3 ms·
> For example, they can be used for duplicate detection across a large data set. And that's how my colleague sees the photos of some unknown woman in his Dropb
by wazoox 12y ago
> For example, they can be used for duplicate detection across a large data set.
And that's how my colleague sees the photos of some unknown woman in his Dropbox (and supposedly, she sees his pictures too).
- Eiriksmal 12y agoCan you elaborate on what mechanism of Dropbox lets this work?
- wazoox 12y agoAlmost certainly by using some form of fragile hashing mechanism such as MD5 to identify users, instead of UUID or something similar.
- habitue 12y agoNo, almost certainly not. Md5 being broken in this way doesn't mean the chances of two random 160 bit numbers are any more likely to collide by chance. It requires an active adversary. There are a million ways dropbox's software could be buggy that would result in this, that are more likely than a chance md5 collision Furthermore, the kind of weakness md5 has now would require that that the attacker generate both usernames. And the usernames would be really really long because they had gibberish tacked onto the end to make the hashes collide. In the jpeg format you can make that part invisible, but not in a username.