3 ms·
"hash - An MD5 hash value made of the concatenation of YOUR_APPLICATION_KEY + EMAIL + CODE" Stop using unsafe keyed hashes: http://rdist.root.org/2009/10/29/st
by sweis 15y ago
"hash - An MD5 hash value made of the concatenation of YOUR_APPLICATION_KEY + EMAIL + CODE"
Stop using unsafe keyed hashes:
http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-hashes-use-hmac/ http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-has...
That's a red flag that these guys don't know what they're doing and thus not to be trusted to handle my authentication.
- latortuga 15y agoSeriously, HMAC was built for this exact purpose. The primary design goal of HMAC was to combat insecure ad-hoc keyed hash schemes exactly like this. I saw this a couple months ago on moonshado's SMS API and after going back and forth with someone from their team I just let it go because they obviously didn't get it. For anyone who cares about security, this is a huge red flag.
- robee 15y agoThe HMAC library in Python still uses MD5 (http://docs.python.org/library/hmac.html http://docs.python.org/library/hmac.html) which is known to be exploitable with hash collisions. My opinion is that its not too difficult to roll a MAC setup using some SHA based hash.
- adambard 15y agoThe constructor for the Python HMAC library just defaults to MD5; you can pass any of the hashlib modules to it via the digestmod parameter. I don't know why it doesn't default to something more secure, but it's no challenge to do.