countries and across all ideologies. It's possible that the hacking is still a crime in Sweden, regardless of the motives. No one is defending it--you seem to have done that on your own, as the linked article certainly does not.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#82

Post by pyre »

robomartin wrote: post #77
knowtheory wrote: post #71

Earlier quoted context omitted.

Being born into a jewish family isn't a choice. Being gay isn't a choice. Being politically affiliated with hate speech IS a choice. That is some straight up false equivalency bullshit.

The British probably thought those behind the movement that ultimately resulted in the United States were engaging in hate speech. Be careful not to use a tinted lens to evaluate the world. We all do it. I am not critical of your statement. I am merely pointing out that dissenting points of view throughout history have often met with push-back. Very often, years later, those responsible for the "hate speech" were rec…

> Being Jewish is a choice

Do you think that proponents of Neo-Nazism (etc) really care about the distinction between "born into a Jewish family" and "is a member of the Jewish religion?" I'm not saying that there isn't a distinction, but people engaged in hate usually aren't too interested in nuance.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#83

Post by bzbarsky »

knowtheory wrote: post #71
draugadrotten wrote: post #45

If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope…

Being born into a jewish family isn't a choice. Being gay isn't a choice. Being politically affiliated with hate speech IS a choice. That is some straight up false equivalency bullshit.

> Being born into a jewish family isn't a choice.

The normal US point of view is that "Jewish" is a religion, not an ethnicity, hence is a choice.

That point of view is not universally shared, of course.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#84

Post by drone »

knowtheory wrote: post #71
draugadrotten wrote: post #45

If a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope…

Being born into a jewish family isn't a choice. Being gay isn't a choice. Being politically affiliated with hate speech IS a choice. That is some straight up false equivalency bullshit.

Hate speech is just the speech that the majority has determined that they don't want to hear, and clearly, in some countries, are willing to exercise state violence upon those who commit it.

The problem with making speech legal or illegal based on popular opinion of it, is that one IS perfectly capable of engaging in hate speech without choosing to do so. What happens when what I said online two years ago becomes hate speech tomorrow? Do I need to make sure I go scrub all of my past speech before anyone finds out and sends me to jail?

Furthermore, one "chooses" their future course, and whether they want to self-identify with one group more than another. To claim otherwise is to deny any semblance of free will. I know many people who choose to identify with the gay community that aren't gay, and many who choose to NOT identify with the gay community who are gay.

False equivalency rains down wonderfully on the head of a man imprisoned for speaking his mind. You can tell him all day how he chose to be in jail.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#85

Post by darkarmani »

tedunangst wrote: post #52
darkarmani wrote: post #47

Earlier quoted context omitted.

> I don't get it, if your email address is so private then why you share it with 3rd parties? How would you use it otherwise? My backyard is private, but I share it with a few 3rd parties. That doesn't mean i intent to share my backyard with the entire world. There is an element of trust with particular 3rd parties that is being violated. Why is that so hard to understand?

The address of your backyard is not private.

So what is the address of my backyard? Besides being an inane argument, how do you know it is not private?

Unless you run your own mail server, someone knows your email address, so are you trying to define that as not private? Obviously, we are using fuzzy terms about private/public when there is a huge gradient of privacy.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#86

Post by ddebernardy »

Sae5waip wrote: post #13
ddebernardy wrote: post #2

Yawn. A rainbow table can be used to determine str in MD5(str). News at 11…

The news is that Disqus is relying on that.

So does Automattic with gravatars (on nearly 20% of the internet, no less), and pray tell how many other companies that use md5(email) as a unique ID for a reason or another. Duh! What were they thinking!

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#87

Post by amckenna »

cubehouse wrote: post #23

MD5 hashes of emails is very common practice for Gravatar etc. - although it's fairly sucky, I'm assuming this is in the API specifically for things like showing Gravatar images. I reported a username -> plaintext email vuln to Disqus earlier this year and they were very prompt in patching it, I wouldn't criticize them for this at all as this a very common issue across most blog comment systems. Would be nice to chan…

Another solution would be for these services to use something with a greater work factor than MD5. When a typical user can brute force MD5s at a rate of 8.5 billion per second with AMD HD7970 graphics card then it's time to use a different hashing algorithm. Something like scrypt or bcrypt with a larger work factor would make these attacks much harder and more expensive, while leaving the fundamentals of the system the same.

http://hashcat.net/oclhashcat/ https://www.tarsnap.com/scrypt.html https://en.wikipedia.org/wiki/Bcrypt

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#88

Post by diminoten »

bzbarsky wrote: post #83
knowtheory wrote: post #71

Earlier quoted context omitted.

Being born into a jewish family isn't a choice. Being gay isn't a choice. Being politically affiliated with hate speech IS a choice. That is some straight up false equivalency bullshit.

> Being born into a jewish family isn't a choice. The normal US point of view is that "Jewish" is a religion, not an ethnicity, hence is a choice. That point of view is not universally shared, of course.

Can you provide your reasoning for saying this is the "normal" point of view?

A cursory search tells me nothing of much use.

Apropos of nothing, I found a Pew poll[0] that says... 21% of atheists believe in a god? Huh?

[0] - http://religions.pewforum.org/pdf/report2religious-landscape... ("Conception of God")

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#89

Post by robomartin »

pyre wrote: post #82
robomartin wrote: post #77

Earlier quoted context omitted.

The British probably thought those behind the movement that ultimately resulted in the United States were engaging in hate speech. Be careful not to use a tinted lens to evaluate the world. We all do it. I am not critical of your statement. I am merely pointing out that dissenting points of view throughout history have often met with push-back. Very often, years later, those responsible for the "hate speech" were rec…

> Being Jewish is a choice Do you think that proponents of Neo-Nazism (etc) really care about the distinction between "born into a Jewish family" and "is a member of the Jewish religion?" I'm not saying that there isn't a distinction, but people engaged in hate usually aren't too interested in nuance.

Probably not. But that's not what I was arguing. Right?

For every example we care to provide there's probably a deviant group more than willing to discriminate against that population and even want to kill them. I think the history of genocides more than proves that point.

Please don't be offended. Jews don't really have a monopoly on being hated or being murdered en-masse. Many argue --quite convincingly-- that the Jewish genocide was modeled after the Armenian genocide of 1914/15 (the Nazi's copied some of the methods the Turks used on their Armenian population).

In the US, at least, in non-deviant circles, I believe you can be a person and not someone "born into an family". In that context whatever you push in front of people as what defines you is up to you. Believe it or not, as an atheist I have a number of good friends who are Born Again Christians. Every single one of them is a great person. Each one of them chooses to define themselves by their religion differently. One in particular will smash you in the face with it every chance he gets. Not surprisingly he has suffered greatly with employment because, well, this isn't something you wear on your forehead and pester people with at work. The other guys are just guys who happen to privately be BAC's. He is a militant BAC. Choice.

Re: Disqus cracked – Security flaw reveals users’ e-mail addresses

#90

Post by bzbarsky »

diminoten wrote: post #88
bzbarsky wrote: post #83

Earlier quoted context omitted.

> Being born into a jewish family isn't a choice. The normal US point of view is that "Jewish" is a religion, not an ethnicity, hence is a choice. That point of view is not universally shared, of course.

Can you provide your reasoning for saying this is the "normal" point of view? A cursory search tells me nothing of much use. Apropos of nothing, I found a Pew poll[0] that says... 21% of atheists believe in a god? Huh? [0] - http://religions.pewforum.org/pdf/report2religious-landscape... ("Conception of God")

I don't have a citation, sorry, just a general perception of how the issue is typically addressed in conversation and the media...

And again, if you talk to people who self-identify as "Jewish", you get a rather more complex picture.

Post reply on HN