News for hackers. Stuff that matters.

A comment on The hijacking flaw that lurked in Intel chips is worse than anyone thought. Parent comment

Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @03:44AM (#14284357)
> Also, fixed length hashes aren't strings.

In HTTP everything is a string.

> Using a proper cryptography library also might have saved them from using MD5.

HTTP, again. Browser sends MD5 whether you like it or not.

[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by benchaney on Sunday May 07, 2017 @04:02AM (#14284391)
> In HTTP everything is a string.

Once you parse it out of HTTP it is no longer as string (or at least it should no longer be a string).

>HTTP, again. Browser sends MD5 whether you like it or not.

They are quite clearly doing verification themselves. They can use whatever algorithm they want.

[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @04:41AM (#14284482)
It has to be MD5. They use HTTP digest auth, which uses MD5. You send a nonce, the browser throws a popup asking for password and returns md5(nonce+pass). No way around it.
[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by coldtea on Sunday May 07, 2017 @08:00AM (#14285025)
Very easy way around it: do NOT use digest auth.
[ Parent | on HN ]
Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @08:17AM (#14285082)
Sure, which brings us to the second point: HTTP's MD5 digest auth is still good enough to keep passive eavesdroppers from learning the password when TLS isn't used, which is its only purpose.
[ Parent | on HN ]