4 ms·

Can you elaborate on what mechanism of Dropbox lets this work?

• wazoox 12y ago
  Almost certainly by using some form of fragile hashing mechanism such as MD5 to identify users, instead of UUID or something similar.
  • habitue 12y ago
    No, almost certainly not. Md5 being broken in this way doesn't mean the chances of two random 160 bit numbers are any more likely to collide by chance. It requires an active adversary. There are a million ways dropbox's software could be buggy that would result in this, that are more likely than a chance md5 collision Furthermore, the kind of weakness md5 has now would require that that the attacker generate both usernames. And the usernames would be really really long because they had gibberish tacked onto the end to make the hashes collide. In the jpeg format you can make that part invisible, but not in a username.