5 ms·
Seriously? Who is still using md5? There are strong hashing libraries for like every language. Anyone reading this uses md5? Can we find these people and just
by Cushman 15y ago
Seriously? Who is still using md5? There are strong hashing libraries for like every language. Anyone reading this uses md5?
Can we find these people and just let them know?
- jeffreymcmanus 15y agoThis kind of work is one way we let people know.
- aparadja 15y agoWasn't MtGox, the Bitcoin exchange that was hacked a while ago, using md5?
- maratd 15y ago> Anyone reading this uses md5? I use MD5 all the time, just not for security.
- throwaway64 15y agoUltimately, data integrity is the same thing as data security. If you cannot trust your data not be detectably corrupt in the face of a malicious collision attack, you do not have data integrity. Collided data can be used to cause a DoS, to overrun buffers, any number of nasty things that arbitrary user data can cause when trusted implicitly.
- maratd 15y agoYou are making assumptions that are unwarranted. There are other uses for MD5 besides data integrity and data security. For instance, I generate an MD5 hash of a user's email address and use that hash for Gravatar. While someone who knows quite a bit about MD5 and the other person's email address, can force a collision ... all that would get him would be the other person's avatar image ... which is public anyway. In other words, using MD5 is perfectly fine in situations where collisions don't pose a serious problem.
- viraptor 15y agoMajority of voip connections and some simple http authentication for example: http://en.wikipedia.org/wiki/Digest_access_authentication http://en.wikipedia.org/wiki/Digest_access_authentication That means they're both md5-hashed on the wire and in the database.
- city41 15y agoYour post feels rather optimistic to me. Not only do a lot of people still use md5, I'd argue a sizable number of sites still store passwords in plain text.
- nateberkopec 15y ago37signals used to store passwords in plaintext. http://blog.jgc.org/2009/05/can-you-trust-37signals-with-your.html http://blog.jgc.org/2009/05/can-you-trust-37signals-with-you...
- nateberkopec 15y ago37signals used to store passwords in plaintext. http://blog.jgc.org/2009/05/can-you-trust-37signals-with-your.html http://blog.jgc.org/2009/05/can-you-trust-37signals-with-you...
- Natsu 15y agoTake a look at the PHP code in this question and weep: http://stackoverflow.com/questions/1581610/how-can-i-store-my-users-passwords-safely http://stackoverflow.com/questions/1581610/how-can-i-store-m... I think we need more code examples of how to do things right, because that code is very, very wrong.
- 16s 15y agoMicrosoft Active Directory Server systems use MD4 in their central distributed credential database (ntds.dit). Yes, that's a 4, not a 5... MD4. This is the strongest storage hash that one can use in Active Directory. Shock and horror when geeks meet the real-world. Yes, I know.
- FlowerPower 15y agoLast.fm Its in the specification, and no salt.