4 ms·
This comment reminds me of all the people that open PR in php projects to replace various hashing algorithm with md5, because that one is built-in and obviously
by y4mi 5y ago
This comment reminds me of all the people that open PR in php projects to replace various hashing algorithm with md5, because that one is built-in and obviously superior
Especially in web context the new authentication APIs such as webauthn are long overdue and I'm looking forward to the next generation of password managers that will hopefully keep these generated keys synchronized between devices
- raxxorrax 5y agoMD5 is relatively secure for many applications. You can substitute a few bytes without changing the hash so that leaves some applications for manipulation. It is correct to not use it anymore, but you should know about the specific pitfalls. There is nothing like this for passwords or do you want to elaborate further? A password can even offer superior security in some cases. You can gladly use webauthn if the service supports it. I just want to keep options. I also dislike synchronizing devices in some cases because that can be a security problem. I also like to compartmentalize some things.
- y4mi 5y ago> MD5 is relatively secure for many applications This is pure gold.
- raxxorrax 5y agoFinding m' from m with the same hash even with an old md5 is not trivial. It has been memed as such, but it is not the case. Don't use it anyway for any application because there are problems and you would need to talk to walls to explain why it can be safe for certain applications. There is a theoretical solution preimage attacks too, but I don't think it was ever demonstrated. I know this is a lost discussion, but it is technically correct. End of comment.
- Godel_unicode 5y agoYou are incorrect. Collisions are trivially easy to create, there is no situation where md5 is a good choice.