Yahoo discloses hack of 1B accounts

Re:Yahoo discloses hack of 1B accounts by pbhjpbhj on Wednesday December 14, 2016 @07:46PM (#13181270)

>Md5(password) can yield the same result for many different values of password //

Not "many different" using the normal constraints of text/numbers/typographical-marks and with maximum password lengths of 32 or so (I'll bet Yahoo's was shorter than that in 2013).

Are there any MD5 collisions in [:graph:]{,32} ?

[ Parent | on HN ]

Re:Yahoo discloses hack of 1B accounts by danielweber on Wednesday December 14, 2016 @09:26PM (#13181843)

I really doubt it. When people demonstrate MD5 collisions, they use a hex strings like

0e306561559aa787d00bc6f70bbdfe3404cf03659e70 4f8534c00ffb659c4c8740cc942feb2da115a3f4155c bb8607497386656d7d1f34a42059d78f5a8dd1ef

[ Parent | on HN ]

Re:Yahoo discloses hack of 1B accounts by hawkice on Wednesday December 14, 2016 @09:31PM (#13181873)

Yes, because MD5 digests are much shorter than 32 characters, even if it's just ascii, so by the pidgeonhole principle there must be. If you're asking if there are _known_ collisions between two messages with less than 32 printable ascii characters -- the answer is likely yes, but there are not known to me and likely not publicly known at all yet.

[ Parent | on HN ]

Re:Yahoo discloses hack of 1B accounts by pbhjpbhj on Thursday December 15, 2016 @07:48AM (#13184205)

I thought md5 were 32 characters. But you're right every md5 hash would be in that space, so there must be collisions.

[ Parent | on HN ]