:celeste_hearts_lesbian: :celeste_hearts_trans: :celeste_hearts_demisexual: flori_ava_star@[matrix]conf:~:cursor_blinking: (@star)

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

if you use MD5 or SHA1 for literally ANYTHING in 2026, STOP. GET SOME HELP. DO NOT

1❤️4

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

even for seemingly inane tasks, simply DON'T!!!!

❤️2

cat-shaped cat @l@lea.pet

@star apparently windows still hashes passwords with MD4 :)

❤️2

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

@l no there it's fine. they need it for their backdoors

❤️3🩷1

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

???????????,,?????,!!,!,!,?.

@l my backdoor is hashed with md1 the way it is widely accessible

:neocat_googly_shocked@mk.absturztau.be:

1❤️1😭1🩷1

Emma, die Goth-oma @emma@gts.apicrim.es

@l @star wait wtf

cat-shaped cat @l@lea.pet

@emma @star backwards compat for smb 1 or some bullshit from what i know

Emma, die Goth-oma @emma@gts.apicrim.es

@l @star okay, well, that alreqday isn't an explanation I accept wtf are they smoking

We have had collision attacks for over 30 years now!

cat-shaped cat @l@lea.pet

@emma @star its fine :)
microsoft knows best :)

Emma, die Goth-oma @emma@gts.apicrim.es

@l @star microsoft knows best.

V-486233, b0rk3d c0rp0 dr0n3 @vrn@app.wafrn.net

@star

given the illusion of free choice, I'd pick Blake3 100% of the time.

https://github.com/BLAKE3-team/BLAKE3

Xerz 💗 @xerz@masfloss.net

@star sometimes, the only available hash for a file is MD5 and then I

❤️1

[4fbb09] @5225225@furry.engineer

@xerz @star to be fair, a lot of the cases where a file hash is provided (foo.net listing the hash of a file you download... from foo.net) is simply not security relevant.

unless the file is actually being hosted on a mirror and the file hash isn't.

in that case, yeah, it makes sense (but also you still kinda need to trust the mirror because in 99% of cases people won't check the hash unless you do it automatically)

❤️1

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

@5225225 @xerz noooooo, "not security relevant" is not a good excuseeee!!!! this is how usage of md5 proliferates/continues lkjhslkjhdfglkjhsdflkjhsdfglkjhsdgflkjhsdgflkjh

there are simply much better, much safer, much faster hashing algorithms out there! like sha512 or blake3 my beloved

❤️1

Juan D. Jara :yeah_waffy: @javascript@app.wafrn.net

@5225225 @star @xerz

when someone sends you a md5 hash in the year 2026

[4fbb09] @5225225@furry.engineer

@star @xerz i mean for the case of file checksums my argument is to not provide a md5 it's to not provide a hash at all. no one checks it, and checking it only protects against disk corruption on your end (which, sure. whatever.), or the file getting corrupted on the server end.

Xerz 💗 @xerz@masfloss.net

@5225225 @star ...huh? I check hashes constantly tho, in particular for Windows software and retro stuff, plus my Nix checks hashes constantly in an automated fashion, just as e.g. torrents do

this seems like a really easy way to lose track of history and force everyone to be vulnerable just because the majority doesn't understand hashes

[4fbb09] @5225225@furry.engineer

@xerz @star the specific case i'm talking about is page on https://foo.net/ with a download link to https://foo.net/file.bin, and a hash (secure or otherwise) on that page

the hash there is pure security theatre. anyone who can tamper with the file can tamper with the hash to match their tampering. okay, there's more vague benefits of "it's easier to check that the hash hasn't been tampered with than the file" (if anyone is actually monitoring that...), but for the individual, it's not as meaningful

for the case of nix, yes, the hash there is load bearing (especially since certificate checking is disabled in nixpkgs fetchurl if a hash is given, so the HTTPS doesn't protect you)

[XYZ] ww 🩶 @ww@xyzzy.link

@xerz @star didn't know everyone on fedi was a crc32 fan 🙃