New answers tagged

-1

Besides the normal Philip Dick kind of paranoia which tells you nothing is as it seems -- ever -- there is nothing that can be inferred from simply seeing that Chrome has alerted you to a site's using SHA-1 for their certificate's signature. Google said they were going to do this back in 2014. You could be on Amazon.com, using Chrome. The fact is, if ...


1

Others have noted the problems getting the card info to the site, but you must also think about how they handle that information internally. I once worked at a dotcom that stored credit card info in our database in plain text. Anyone with access to client info could see them. Lazy certification is only the tip of the iceberg, IMO.


23

As others have said, technically the risk is small for a MiM attack. However this has a larger problem and implication. Should I go ahead and enter my card details and pay for something on this site? NO, YOU SHOULD NOT USE THIS SITE FOR A CARD TRANSACTION The SSL issue is, as stated by others, relatively minor, however, using a SHA-1 hash means two ...


16

It means that the certificate used by the site is using an outdated signature algorithm to confirm the certificate identity. Google has been aggressively targeting SHA-1 signatures for site certificates for a couple of years, since there are some theoretical attacks which could result in a fraudulent certificate having a valid signature, although there has ...


71

It's a bad sign, but it is still very unlikely that the connection is being eavesdropped on. The website appears to have a valid certificate signed by a certificate authority, but it is signed with a weak and obsolete hash algorithm. What does that mean? It means the connection is encrypted and a passive eavesdropper can still not listen in. But a ...


2

Say I am using SHA-1 which outputs 160 characters string, and my input string is 161 characters, so does that mean each of my 161 character message has at most unlimited collisions and at least 10 collisions/pre-images each of 161 characters. Is my understanding correct? No. First it cannot have unlimited collisions since the number of messages with ...


1

As you already determined correctly multiple images resulting in the same hash must be possible. The argumentation is simple: there is a limited number of hashes and an unlimited number of images which means that there must be multiple images resulting in the same hash.


-1

Here is the comparison between MD5 and SHA1. You can get a clear idea about which one is better.


6

Firstly terminology, SHA-512 is a hashing algorithm not an encryption algorithm, so it makes not sense to talk about "decrypting a SHA-512 hash". As your link states you are trying to find a collision e.g. an input that gives the same value as a known hash. If you have an unknown, large, random input this becomes an exhaustive search such as described first ...


1

In your specific use case, this assertion is faulty: ... suggested that a small digest is susceptible to rainbow tables and other attacks ... A rainbow table is only a lookup table of pre-computed digest values. Think of your use of a hash like the index at the end of a book, telling you what page number to read to find the real context containing ...


2

In practice it literally doesn't matter. If your key size is 512-bit (I'm not sure what cipher you're using, as none that I'm aware of use 512-bit keys, but whatever) then you've got two scenarios: In a small digest you've got so many collisions that discovering the original key by looking for matching values will give you a silly number of results. Not ...


6

Your question appears to have nothing to do with certificates or hashes. Neither one involve symmetric ciphers (like DES or AES) at all. The actual answer is just a matter of how Outlook (or Mail.app) is configured on each machine, nothing more. I don't know how to control the ciphers used on Outlook for Mac, but here are the steps for Outlook 2013 on ...



Top 50 recent answers are included