11 ms·
Disqus cracked – Security flaw reveals users’ e-mail addresses
- antonpug 13y agoNice. Glad I decided against using Disqus for my site.
- ddebernardy 13y agoYawn. A rainbow table can be used to determine str in MD5(str). News at 11…
- Sae5waip 13y agoThe news is that Disqus is relying on that.
- ddebernardy 13y agoSo does Automattic with gravatars (on nearly 20% of the internet, no less), and pray tell how many other companies that use md5(email) as a unique ID for a reason or another. Duh! What were they thinking!
- Sae5waip 13y agoI don't know what they were thinking. It's wrong, they shouldn't violate their users privacy like that.
- nallerooth 13y agoThe fact that md5 hashes of email addresses can be brute forced is nothing new. This has been pointed out for years, concerning services like gravatar. The only thing which is important, is that Expressen/Researchgruppen believes that they have the right to exploit Disqus' service in order to "make the news".
- Sae5waip 13y agoWhy don't/shouldn't they?! Theres a security problem with Disqus. Apparently it (genereal technique) is "old news" Apparently Disqus doesn't care enough to fix it. Demonstrating the attack may be the only way to get them to care.
- downer90 13y agoAnything requiring third-party cookies, AND requesting an e-mail address not only stinks of spam-oriented advertising revenue, but also total disregard for user security. Even more telling were the options to sign in with services like Facebook Oauth. So from the beginning, I think it was always obvious that Disqus had no interest beyond the bare minimum in casually protecting user privacy. This prompted me to avoid ever providing Disqus with any kind of serious e-mail address. Looks like my instincts served me well.
- eli 13y agoYou think Disqus is selling your email address to spammers?
- eXpl0it3r 13y agoThe article is a bit miss leading. The so called security flaw does not reveal the e-mail address directly, but a MD5 hash of it. Sure it can be cracked, but it doesn't mean that it will get cracked.
- Sae5waip 13y agoActually, yeah, it will be cracked, by someone. And E-Mail-addresses aren't passwords; trying a few hundred variations for each firstname for each lastname is perfectly feasible and should crack a nice percentage of these hashes.
- hrrsn 13y agoMy email is firstname@companyname.co.nz (I have a few of these at different companies). I'm fairly confident this isn't going to be cracked any time soon by random MD5 hashing. (of course, my real name can be extrapolated from my HN username)
- rmc 13y agoHow many *.co.nz's are there? 1,000,000? 10,000? How many first names are there? People can generate millions of MD5's per second now-a-days.
- Jakob 13y agoThe rainbow table would just need to include alphanumeric letters + '@' for up to 30 letters. I think your emails are in nearly every rainbow table in existence.
- aparadja 13y agoJust the 1-10 character lowercase alphanumeric rainbow table from freerainbowtables.com is 297 GB. Of course, you can generate rainbow tables with various parameters and tradeoffs so it's not trivial to compare them. Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?
- __pThrow 13y agoIn all our worry about NSA taps, the simple fact is that gravatar and now disqus allows anyone NSA, your health insurance company, groups who dislike your group, etc., to track your blog comments, help desk comments, any comment you make around the net. Your comments to gay rights groups, anti-gay rights groups, cancer support groups, aids support groups, abortion groups, democratic politics, tea party groups, gun rights groups, doctors offices, anyone using wordpress as a front end group. Anyone can do this with a simple search engine they create, and apparently we don't care because gravatar was setup by a silicon valley favorite and is now owned by Wordpress who was informed of this years ago and refused to consider it a privacy leak. And anyway we like them cutsie cartoon avatars. Anyone can do this with a search engine that maps pages to md5 hashes and vice versa and either a rainbow table of email addresses, or even easier, a list of your customer's email addresses, because let's see if any of our customers have health problems they didn't disclose.
- lmm 13y agoAny comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person. If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?
- Sae5waip 13y agoFrom the same person, but not from that email address. Bad idea, but as per the article people expect these posts not to be linkable to their e-mail address. Why? Well, obviously, because that's the way Disqus works "usually".
- __pThrow 13y agoIf I go to comment at a wordpress site it says this: "Email (required) (Address never made public)" MD5 leaks of my email address into web pages is in fact making my address public. Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress has been leaking your md5 address all over the place.
- dutchbrit 13y agoOld olllddd news, almost every Wordpress blog uses Gravatar, same issue...
- subsystem 13y agoSo why do you feel compelled to post when you know what you are saying is old news? You just adds to the noise and make it off putting for anyone else to post that actually knows about this event including your obvious point.
- Asdfjgori 13y agoGet 150 million e-mail addresses from Adobe hack. Match vs Disqus users. Profit.
- gabriel34 13y agoEven better, you can be certain a great number of users reuse their password
- Asdfjgori 13y agoTrue. A percentage of the union of Adobe and Disqus users will use the same password for both services.
- jessaustin 13y agoBut if they haven't changed their password after the Adobe hack then they're already boned, aren't they? How doe the Disqus vuln add to that?
- Asdfjgori 13y agoYou don't want to try 150 million Adobe logins on Disqus. You want to identify which ones to test first.
- jessaustin 13y agoMaybe I'm being dense this morning... if I were in the Adobe 150M, some criminals would already have my email address, right? How does getting Disqus's hash of it help them out?
- gabriel34 13y agoNot being dense at all, it's a valid point, but crossing both leaks helps them find out quickly which logins and password combos to try at disqus, and which accounts will be compromised.
- f055 13y agoI don't get it, if your email address is so private then why you share it with 3rd parties? Also, why would your email address be so private if the spam filters are so efficient nowadays, what's the harm in having a public email address? Please enlighten me.
- pathy 13y agoIt gets a bit awkward when you comment on racist/anti-immigration websites with your (at least semi public) email while you represent a far right party that officially has a zero tolerance on racism. The party has its roots in the skinhead/neo-nazi organizations and they have been trying to shake that image problem for quite some time now. To be fair, putting on suits has helped them.
- f055 13y agoYeah well, the person has himself to blame. Either be identifiable or anonymous. Don't use private email and expect to be untraceable. That's just mad.
- timbro 13y agoThat's the point. 95% of the population has absolutely no clue about how technology works and how it will be used against them, sooner or later.
- pathy 13y agoAt least some of the emails weren't even private. I saw an example of one of the politicians who got their identity 'leaked'. The email she used for the Disqus comments was listed on her official municipality contact page.
- iamabhishek 13y agoyou are absolutely right, we have public email addresses, and also the spam filters. But then still, information needs to be protected. There are people who dont want their email addresses public or in some list which is being sold over and over again to marketing companies which then flood your inbox with spams. It is irritating at times even if there's spam filters.
- cubehouse 13y agoMD5 hashes of emails is very common practice for Gravatar etc. - although it's fairly sucky, I'm assuming this is in the API specifically for things like showing Gravatar images. I reported a username -> plaintext email vuln to Disqus earlier this year and they were very prompt in patching it, I wouldn't criticize them for this at all as this a very common issue across most blog comment systems. Would be nice to change how Gravatar works, but it's fairly fundamental. I think if you want your email to be private you should probably be registering temporary ones or using the + aliases like gmail offers to avoid these kinds of hash-cracking attacks.
- amckenna 13y agoAnother solution would be for these services to use something with a greater work factor than MD5. When a typical user can brute force MD5s at a rate of 8.5 billion per second with AMD HD7970 graphics card then it's time to use a different hashing algorithm. Something like scrypt or bcrypt with a larger work factor would make these attacks much harder and more expensive, while leaving the fundamentals of the system the same. http://hashcat.net/oclhashcat/ http://hashcat.net/oclhashcat/ https://www.tarsnap.com/scrypt.html https://www.tarsnap.com/scrypt.html https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt
- gabriel34 13y agoSo, what would suffice to maintain anonymity AND the ability to send the user email notifications? I'm guessing Hashing (not MD5 though) + Salting + throwing away the salt and bruteforcing it every time you need the plain email (you will lose the option to mass mail your users) Even then the whole concept of anonymity AND email bound account seems kind of silly. Even if the user uses a secondary email address just for this, he still has to trust the email provider (and if he uses a throwaway, what is the point of collecting it anyway?) This crack is proof that services that provide a fake sense of anonymity can do a lot of harm.
- eterm 13y agoSurely any hashing would be susceptible? Even a slower or more "secure" hash wouldn't help much, because I can take your starting known email address and find comments you have made. i.e. I can start with "bill@example.com", slowly hash that to 901e54d1 and then search google for 901e54d1 to find comments you've made. Speed isn't a big deal if I'm interested in attacking specific subsets of emails. (Which could still be a "large" set in a real world sense.) As long as the hashing algorithm is known then it would be weak to finding comments made by known authors. If the hashing algorithm is unknown then it falls under security by obscurity. So is there any way to implement a decentralised pseudonymous but ID-based system where the ID is tied to email but cannot be generated from email (or rather is generated from email but with some added entropy that prevents going in either direction in the future.).
- gabriel34 13y agoyou could salt the hash twice. One (large) you store the other you throw away. This way to compromise a specific account you would have to steal it's stored hash. If there was a leak of the hashes you would need to bruteforce all the hashes which were thrown away
- jessaustin 13y agoIn general, what you're asking about is called a "salted hash". I don't understand enough about Disqus's system to say it would definitely have prevented this vulnerability.
- darkarmani 13y agoA salted hash only slows down brute-force attacks and dictionary attacks. The salt is still stored with the hash, so you could still eventually match the email address with the hash. Instead of hashing each email address once and comparing it with all of your collected hashes, you'd have to hash each email address using every salt until you found a match.
- jessaustin 13y agoSure since they're using MD5 then a salt wouldn't solve their problem, especially if the salt were also part of the url. And let's not pretend that the url itself is somehow secret: there are many ways to collect those, particularly if specific users are targeted. Usually when people are this boneheaded about hashes they're trying to save storage space, but I can't imagine that storing a separate random identifier would add significantly to Disqus's storage.
- Asdfjgori 13y agoResearchgruppen seems to be in violation of the Disqus terms of service by harvesting personal information and also disclosing this in other mediums.
- oneeyedpigeon 13y agoSo what? I doubt they're bothered if Disqus bans them from using their service.
- kmfrk 13y agoGlad I use separate e-mail addresses for signing up to sites and for personal correspondence.
- jstalin 13y agoAnother reason to not use your real name or email address when commenting across the web.
- vocino 13y agoOr you know just be a decent person and not post things you wouldn't say in person yourself.
- TallGuyShort 13y agoYeah - people have never been persecuted for who they are in person.
- deleted 13y ago[deleted]
- defen 13y agoCommon Sense, The Federalist Papers, Candide ...
- jstalin 13y agoThings like... I think gays shouldn't be beaten up and jailed in Russia for engaging in gay "propaganda?" Things that people who are under the threat of being beaten up and jailed for saying fear?
- draugadrotten 13y agoIf a political organisation was revealing the identities behind anonymous speech on a jewish forum, the world would be up in arms. If the identities on a gay board was published, Obama himself would be apologising. Now the identities of thousands of people commenting on politics in Sweden was revealed, and it's OK because "they" are the bad guys, says the extreme left organisation Researchgruppen. The slippery slope is
- trapezor 13y agoWell yes, because of hate speech and potential violence...
- subsystem 13y agoPress freedom generally trumps privacy, as it should.
- knowtheory 13y agoBeing born into a jewish family isn't a choice. Being gay isn't a choice. Being politically affiliated with hate speech IS a choice. That is some straight up false equivalency bullshit.
- robomartin 13y agoThe British probably thought those behind the movement that ultimately resulted in the United States were engaging in hate speech. Be careful not to use a tinted lens to evaluate the world. We all do it. I am not critical of your statement. I am merely pointing out that dissenting points of view throughout history have often met with push-back. Very often, years later, those responsible for the "hate speech" were recognized as being at the root of positive world-changing developments. Imagine the people who dared to engage in "hate speech" against the flat earth and geocentric dogma, voting rights, slavery, etc. I am disagreeing with you on one point. Being Jewish is a choice, just like being Christian is a choice. I was born into a family, like most, with generations of religious belief. I, however, am an atheist. You don't have to be a Jew. You can have jewish culture in your life, respect it and enjoy it. That does not mean you have no choice but to also be religious. That part is a choice. Just as it is for anyone from any other religion.
- deleted 13y ago[deleted]
- anilshanbhag 13y agoWhere does one get the dataset of email id's of Adobe users ?
- d0ugie 13y agoI think here: http://goo.gl/cRJfVu http://goo.gl/cRJfVu
- sneak 13y agoY'all seem to be forgetting that this isn't random ascii string bruteforcing: you start with a list of known email addresses collected from other places or bought from spammers, then you hash all those, and you see which ones match.
- stonemetal 13y agoWhy MD5 the email addresses? If you just need a unique id for a user, why not use a GUID or something that isn't traceable from public information?