11 ms·

In case you are looking for the important information, it seems to be MD5 hash without salt.

by ilarum 10y ago

chillydawg 10y ago
Bloody hell. Sloppy and incompetent.
- kuschku 10y ago
  [deleted]
  - scrollaway 10y ago
    It's really not. Unsalted MD5 has been shameful for a long, long time.
    - pluma 10y ago
      As a data point: when I was a teenage code monkey in 2004 writing PHP I already understood that unsalted MD5 is unsafe. According to Wikipedia: * 2004 it became possible to find MD5 collisions at a rate of one per hour on a cluster * 2005 it became possible to do this within "a few hours" on a consumer laptop * 2006 it became possible to do this within one minute * nowadays it's possible to do this "within seconds" Plus, as others have mentioned, it's now possible to find collisions instantly by using widely available rainbow tables, e.g. https://md5db.net/decrypt https://md5db.net/decrypt
      - yuhong 10y ago
        MD5 collisions are probably not important for passwords.
        funnyfacts365 10y ago
        Care to explain? The hashes are what is compared so it seems it's important.
        duskwuff 10y ago
        The existence of crafted collisions -- being able to create a pair of M1 and M2 such that MD5(M1) = MD5(M2) -- is primarily relevant to situations where MD5 is being used as a signature algorithm, such as in certificate issuance. In these applications, being able to generate a pair of documents with the same hash is catastrophic. Being able to generate a pair of passwords that are treated as equal, on the other hand, is useless from a security perspective. It's a neat party trick, but it's not dangerous. Now, if there were a preimage attack -- being able to take MD5(M1) and come up with a M2 such that MD5(M2) = MD5(M1) -- that'd be a much bigger deal, and it'd break MD5 password hashing wide open. But nobody's done that yet.
        rev_bird 10y ago
        I'm a total greenhorn when it comes to cryptography, but the difference between these two situations was totally lost on me until I read this comment. When I see, "It's easy to create MD5 collisions," my first thought is, "If you give me a hash, it's easy to find a string that results in an identical hash." If I'm understanding this right, that would be a "preimage attack," and would be bad for all the reasons being discussed in this thread. However, it seems like "It's easy to create MD5 collisions," at least as it is true today, actually means something different: That, given a string, it's easy to find a second string that shares the same hash. If that's the case, I have two questions: * I am totally lost as to how these are different scenarios. There's no difference I can see between "Here's string A" and "here's the hash of string A," if the goal is to find a "string B" that shares the hash. Are these "crafted collisions" generated by modifying string A and string B, until a collision pops out? * If that's the case... what's everyone freaking out about? Why were people saying MD5 is unsafe 20 years ago, if even now, we can't achieve a preimage attack that can get you into an account based on the valid password's hash? Yahoo could have printed these hashes out and hung them up on posters in the mall and no one would have been able to get into accounts from it. There are dozens of comments lamenting how stupid this was, but... it seems like there's no actual problem?
        user5994461 10y ago
        To put it in layman terms. The MD5 collisions attack usually done by researchers: They want to generate 2 files with the same MD5 hash (they can put anything they want in these files). This kind of attack doesn't affect passwords. The user picked one file (i.e. the password), you don't know it, you can't change it, you can't choose it.
      - Buge 10y ago
        That website does not find collisions. It uses rainbow tables (or some other type of table) to crack passwords that it already knows. Collisions are irrelevant for password cracking.
  - chillydawg 10y ago
    No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.
    - kuschku 10y ago
      Sure, it's borderline negligent. But it's already a godsend compared to what many banks do, storing passwords in plaintext, sending reset passwords via plaintext email, requiring 4-8 character passwords that can only contain digits and a limited set of characters, etc. I'd be more than happy if any bank would follow Yahoo!'s password standards.
      - Kadin 10y ago
        Most banks don't have a billion customers. (There are probably a few that do, but not many.)
  - camus2 10y ago
    > Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today. Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time. By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?
    - kuschku 10y ago
      > How can you come up with that argument in good faith ? Let's say I've seen far worse in 2016, from companies storing far more sensitive data. Like a bank, with no 2FA support, emailing me my plaintext password after clicking "Password forgotten", in 2016. This story is problematic, but I'd be grateful if that bank would implement even the same stuff as Yahoo.
    - normaljoe 10y ago
      > Furthermore I got no email from Yahoo telling me that my account may have been hacked Then your account was most likely not on the list of accounts compromised. > By the way I did some PHP dev back in 2011 Well Yahoo is a tad bit older then that, by about 17 years. This is not an excuse, but really comparing your 2011 coding to 1994.... Go ahead and boot up your old 486. I'll get back to you when this page loads up in an hour. :) Yahoo's code base is old and huge, like billions of lines huge. Yahoo's engineers have modernized it at a massively rapid pace. I'm not sure of current state, but when I left Yahoo finance was written in something like 10 languages including serving pages in C, cause that's all they had back then. Current tech is NodeJSish and others. They have their own hardened versions. But still migrating millions of lines of C to something other then C isn't a walk in the park.
- mtgx 10y ago
  Also malicious (allowing NSA to search through everyone's emails).
  - bpicolo 10y ago
    Current law seems to dictate that if the NSA wants that, it's what they're getting. Blame the government.
    - deleted 10y ago
      [deleted]
  - iopq 10y ago
    They actually fought in court about it, so I commend them for it
- dopamean 10y ago
  I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
  - bpicolo 10y ago
    I doubt that decision was made in the last decade. It's surely just something that's been around for a long time and was never upgraded. Still neglectful, but I sincerely doubt it was just a recent engineer's bad decision-making.
  - stanleydrew 10y ago
    Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
    - cm2187 10y ago
      But it's not like if we didn't have a pretty much continuous stream of major data leaks for the past 5 years. Surely yahoo engineers occasionally open a newspaper...
      - Endy 10y ago
        From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was going to discourage users from using Yahoo and send them over to GMail. Unfortunately... that argument wasn't wrong.
        10y ago
- MorePowerToYou 10y ago
  I think the organization as a whole is just indifferent. Does this breach really matter to Yahoo's bottom line? They were already sold to Verizon. Most of the active users probably won't read this news. It's sad to say, but I think Yahoo as a whole just doesn't care about their users.

In case you are looking for the important information, it seems to be MD5 hash without salt.

by ilarum 10y ago

In case you are looking for the important information, it seems to be MD5 hash without salt.

chillydawg 10y ago

Bloody hell. Sloppy and incompetent.

kuschku 10y ago
[deleted]
- scrollaway 10y ago
  It's really not. Unsalted MD5 has been shameful for a long, long time.
  - pluma 10y ago
    As a data point: when I was a teenage code monkey in 2004 writing PHP I already understood that unsalted MD5 is unsafe. According to Wikipedia: * 2004 it became possible to find MD5 collisions at a rate of one per hour on a cluster * 2005 it became possible to do this within "a few hours" on a consumer laptop * 2006 it became possible to do this within one minute * nowadays it's possible to do this "within seconds" Plus, as others have mentioned, it's now possible to find collisions instantly by using widely available rainbow tables, e.g. https://md5db.net/decrypt https://md5db.net/decrypt
    - yuhong 10y ago
      MD5 collisions are probably not important for passwords.
      - funnyfacts365 10y ago
        Care to explain? The hashes are what is compared so it seems it's important.
        duskwuff 10y ago
        The existence of crafted collisions -- being able to create a pair of M1 and M2 such that MD5(M1) = MD5(M2) -- is primarily relevant to situations where MD5 is being used as a signature algorithm, such as in certificate issuance. In these applications, being able to generate a pair of documents with the same hash is catastrophic. Being able to generate a pair of passwords that are treated as equal, on the other hand, is useless from a security perspective. It's a neat party trick, but it's not dangerous. Now, if there were a preimage attack -- being able to take MD5(M1) and come up with a M2 such that MD5(M2) = MD5(M1) -- that'd be a much bigger deal, and it'd break MD5 password hashing wide open. But nobody's done that yet.
        rev_bird 10y ago
        I'm a total greenhorn when it comes to cryptography, but the difference between these two situations was totally lost on me until I read this comment. When I see, "It's easy to create MD5 collisions," my first thought is, "If you give me a hash, it's easy to find a string that results in an identical hash." If I'm understanding this right, that would be a "preimage attack," and would be bad for all the reasons being discussed in this thread. However, it seems like "It's easy to create MD5 collisions," at least as it is true today, actually means something different: That, given a string, it's easy to find a second string that shares the same hash. If that's the case, I have two questions: * I am totally lost as to how these are different scenarios. There's no difference I can see between "Here's string A" and "here's the hash of string A," if the goal is to find a "string B" that shares the hash. Are these "crafted collisions" generated by modifying string A and string B, until a collision pops out? * If that's the case... what's everyone freaking out about? Why were people saying MD5 is unsafe 20 years ago, if even now, we can't achieve a preimage attack that can get you into an account based on the valid password's hash? Yahoo could have printed these hashes out and hung them up on posters in the mall and no one would have been able to get into accounts from it. There are dozens of comments lamenting how stupid this was, but... it seems like there's no actual problem?
      - user5994461 10y ago
        To put it in layman terms. The MD5 collisions attack usually done by researchers: They want to generate 2 files with the same MD5 hash (they can put anything they want in these files). This kind of attack doesn't affect passwords. The user picked one file (i.e. the password), you don't know it, you can't change it, you can't choose it.
    - Buge 10y ago
      That website does not find collisions. It uses rainbow tables (or some other type of table) to crack passwords that it already knows. Collisions are irrelevant for password cracking.
- chillydawg 10y ago
  No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.
  - kuschku 10y ago
    Sure, it's borderline negligent. But it's already a godsend compared to what many banks do, storing passwords in plaintext, sending reset passwords via plaintext email, requiring 4-8 character passwords that can only contain digits and a limited set of characters, etc. I'd be more than happy if any bank would follow Yahoo!'s password standards.
    - Kadin 10y ago
      Most banks don't have a billion customers. (There are probably a few that do, but not many.)
- camus2 10y ago
  > Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today. Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time. By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?
  - kuschku 10y ago
    > How can you come up with that argument in good faith ? Let's say I've seen far worse in 2016, from companies storing far more sensitive data. Like a bank, with no 2FA support, emailing me my plaintext password after clicking "Password forgotten", in 2016. This story is problematic, but I'd be grateful if that bank would implement even the same stuff as Yahoo.
  - normaljoe 10y ago
    > Furthermore I got no email from Yahoo telling me that my account may have been hacked Then your account was most likely not on the list of accounts compromised. > By the way I did some PHP dev back in 2011 Well Yahoo is a tad bit older then that, by about 17 years. This is not an excuse, but really comparing your 2011 coding to 1994.... Go ahead and boot up your old 486. I'll get back to you when this page loads up in an hour. :) Yahoo's code base is old and huge, like billions of lines huge. Yahoo's engineers have modernized it at a massively rapid pace. I'm not sure of current state, but when I left Yahoo finance was written in something like 10 languages including serving pages in C, cause that's all they had back then. Current tech is NodeJSish and others. They have their own hardened versions. But still migrating millions of lines of C to something other then C isn't a walk in the park.
mtgx 10y ago
Also malicious (allowing NSA to search through everyone's emails).
- bpicolo 10y ago
  Current law seems to dictate that if the NSA wants that, it's what they're getting. Blame the government.
  - deleted 10y ago
    [deleted]
- iopq 10y ago
  They actually fought in court about it, so I commend them for it
dopamean 10y ago
I'm genuinely curious how the decision to use MD5 gets made. Who says, "hey, maybe we should use MD5." And then who responds, "that sounds like a great idea Bob." Seriously. I've known for years that MD5 is insufficient for hashing passwords and I'm just some random guy. This kind of thing really baffles me.
- bpicolo 10y ago
  I doubt that decision was made in the last decade. It's surely just something that's been around for a long time and was never upgraded. Still neglectful, but I sincerely doubt it was just a recent engineer's bad decision-making.
- stanleydrew 10y ago
  Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade. It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
  - cm2187 10y ago
    But it's not like if we didn't have a pretty much continuous stream of major data leaks for the past 5 years. Surely yahoo engineers occasionally open a newspaper...
    - Endy 10y ago
      From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was going to discourage users from using Yahoo and send them over to GMail. Unfortunately... that argument wasn't wrong.
      - 10y ago
MorePowerToYou 10y ago
I think the organization as a whole is just indifferent. Does this breach really matter to Yahoo's bottom line? They were already sold to Verizon. Most of the active users probably won't read this news. It's sad to say, but I think Yahoo as a whole just doesn't care about their users.