4 ms·

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anyth

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.

rasur 11y ago
> MD5 is is broken and should not be used for anything anymore. With the possible exception of demonstrating brokenness in hashing algorithms ;) (Sorry, couldn't resist!)
nsgi 11y ago
What about Gravatar?
- dchest 11y ago
  Of course, you'll have to use whatever the third-party API uses, which includes Gravatar, but don't use it for anything under your control. Replace with: - BLAKE2 if you need a fast cryptographic hash function (e.g. for hashing file contents) - SHA512 (or SHA256, or SHA-3) if you want a standard cryptographic hash function that is available in your programming language libraries (Speaking of Gravatar, their use of md5(email) or even more secure hash function won't help protect email addresses against dedicated attackers, as it's easy to iterate over billions of them in seconds, just like in the stories about password cracking you hear, but it works as a simple anti-spam measure.)
- Sir_Substance 11y ago
  Please just stop using it? It's the feature no one asked for.
  - scrollaway 11y ago
    I am not a very important person but I certainly ask for it, and I'd like you to stop discarding me and my "kind" as "no one".
    - hobs 11y ago
      Do you ask for that with the awareness that gravatar then gets to track your presence around the internet for the cost of a tiny picture? I would rather have less ad tracking pixels on someone elses websites if possible, but I am genuinely interested in the value that gravatar provides to people who like the service.
      - scrollaway 11y ago
        There's a lot of things that can track presence around the web and gravatar's not one of them. Iff you decide to implement gravatar without mirroring their images, avatars are indeed loaded on their first query (and not subsequent ones) and, god knows what they're doing with that information ohgod. They certainly can't "track my presence around the web", though - no js means no fingerprinting, no tracking cookie, nothing. Juuuust a blind IP address. But the recommended way is to prefetch the avatars directly from your server and offer them on your own cdn. As for the value it provides, well for one thing I pretty much never have to upload my avatar to websites anymore - it's an avatar attached to my email addresses instead and that's very nice. Of course I'd prefer a proper identity protocol but nobody's working on one. If you want to, be my guest...
        hobs 11y ago
        I think we disagree on one basic topic, I dont want an easily distinguishable identity to track across the internet. I would rather external actors (say gravatar does nothing wrong) not be able to identify which email address I use on a site they do not own, and not be able to track my user signups by something that might be public information, which generally a site does not advertise. It just feels wrong.
        scrollaway 11y ago
        Unlike every actual tracker on the internet, Gravatar is opt-in. Things like google analytics, facebook like button/tweet button etc, they are all opt-out.
strayptr 11y ago
MD5 is is broken and should not be used for anything anymore. Actually, HMAC-MD5 is secure.
- scott_karana 11y ago
  It's a stretch to say it's "secure". Yes, there aren't any known attacks right now, but since MD5 itself already has practical collision attacks against it, there isn't any good reason to use HMAC-MD5 in a new cryptosystem when there are better alternatives. --- Supporting evidence: new versions of OpenSSHD do not use HMAC-MD5 by default anymore: it has to be enabled manually. The default is: umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, umac-64@openssh.com,umac-128@openssh.com, hmac-sha2-256,hmac-sha2-512 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/sshd_config.5?query=sshd_config http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/...

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.

rasur 11y ago

> MD5 is is broken and should not be used for anything anymore. With the possible exception of demonstrating brokenness in hashing algorithms ;) (Sorry, couldn't resist!)

nsgi 11y ago

What about Gravatar?

dchest 11y ago
Of course, you'll have to use whatever the third-party API uses, which includes Gravatar, but don't use it for anything under your control. Replace with: - BLAKE2 if you need a fast cryptographic hash function (e.g. for hashing file contents) - SHA512 (or SHA256, or SHA-3) if you want a standard cryptographic hash function that is available in your programming language libraries (Speaking of Gravatar, their use of md5(email) or even more secure hash function won't help protect email addresses against dedicated attackers, as it's easy to iterate over billions of them in seconds, just like in the stories about password cracking you hear, but it works as a simple anti-spam measure.)
Sir_Substance 11y ago
Please just stop using it? It's the feature no one asked for.
- scrollaway 11y ago
  I am not a very important person but I certainly ask for it, and I'd like you to stop discarding me and my "kind" as "no one".
  - hobs 11y ago
    Do you ask for that with the awareness that gravatar then gets to track your presence around the internet for the cost of a tiny picture? I would rather have less ad tracking pixels on someone elses websites if possible, but I am genuinely interested in the value that gravatar provides to people who like the service.
    - scrollaway 11y ago
      There's a lot of things that can track presence around the web and gravatar's not one of them. Iff you decide to implement gravatar without mirroring their images, avatars are indeed loaded on their first query (and not subsequent ones) and, god knows what they're doing with that information ohgod. They certainly can't "track my presence around the web", though - no js means no fingerprinting, no tracking cookie, nothing. Juuuust a blind IP address. But the recommended way is to prefetch the avatars directly from your server and offer them on your own cdn. As for the value it provides, well for one thing I pretty much never have to upload my avatar to websites anymore - it's an avatar attached to my email addresses instead and that's very nice. Of course I'd prefer a proper identity protocol but nobody's working on one. If you want to, be my guest...
      - hobs 11y ago
        I think we disagree on one basic topic, I dont want an easily distinguishable identity to track across the internet. I would rather external actors (say gravatar does nothing wrong) not be able to identify which email address I use on a site they do not own, and not be able to track my user signups by something that might be public information, which generally a site does not advertise. It just feels wrong.
        scrollaway 11y ago
        Unlike every actual tracker on the internet, Gravatar is opt-in. Things like google analytics, facebook like button/tweet button etc, they are all opt-out.

strayptr 11y ago

MD5 is is broken and should not be used for anything anymore. Actually, HMAC-MD5 is secure.

scott_karana 11y ago
It's a stretch to say it's "secure". Yes, there aren't any known attacks right now, but since MD5 itself already has practical collision attacks against it, there isn't any good reason to use HMAC-MD5 in a new cryptosystem when there are better alternatives. --- Supporting evidence: new versions of OpenSSHD do not use HMAC-MD5 by default anymore: it has to be enabled manually. The default is: umac-64-etm@openssh.com,umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com, umac-64@openssh.com,umac-128@openssh.com, hmac-sha2-256,hmac-sha2-512 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/sshd_config.5?query=sshd_config http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/...