mersenneforum.org  

Go Back   mersenneforum.org > Great Internet Mersenne Prime Search > PrimeNet

Reply
 
Thread Tools
Old 2009-04-27, 19:39   #1
stars10250
 
stars10250's Avatar
 
Jul 2008
San Francisco, CA

20110 Posts
Default username and password in url?

Is there some way to not have my username and password show up in the url when I enter my account? I know it's just my primenet account information, but this doesn't seem very secure. Thanks.
stars10250 is offline   Reply With Quote
Old 2009-06-16, 17:36   #2
soda
 
Jun 2009

38 Posts
Default

At least pass the passwords as an MD5 checksum to the server this way it won't matter if it's passed in the url or not
soda is offline   Reply With Quote
Old 2009-06-23, 06:58   #3
lavalamp
 
lavalamp's Avatar
 
Oct 2007
London, UK

2×11×59 Posts
Default

Quote:
Originally Posted by soda View Post
At least pass the passwords as an MD5 checksum to the server this way it won't matter if it's passed in the url or not
Yes it will, since MD5 is broken, and SHA-1 is on shaky ground having had a significant theoretical break. SHA-512 or Whirlpool would be good though, and then a move to SHA-3 in 2012.
lavalamp is offline   Reply With Quote
Old 2009-06-23, 09:56   #4
joblack
 
joblack's Avatar
 
Oct 2008
n00bville

2D516 Posts
Default

Quote:
Originally Posted by lavalamp View Post
Yes it will, since MD5 is broken, and SHA-1 is on shaky ground having had a significant theoretical break. SHA-512 or Whirlpool would be good though, and then a move to SHA-3 in 2012.
MD5 isn't broken, its weakened but still in most cases secure enough ...
joblack is offline   Reply With Quote
Old 2009-06-23, 10:21   #5
CRGreathouse
 
CRGreathouse's Avatar
 
Aug 2006

11×13×41 Posts
Default

I'd say that moving to MD5 from plaintext would be a much bigger step than from MD5 to SHA-3 (whenever that comes out).
CRGreathouse is offline   Reply With Quote
Old 2009-06-23, 10:53   #6
lavalamp
 
lavalamp's Avatar
 
Oct 2007
London, UK

2·11·59 Posts
Default

Are you kidding? MD5 is totally and utterly broken. I wouldn't even trust it when combined with a salt.
lavalamp is offline   Reply With Quote
Old 2009-06-23, 13:17   #7
xilman
Bamboozled!
 
xilman's Avatar
 
May 2003
Down not across

23×31×41 Posts
Default

Quote:
Originally Posted by lavalamp View Post
Are you kidding? MD5 is totally and utterly broken. I wouldn't even trust it when combined with a salt.
Evidence please.

Here's a challenge which you should find totally and utterly trivial: find a text other than "Xilman" which has 5e757338bc46b7d802b340cda044927f as its MD5 hash.


Paul
xilman is offline   Reply With Quote
Old 2009-06-23, 14:28   #8
CRGreathouse
 
CRGreathouse's Avatar
 
Aug 2006

11·13·41 Posts
Default

"For MD5 collision resistance is known to be broken, but second-preimage resistance is not."

So xilman's challenge should be difficult, even though MD5 is "broken" in the sense of not being collision-free.
CRGreathouse is offline   Reply With Quote
Old 2009-06-23, 14:41   #9
lavalamp
 
lavalamp's Avatar
 
Oct 2007
London, UK

2·11·59 Posts
Default

Well for a password hash I wouldn't need to find a word other than Xilman, because if Xilman were the password it would do just fine assuming an algorithm could find it. However, here is an example of two programs, one a simple "Hello, world!" and the other a fake evil hard drive erasing program.
http://www.mscs.dal.ca/~selinger/md5collision/

There is also a program there to generate matching hash programs from an original program.

On this /. post from 2005 (so quite old) some code was posted that can apparently generate MD5 collisions in, "45 minutes on a 1.6 GHz P4." Though I think that it only finds two strings with the same hash, you can't supply a hash and find a string to generate it.

Then of course there's this crypto paper that was referenced in the MD5 wikipedia article, which describes a method to, "decrease the average time of MD5 collision to 31 seconds." But also, "On PC Intel Pentium 4 (3,2 GHz) it is 17 seconds in average."

Then there are the researchers that used a crap load of PS3s to fake a certificate in 3 days.

Rainbow tables are a wonderful thing though:
http://project-rainbowcrack.com/

MD5 rainbow tables can be generated (in a fairly large amount of time), or even downloaded from some places, and then the plaintext Xilman could be determined from the hash rather quickly after that, a matter of seconds in fact. For a determined password cracker using these utilities, it would be feesible to generate and store rainbow tables for all ASCII printable characters up to 8 chars in length which would weigh in at 1 TB. However, from what I understand rainbow tables are a time/space trade-off, so if you wouldn't mind taking an hour or so to crack a password instead of a few seconds, I would think the rainbow tables could be significantly lowered in size and could therefore be generated for longer character passwords.

MD5 is broken in the same way that WEP is broken. OTHER people can defeat them, not me.

I tried breaking WEP at home once with BackTrack, but I was somewhat hampered by two key problems, my inability to do anything useful in Linux and also my complete unfamiliarity with any of the tools, therefore I was unable to make any progress. I should mention that it was my own WEP "secured" network, not a neighbours, and when I finally gave up, I configured it back to WPA again.
lavalamp is offline   Reply With Quote
Old 2009-06-23, 15:25   #10
joblack
 
joblack's Avatar
 
Oct 2008
n00bville

10110101012 Posts
Default

Quote:
Originally Posted by lavalamp View Post
Rainbow tables are a wonderful thing though:
http://project-rainbowcrack.com/

MD5 rainbow tables can be generated (in a fairly large amount of time), or even downloaded from some places, and then the plaintext Xilman could be determined from the hash rather quickly after that, a matter of seconds in fact.
Rainbow tables are only working if the password hash isn't salted. And that isn't the case for Linux, Windows Vista and most Unix variants.

Having some collisions also doesn't mean broken. Wikipedia and a search for your 'broken md5' hasn't revealed anything.

It's weakened but thats it ...

Last fiddled with by joblack on 2009-06-23 at 15:26
joblack is offline   Reply With Quote
Old 2009-06-23, 16:19   #11
lavalamp
 
lavalamp's Avatar
 
Oct 2007
London, UK

2×11×59 Posts
Default

Rainbow tables are good for alphanumeric passwords up to 8 chars in length, and some other types of password that are longer (all lower or all upper case, numeric etc.). Even with a salt, these can be recomputed.

And currently it seems that 200 PS3s in 3 days can find a specific string to match a hash (or 100 in 6 days, 50 in 12 etc.), tomorrows hardware will bring this within reasonable limits, and more and more progress is made in destroying MD5 every day. SHA-1 isn't far behind.

If that isn't a significant and practical break then I don't know what is. If you question the word "practical" there, consider just how many GFLOP/s users here throw at prime finding, or ask yourself what the thousands of members of the more militant wing of Anonymous might be able to do by only gaining read access to a websites database user table, or whether the RIAA and/or MPAA will be poisoning popular torrents they don't like with slightly altered pieces to corrupt the data, heck Microsoft could even do that for Linux torrent downloads.

So my main point remains, why bother with MD5 now? It's blatantly risky and there are far stronger hash functions available.

Edit: I should point out that although I don't know if the researchers used the graphics cards in the PS3s or just the cell CPUs, if it was just the cell CPUs then my graphics card is 12 times more powerful, 2.4 TFLOP/s to 0.2 TFLOP/s. The graphics cards in the PS3s can apparently bench press 1.8 TFLOP/s. This is all in single precision of course.

Last fiddled with by lavalamp on 2009-06-23 at 16:44
lavalamp is offline   Reply With Quote
Reply

Thread Tools


Similar Threads
Thread Thread Starter Forum Replies Last Post
Get username through public name? UBR47K PrimeNet 0 2015-10-11 16:47
I used the wrong username dchmelik Information & Answers 0 2010-12-15 08:40
Username fraud 10metreh Forum Feedback 13 2010-09-10 12:28
How to consolidate 2 Username? stuymer PrimeNet 4 2004-02-29 21:33
Many username mismatches between database and Primenet GP2 Data 5 2003-09-24 21:15

All times are UTC. The time now is 03:36.

Sun Aug 9 03:36:17 UTC 2020 up 22 days, 23:23, 1 user, load averages: 2.11, 2.03, 1.91

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.

This forum has received and complied with 0 (zero) government requests for information.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation.
A copy of the license is included in the FAQ.