6 ms·

Swedes uncover Disqus user security breach

71 points by aburan28 11y ago

perryh2 11y ago
This is from 2013. Please mention this in the title.
deleted 11y ago
[deleted]
cm2187 11y ago
These idiots seem to suggest that leaking the MD5 of an email isn't leaking the email itself. I wonder if 3 years later they are still that incompetent. Might be old news but I missed it in 2013, and I would have never used Disqus since if I didn't.
- bentlegen 11y ago
  From the article: > Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.
dan1234 11y ago
> He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms. Does this mean that other services using Gravatar are also leaking in this way?
- m_eiman 11y ago
  Yes. Docs here: http://sv.gravatar.com/site/implement/hash/ http://sv.gravatar.com/site/implement/hash/
- bentlegen 11y ago
  Specifically, the vulnerability discussed was Disqus's use of Gravatar. The "MD5 hash" provided by their API was strictly used to construct a Gravatar URL.
- foxhop 11y ago
  Yes, this is how Gravatar works.
eadz 11y ago
Gravatar should stop their support for unsalted MD5 hashes. It's just too insecure when most people don't understand the implications of sharing a MD5 hash of a user's email.
- koolba 11y ago
  The only way something like Gravatar works is by having something that's directly computable from the source email address (or whatever the identifying field is). Whether it's a MD5, SHA256, or whatever is irrelevant. Similarly having it be a salted (instead of the currently unsalted) hash wouldn't help anything. The salt would need to be public for separate web sites to reference the same avatar for the same email address. Short of authenticated requests to Gravatar (which again kills the point of how it all works), one alternative would be to make the computation function more expensive, either by performing multiple rounds of the hash function or switching to a "slow" hash function (ex: bcrypt or scrypt). The latter would require a fixed salt and wouldn't really work for the use case as it'd slow down any webpage that links to multiple gravatars to a crawl. The real issue here is that the email address space is fairly predictable. If you want HASH($EMAIL) to be unpredictable then instead of first.last@example.com switch to ~ [a-z0-9]{16}\@example\.com.
  - ikeboy 11y ago
    They need to provide avatar, given hash, i.e. implement a public getavatar(emailhash) function. They don't need to provide hash given account, i.e. getemailhash(comment). If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.
staticelf 11y ago
Worth noting is that "Researchgruppen" or "The research group" is an extremist left-wing group that exposes normal folks and have ties to people that threaten and use violence against people with different opinion than theirs. Also worth noting is that the Sweden Democrats is not at all far-right, it is more like a conservative social party. More left than right for example. It is also today one of the biggest parties in Sweden and will most likely grow to be the biggest soon. Researchgruppen are part of the politically correct elite in Sweden, supported by basically mainstream media which is most likely the worst in the world when it comes to being objective which this articles just proves. For people interested, the major news paper bought this information from "Researchgruppen" in order to seek, follow and harass everyday citizens and put their faces on the front pages telling the country they are racists. Sure maybe some were technically writing racists comments online, but the gestapo-moves from the news organizations in Sweden is just one of the many harassments you'll recieve if you have any critique what so ever against the large immigration numbers. They have used several illegal actions (credit checks for example) in order to find information on the people they were harassing. The people who got their faces put at the front pages did not get any chance to defend themselves or even tell their story. This is also old news in Sweden.
- geon 11y ago
  The Sweden Democrats have an openly fascist agenda. Several high officials have stated that they want to abolish freedom-of-press. Hardly "conservative social".
- samuellb 11y ago
  Now that you're editing your comment while I'm writing this, it's a bit hard to comment. I agree with you to 100% that we should have anonymity online, and that the media supporting data breaches of personal data is a bad thing. BUT I think what you write/wrote about "pk media", "mainstream media" and "immigration" is totally irrelevant to this post and HN in general. I have to say, for the non-Swedes here, that your view are _definitely not_ the common view that Swedes have. While the media is biased sometimes I would actually say that it's the people who are against immigration and have ran out of arguments to justify their case, who use this "argument" to deny facts. Sorry to be harsh but please find some real arguments why the media is not objective.
gpvos 11y ago
(2013)
deleted 11y ago
[deleted]
foxhop 11y ago
I'm bootstrapping a Disqus "clone" that I plan to open source and offer hosted versions as a SaaS company. I'm still building the MVP but I have a demo running here: http://www.remarkbox.com http://www.remarkbox.com I've taken special care to not hash user emails when generating avatars. In addition by default: * users are anonymous * Gravatar is disabled For default avatars I plan to fork https://github.com/Bekt/invatar https://github.com/Bekt/invatar (to add image caching)
- ShinyCyril 11y ago
  This looks nice – I've been using [Isso](https://posativ.org/isso/ https://posativ.org/isso/) for the past year or so.
  - foxhop 11y ago
    cool, never knew that existed.
_jomo 11y ago
This is a bad article and what it claims is just wrong: > the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts What they received were Gravatar URLs which include the MD5 hash of the senders email address. Obviously you can scrape the web and find more avatars with a matching email address hash and start mapping them to the same author. You can also try brute forcing the hash to find the original address, but all that is not a Disqus security breach. It's scraping public websites, maybe one could call it social engineering, but after all it's a targeted attack and no flaw in Disqus. There is of course something wrong with making email hashes public through avatar URLs, but that's all Gravatar's fault. Many people probably want to see Gravatar support on the websites they use, and it's also very easy to implement by developers. It's pretty much a monopoly and they're the only ones to fix it.

71 points by aburan28 11y ago

perryh2 11y ago

This is from 2013. Please mention this in the title.

deleted 11y ago

[deleted]

cm2187 11y ago

These idiots seem to suggest that leaking the MD5 of an email isn't leaking the email itself. I wonder if 3 years later they are still that incompetent. Might be old news but I missed it in 2013, and I would have never used Disqus since if I didn't.

bentlegen 11y ago
From the article: > Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.

dan1234 11y ago

> He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms. Does this mean that other services using Gravatar are also leaking in this way?

m_eiman 11y ago
Yes. Docs here: http://sv.gravatar.com/site/implement/hash/ http://sv.gravatar.com/site/implement/hash/
bentlegen 11y ago
Specifically, the vulnerability discussed was Disqus's use of Gravatar. The "MD5 hash" provided by their API was strictly used to construct a Gravatar URL.
foxhop 11y ago
Yes, this is how Gravatar works.

eadz 11y ago

Gravatar should stop their support for unsalted MD5 hashes. It's just too insecure when most people don't understand the implications of sharing a MD5 hash of a user's email.

koolba 11y ago
The only way something like Gravatar works is by having something that's directly computable from the source email address (or whatever the identifying field is). Whether it's a MD5, SHA256, or whatever is irrelevant. Similarly having it be a salted (instead of the currently unsalted) hash wouldn't help anything. The salt would need to be public for separate web sites to reference the same avatar for the same email address. Short of authenticated requests to Gravatar (which again kills the point of how it all works), one alternative would be to make the computation function more expensive, either by performing multiple rounds of the hash function or switching to a "slow" hash function (ex: bcrypt or scrypt). The latter would require a fixed salt and wouldn't really work for the use case as it'd slow down any webpage that links to multiple gravatars to a crawl. The real issue here is that the email address space is fairly predictable. If you want HASH($EMAIL) to be unpredictable then instead of first.last@example.com switch to ~ [a-z0-9]{16}\@example\.com.
- ikeboy 11y ago
  They need to provide avatar, given hash, i.e. implement a public getavatar(emailhash) function. They don't need to provide hash given account, i.e. getemailhash(comment). If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.

staticelf 11y ago

Worth noting is that "Researchgruppen" or "The research group" is an extremist left-wing group that exposes normal folks and have ties to people that threaten and use violence against people with different opinion than theirs. Also worth noting is that the Sweden Democrats is not at all far-right, it is more like a conservative social party. More left than right for example. It is also today one of the biggest parties in Sweden and will most likely grow to be the biggest soon. Researchgruppen are part of the politically correct elite in Sweden, supported by basically mainstream media which is most likely the worst in the world when it comes to being objective which this articles just proves. For people interested, the major news paper bought this information from "Researchgruppen" in order to seek, follow and harass everyday citizens and put their faces on the front pages telling the country they are racists. Sure maybe some were technically writing racists comments online, but the gestapo-moves from the news organizations in Sweden is just one of the many harassments you'll recieve if you have any critique what so ever against the large immigration numbers. They have used several illegal actions (credit checks for example) in order to find information on the people they were harassing. The people who got their faces put at the front pages did not get any chance to defend themselves or even tell their story. This is also old news in Sweden.

geon 11y ago
The Sweden Democrats have an openly fascist agenda. Several high officials have stated that they want to abolish freedom-of-press. Hardly "conservative social".
samuellb 11y ago
Now that you're editing your comment while I'm writing this, it's a bit hard to comment. I agree with you to 100% that we should have anonymity online, and that the media supporting data breaches of personal data is a bad thing. BUT I think what you write/wrote about "pk media", "mainstream media" and "immigration" is totally irrelevant to this post and HN in general. I have to say, for the non-Swedes here, that your view are _definitely not_ the common view that Swedes have. While the media is biased sometimes I would actually say that it's the people who are against immigration and have ran out of arguments to justify their case, who use this "argument" to deny facts. Sorry to be harsh but please find some real arguments why the media is not objective.

gpvos 11y ago

(2013)

deleted 11y ago

[deleted]

foxhop 11y ago

I'm bootstrapping a Disqus "clone" that I plan to open source and offer hosted versions as a SaaS company. I'm still building the MVP but I have a demo running here: http://www.remarkbox.com http://www.remarkbox.com I've taken special care to not hash user emails when generating avatars. In addition by default: * users are anonymous * Gravatar is disabled For default avatars I plan to fork https://github.com/Bekt/invatar https://github.com/Bekt/invatar (to add image caching)

ShinyCyril 11y ago
This looks nice – I've been using [Isso](https://posativ.org/isso/ https://posativ.org/isso/) for the past year or so.
- foxhop 11y ago
  cool, never knew that existed.

_jomo 11y ago

This is a bad article and what it claims is just wrong: > the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts What they received were Gravatar URLs which include the MD5 hash of the senders email address. Obviously you can scrape the web and find more avatars with a matching email address hash and start mapping them to the same author. You can also try brute forcing the hash to find the original address, but all that is not a Disqus security breach. It's scraping public websites, maybe one could call it social engineering, but after all it's a targeted attack and no flaw in Disqus. There is of course something wrong with making email hashes public through avatar URLs, but that's all Gravatar's fault. Many people probably want to see Gravatar support on the websites they use, and it's also very easy to implement by developers. It's pretty much a monopoly and they're the only ones to fix it.