Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Seriously? Who is still using md5? There are strong hashing libraries for like every language. Anyone reading this uses md5?

Can we find these people and just let them know?



> Anyone reading this uses md5?

I use MD5 all the time, just not for security.


Ultimately, data integrity is the same thing as data security. If you cannot trust your data not be detectably corrupt in the face of a malicious collision attack, you do not have data integrity. Collided data can be used to cause a DoS, to overrun buffers, any number of nasty things that arbitrary user data can cause when trusted implicitly.


You are making assumptions that are unwarranted. There are other uses for MD5 besides data integrity and data security. For instance, I generate an MD5 hash of a user's email address and use that hash for Gravatar. While someone who knows quite a bit about MD5 and the other person's email address, can force a collision ... all that would get him would be the other person's avatar image ... which is public anyway. In other words, using MD5 is perfectly fine in situations where collisions don't pose a serious problem.


Wasn't MtGox, the Bitcoin exchange that was hacked a while ago, using md5?


Take a look at the PHP code in this question and weep:

http://stackoverflow.com/questions/1581610/how-can-i-store-m...

I think we need more code examples of how to do things right, because that code is very, very wrong.


Microsoft Active Directory Server systems use MD4 in their central distributed credential database (ntds.dit). Yes, that's a 4, not a 5... MD4. This is the strongest storage hash that one can use in Active Directory.

Shock and horror when geeks meet the real-world. Yes, I know.


This kind of work is one way we let people know.


37signals used to store passwords in plaintext.

http://blog.jgc.org/2009/05/can-you-trust-37signals-with-you...


Majority of voip connections and some simple http authentication for example: http://en.wikipedia.org/wiki/Digest_access_authentication

That means they're both md5-hashed on the wire and in the database.


Your post feels rather optimistic to me. Not only do a lot of people still use md5, I'd argue a sizable number of sites still store passwords in plain text.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: