Drop what you’re doing and remove SHA-1 from all your apps

A hash is an algorithm that you apply to something like text, that gives a very specific result.
Instead of saving a password as plain text, so that you can compare it with say login details provided by a user for validation purposes, you apply this algorithm to the password on registration save it, and then also when the user tries to authenticate. These results you can then compare, without knowing the user's password.
The hash is one directional, meaning you shouldn't be able to produce a password that'll give the exact result as the hash.
This principle has now been broken on the SHA-1 algorithm, so people can produce passwords to unlock stuff, provided they have the hashed passwords.

Simply put.
 
First it was MD5, and now SHA-1! Trust in security is being eroded. I bet some agency exploited this for some time :wtf:
 
It is a reason why Microsoft switched to sha256 for signing applications/drivers years ago. Now is just a proof.

No wonder why Yahoo has panicked. They didn't panic because of leaking password hashes of millions of Yahoo mail customers. They panicked as they new that it is now relatively easy to reproduce matching password.
 
Last edited:
Vice said:
First it was MD5, and now SHA-1! Trust in security is being eroded. I bet some agency exploited this for some time :wtf:
Click to expand...

Generating collisions is a function of processing power, storage capacity, and time. If the algorithm has a weakness for which you can preclude parts of the hash result with an equation it reduces these requirements.

MD5 can be brute forced because it's only a 32byte hash, SHA-1 needed a loophole, which is now in he wild.

Since the NSA has more processing power and storage, and like you say probably had their quants find this a long time ago, SHA-1 hasn't been a safe choice for at least a decade.

Which makes you wonder why devs don't just use top tier hashing and encryption by default. It's literally a few lines of code and lower level libs take care of the rest. Fine there is a small payoff in CPU cycles. But really.. how many servers have you seen constantly maxed at 100% CPU
 
Last edited:
Vice said:
First it was MD5, and now SHA-1! Trust in security is being eroded. I bet some agency exploited this for some time :wtf:
Click to expand...

Nothing is 100% secure, you find a weakness you move on to the next best thing which will also be found unsecure somewhere down the line.

/dusts off enigma machine...
 
ponder said:
Nothing is 100% secure, you find a weakness you move on to the next best thing which will also be found unsecure somewhere down the line.

/dusts off enigma machine...
Click to expand...
nah that was broken many moons ago. Heil bloody Hitler. :erm:
 
ScottulusMaximus said:
In English?
Click to expand...
Messugga said:
A hash is an algorithm that you apply to something like text, that gives a very specific result.
Instead of saving a password as plain text, so that you can compare it with say login details provided by a user for validation purposes, you apply this algorithm to the password on registration save it, and then also when the user tries to authenticate. These results you can then compare, without knowing the user's password.
The hash is one directional, meaning you shouldn't be able to produce a password that'll give the exact result as the hash.
This principle has now been broken on the SHA-1 algorithm, so people can produce passwords to unlock stuff, provided they have the hashed passwords.

Simply put.
Click to expand...
It took two organisations two years to come up with two pieces of data (we have no idea if it's even real text) that happen to have the same hash. It's a lot harder given a specific piece of data. This is also only for signatures where you have the document and hash.

If you have a hash but not the password you are essentially flying blind using a brute force meaning you're more likely to come up with the actual password than another password with the same hash.

Sensationalism at its best. No reason to hurry and remove anything right now but SHA-1 should be phased out.
 
Oh F*** off with these retarded headlines - this is worse than Buzzfeed.

My assumption is whoever copy and pasted this article on to mybb doesn't understand what it's about.

To compute two colliding hashes using Amazon Web Services would cost around $110,000, said the researchers.
Click to expand...

I think a slow transition over the next few years is called for. A handful of operations throughout the world need to look at it in the next few weeks/months.
 
I can be carded or infracted for what I am about to say but it is the truth:

Sensationalist-seeking headline, is what this is. An overly, emotional, dramatic headline that has no basis in reality.

The people who write this rubbish know nothing about cryptography.
We all knew SHA-1 was vulnerable for a long time. I transitioned my previous employer over to SHA-3, and that was in 2015.

One does not "drop what one is doing" and say "OK Koos kom ons swaai daai crypto". Doesn't work like that.
 
Randy_The_Squirrel said:
I can be carded or infracted for what I am about to say but it is the truth:.
Click to expand...

You shouldn't need to worry about expressing your opinion... site owners should take it as constructive criticism. This site used to be a nice place for techies to get good news, but now it's really just a content mill. I use it more like a glorified RSS feed - I rarely read the content, and if, on the rare occasion, it's written by one of the staff and not a cut-and-paste job, I almost never bother reading to the end of the article.

It's all about quantity over quality. Maybe a good business model, but certainly credibility is in the toilet.
 
Randy_The_Squirrel said:
I can be carded or infracted for what I am about to say but it is the truth:

Sensationalist-seeking headline, is what this is. An overly, emotional, dramatic headline that has no basis in reality.

The people who write this rubbish know nothing about cryptography.
We all knew SHA-1 was vulnerable for a long time. I transitioned my previous employer over to SHA-3, and that was in 2015.

One does not "drop what one is doing" and say "OK Koos kom ons swaai daai crypto". Doesn't work like that.
Click to expand...

Haha, the writer begs to differ
 
elvis_presley said:
You shouldn't need to worry about expressing your opinion... site owners should take it as constructive criticism. This site used to be a nice place for techies to get good news, but now it's really just a content mill. I use it more like a glorified RSS feed - I rarely read the content, and if, on the rare occasion, it's written by one of the staff and not a cut-and-paste job, I almost never bother reading to the end of the article.

It's all about quantity over quality. Maybe a good business model, but certainly credibility is in the toilet.
Click to expand...
I read and feel justified to comment when its an article about a subject I have dealings with on a day-to-day basis. Hence I read the codswallop to see what was written.

Quantity is the game at hand, The quality flew out the window a long time ago. Click-bait, or in this case, posting a bunch of nonsense like this, is what is required.
 
cert.PNG

OMG! Mybb is insecure! Russian haxxers are haxxing it right now!

DROP WHAT YOU'RE DOING AND UPDATE THIS SITE'S CERTIFICATE!

This isn't a sensationalist forum post.. but you won't BELIEVE what happens next!
 
Last edited:
elvis_presley said:
View attachment 419936

OMG! Mybb is insecure! Russian haxxers are haxxing it right now!

DROP WHAT YOU'RE DOING AND UPDATE THIS SITE'S CERTIFICATE!
Click to expand...

I say nothing... because these people (Lancaster and friend) infract me even for critique, never mind criticism.

This SHA-1 business was known to me since 2010 at least. I was working at a place in 2011, and lurking on this very site when I read about the collision found. At the time the forum was in a tizz about e-tolls and stuff.

In the above screencap, the SHA1 you refer to is just the fingerprint, not the actual algorithm being implemented. You will note there are two fingerprints. This does NOT imply the site is using SHA1. You see there is also a SHA-256 fingerprint
 
Randy_The_Squirrel said:
I can be carded or infracted for what I am about to say but it is the truth:

Sensationalist-seeking headline, is what this is. An overly, emotional, dramatic headline that has no basis in reality.

The people who write this rubbish know nothing about cryptography.
We all knew SHA-1 was vulnerable for a long time. I transitioned my previous employer over to SHA-3, and that was in 2015.

One does not "drop what one is doing" and say "OK Koos kom ons swaai daai crypto". Doesn't work like that.
Click to expand...

rofl...

And you know the word "app" was added to draw in the non-technical.
Since we all deal with "apps" on our phones etc.
 
elvis_presley said:
Oh F*** off with these retarded headlines - this is worse than Buzzfeed.

My assumption is whoever copy and pasted this article on to mybb doesn't understand what it's about.

I think a slow transition over the next few years is called for. A handful of operations throughout the world need to look at it in the next few weeks/months.
Click to expand...
Yeah, it wasn't long ago Kevin Lancaster was arguing that they don't have clickbait headlines, hahahahaha.
 
Swa said:
It took two organisations two years to come up with two pieces of data (we have no idea if it's even real text) that happen to have the same hash. It's a lot harder given a specific piece of data. This is also only for signatures where you have the document and hash.

If you have a hash but not the password you are essentially flying blind using a brute force meaning you're more likely to come up with the actual password than another password with the same hash.

[-]Sensationalism at its best. No reason to hurry and remove anything right now[/-] but SHA-1 should be phased out.
Click to expand...
Yes, the algorithm require knowing content of the original document. Problem is that in most cases the (signed) original document is available, like in the case of signed PDF files for agreements, drivers, executable files. It is where a real problem is.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X