Re:How I created two images with the same MD5 hash
by Eiriksmal on Tuesday November 04, 2014 @12:47PM
(#8557893)
Can you elaborate on what mechanism of Dropbox lets this work?
[ Parent
| on HN ]
Re:How I created two images with the same MD5 hash
by wazoox on Tuesday November 04, 2014 @05:10PM
(#8559365)
Almost certainly by using some form of fragile hashing mechanism such as MD5 to identify users, instead of UUID or something similar.
Re:How I created two images with the same MD5 hash
by habitue on Tuesday November 04, 2014 @06:08PM
(#8559629)
No, almost certainly not. Md5 being broken in this way doesn't mean the chances of two random 160 bit numbers are any more likely to collide by chance. It requires an active adversary. There are a million ways dropbox's software could be buggy that would result in this, that are more likely than a chance md5 collision
Furthermore, the kind of weakness md5 has now would require that that the attacker generate both usernames. And the usernames would be really really long because they had gibberish tacked onto the end to make the hashes collide. In the jpeg format you can make that part invisible, but not in a username.