Re:The hijacking flaw that lurked in Intel chips is worse th...
by megadollar on Sunday May 07, 2017 @11:26PM
(#14289037)
You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb and you've since argued against a strawman. Did I ever say "MD5 is ok in some cases"?
Aside: a preimage attack implies a second preimage attack.
Re:The hijacking flaw that lurked in Intel chips is worse th...
by benchaney on Monday May 08, 2017 @06:30PM
(#14296235)
>You're clearly somebody who wants to rely on "rules of thumb" for security. I'm arguing against the entire concept of rules of thumb
Not all devs are security experts, or can even afford to focus on security. To deny the value of rules of thumb is to deny that they need to consider security.
> Did I ever say "MD5 is ok in some cases"?
Oh, really? Were you not arguing that MD5 is ok if you only need preimage resistance?
> MD5 is not broken for the usage that you think it's broken for. Please don't snipe on things like this again. People like you who say things like "md5 is always bad" or "you should bcrypt, duh" are literally cargo culting the idea of computer security.
Hmm. Seems like you were...
In addition, you are completely wrong about the harm caused by simplifying the rules of thumb for security. There is not good reason to ever use MD5 for this purpose, and saying "MD5 is ok in some cases" has the potentially to do far more harm than "never use MD5".
> note, this is actually a prize for a weaker claim than an preimage attack; all I want is a second preimage (!)
Don't act like you are doing GP a favor, second preimage is the attack that would cause a vulnerability in this usage of MD5.
You are the one who is"opin[ing] on security threads while not quite understanding anything", so I think before the next time you condescendingly correct someone you should make sure you have a basic understanding of what you are talking about.