Swedes uncover Disqus user security breach(thelocal.se)
thelocal.se
Swedes uncover Disqus user security breach
http://www.thelocal.se/20131212/millions-of-disqus-comments-leaked-to-swedish-group
33 comments
> "The research group" is an extremist left-wing group
> Sweden Democrats is not at all far-right, it is more like a conservative social party
Hmm, where's the bias here, I wonder...
The Swedish Democrats are basically a cleaned-up racist-nationalist party. They had to explicitly ban members from wearing nazi uniforms. Did a green party ever have that problem? Everyone else knows that they're just playing at dog-whistle politics. "concerned about immigration" obviously means "keep out brown people, get rid of as many as possible who are already here".
> mainstream media which is most likely the worst in the world when it comes to being objective
This is just hilarious. You've clearly never read the washington post or watched just about any american news tv.
> Sure maybe some were technically writing racists comments online,
While being sitting politicans...
> This is also old news in Sweden.
This is as least true. It's from 2013
> Sweden Democrats is not at all far-right, it is more like a conservative social party
Hmm, where's the bias here, I wonder...
The Swedish Democrats are basically a cleaned-up racist-nationalist party. They had to explicitly ban members from wearing nazi uniforms. Did a green party ever have that problem? Everyone else knows that they're just playing at dog-whistle politics. "concerned about immigration" obviously means "keep out brown people, get rid of as many as possible who are already here".
> mainstream media which is most likely the worst in the world when it comes to being objective
This is just hilarious. You've clearly never read the washington post or watched just about any american news tv.
> Sure maybe some were technically writing racists comments online,
While being sitting politicans...
> This is also old news in Sweden.
This is as least true. It's from 2013
> Hmm, where's the bias here, I wonder...
Well it's true. Several in the group have connection to violent organisations. While Sweden Democrats is a democratic party. Sure they might have had some issues before, but now they are a conservative social party wether you like it or not.
> This is just hilarious. You've clearly never read the washington post or watched just about any american news tv.
I have but I still think Swedish news are more biased many times. Sure there are extremes in the US like Fox News, but we are pretty much competing with them. In our case I know there is studies on the subject. But of course I am biased since I get exposed more to Swedish news.
> While being sitting politicans... And many were not? And why does it even matter? They should be able to post anonymous comments like anyone else.
Well it's true. Several in the group have connection to violent organisations. While Sweden Democrats is a democratic party. Sure they might have had some issues before, but now they are a conservative social party wether you like it or not.
> This is just hilarious. You've clearly never read the washington post or watched just about any american news tv.
I have but I still think Swedish news are more biased many times. Sure there are extremes in the US like Fox News, but we are pretty much competing with them. In our case I know there is studies on the subject. But of course I am biased since I get exposed more to Swedish news.
> While being sitting politicans... And many were not? And why does it even matter? They should be able to post anonymous comments like anyone else.
As a fellow swede I just don't agree with anything you have to say. Outing politicians who are ranting online is fair game as far as I'm concerned. The Sweden Democrats attract racists and their roots are racist, there's just no way to deny that - they mostly follow the same neo-fascist agenda of similar parties throughout Europe.
>Outing politicians who are ranting online is fair game as far as I'm concerned.
I don't see how that has anything to do with that Expressen did to ordinary non-political citizens.
>Expressen har kartlagt chefer, företagare och en docent som hatar anonymt på Avpixlat.
> - Det som ni håller på med är helt avskyvärt. Ni försöker bara hindra folk från att rösta på Sverigedemokraterna, säger Jim Olsson, 67, docent i fysikalisk kemi.
Translation:
>Expressen has researched and tracked managers, entrepreneurs and a docent who hates online at Avpixlat [immigrant focused news site, according to big media a hate-site, my annotation]
>- What you are doing is despicable. You are trying to stop people from voting on the Sweden Democrats, says Jim Olsson, 67, docent in physical chemistry.
Disclaimer: I dont vote nor sympathize with the Sweden Democrats, i just find this gestapo/social-shaming behavior despicable by one of Swedens largest news-papers.
I don't see how that has anything to do with that Expressen did to ordinary non-political citizens.
>Expressen har kartlagt chefer, företagare och en docent som hatar anonymt på Avpixlat.
> - Det som ni håller på med är helt avskyvärt. Ni försöker bara hindra folk från att rösta på Sverigedemokraterna, säger Jim Olsson, 67, docent i fysikalisk kemi.
Translation:
>Expressen has researched and tracked managers, entrepreneurs and a docent who hates online at Avpixlat [immigrant focused news site, according to big media a hate-site, my annotation]
>- What you are doing is despicable. You are trying to stop people from voting on the Sweden Democrats, says Jim Olsson, 67, docent in physical chemistry.
Disclaimer: I dont vote nor sympathize with the Sweden Democrats, i just find this gestapo/social-shaming behavior despicable by one of Swedens largest news-papers.
So you believe that people should be allowed to express their opinions being anonymous? If yes, why should that not be the case for politicians?
There is a public interest issue when politicians says one thing to the voters and another behind closed doors.
But that is the exact same thing as saying people should not be allowed to speak up anonymously. Either you are anonymous or you are not.
I'm not arguing against anonymity, i am arguing that there is a ethical difference between releasing information about that there's a difference between what a politician says publicly and what the politician really thinks, and the same situation with a private citizen.
A politician wants to change the laws and circumstances for our lives, and he/she gets a mandate to do that by convincing the voters that they have aligned interests.
A politician wants to change the laws and circumstances for our lives, and he/she gets a mandate to do that by convincing the voters that they have aligned interests.
Now that you're editing your comment while I'm writing this, it's a bit hard to comment. I agree with you to 100% that we should have anonymity online, and that the media supporting data breaches of personal data is a bad thing.
BUT I think what you write/wrote about "pk media", "mainstream media" and "immigration" is totally irrelevant to this post and HN in general. I have to say, for the non-Swedes here, that your view are _definitely not_ the common view that Swedes have. While the media is biased sometimes I would actually say that it's the people who are against immigration and have ran out of arguments to justify their case, who use this "argument" to deny facts. Sorry to be harsh but please find some real arguments why the media is not objective.
BUT I think what you write/wrote about "pk media", "mainstream media" and "immigration" is totally irrelevant to this post and HN in general. I have to say, for the non-Swedes here, that your view are _definitely not_ the common view that Swedes have. While the media is biased sometimes I would actually say that it's the people who are against immigration and have ran out of arguments to justify their case, who use this "argument" to deny facts. Sorry to be harsh but please find some real arguments why the media is not objective.
Sorry, I was adding more information since I thought it was interested for outsiders to objectively learn about what is happening in Sweden.
I haven't said anything about immigration, but that we have a mainstream media that have specific political bias is proven [1] and that people don't trust media is also well known [2].
It IS the common view Swedes have, or at least one of the more common. The reason why media is not objective is simple: there is no one there with different opinions that get air to vent the counter arguments. That is why there is such a huge traffic going to "alternative media" which is almost as popular as the state sponsored SVT. [3]
[1] http://www.journalisten.se/nyheter/svenska-journalister-fore...
[2] http://www.allehanda.se/allmant/angermanland/varannan-litar-...
[3] https://medium.com/@martinborgs/alternativa-medier-public-se...
I haven't said anything about immigration, but that we have a mainstream media that have specific political bias is proven [1] and that people don't trust media is also well known [2].
It IS the common view Swedes have, or at least one of the more common. The reason why media is not objective is simple: there is no one there with different opinions that get air to vent the counter arguments. That is why there is such a huge traffic going to "alternative media" which is almost as popular as the state sponsored SVT. [3]
[1] http://www.journalisten.se/nyheter/svenska-journalister-fore...
[2] http://www.allehanda.se/allmant/angermanland/varannan-litar-...
[3] https://medium.com/@martinborgs/alternativa-medier-public-se...
For everyone who doesn't speak swedish, in the third citation you can also read that the "alternative media" is far from the popularity of the most popular media outlets.
> Fria Tiders total under veckan var 91936 reaktioner på 55 artiklar. Aftonbladets motsvarande siffra var 936570 på 1316 artiklar.
Fria Tiders total was 100k "shares" on social media whereas the biggest news outlet Aftonbladet has 1M "shares". And there is another one called Expressen which has another 1M shares.
> Fria Tiders total under veckan var 91936 reaktioner på 55 artiklar. Aftonbladets motsvarande siffra var 936570 på 1316 artiklar.
Fria Tiders total was 100k "shares" on social media whereas the biggest news outlet Aftonbladet has 1M "shares". And there is another one called Expressen which has another 1M shares.
Alternative facts:
The Sweden Democrats are in decline as of lately.
They are an extremist right-wing party with nazi ties on all levels.
The Sweden Democrats are in decline as of lately.
They are an extremist right-wing party with nazi ties on all levels.
The Sweden Democrats have an openly fascist agenda. Several high officials have stated that they want to abolish freedom-of-press.
Hardly "conservative social".
Hardly "conservative social".
This is from 2013. Please mention this in the title.
This is a bad article and what it claims is just wrong:
> the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts
What they received were Gravatar URLs which include the MD5 hash of the senders email address. Obviously you can scrape the web and find more avatars with a matching email address hash and start mapping them to the same author. You can also try brute forcing the hash to find the original address, but all that is not a Disqus security breach.
It's scraping public websites, maybe one could call it social engineering, but after all it's a targeted attack and no flaw in Disqus.
There is of course something wrong with making email hashes public through avatar URLs, but that's all Gravatar's fault.
Many people probably want to see Gravatar support on the websites they use, and it's also very easy to implement by developers. It's pretty much a monopoly and they're the only ones to fix it.
> the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts
What they received were Gravatar URLs which include the MD5 hash of the senders email address. Obviously you can scrape the web and find more avatars with a matching email address hash and start mapping them to the same author. You can also try brute forcing the hash to find the original address, but all that is not a Disqus security breach.
It's scraping public websites, maybe one could call it social engineering, but after all it's a targeted attack and no flaw in Disqus.
There is of course something wrong with making email hashes public through avatar URLs, but that's all Gravatar's fault.
Many people probably want to see Gravatar support on the websites they use, and it's also very easy to implement by developers. It's pretty much a monopoly and they're the only ones to fix it.
I'm bootstrapping a Disqus "clone" that I plan to open source and offer hosted versions as a SaaS company.
I'm still building the MVP but I have a demo running here: http://www.remarkbox.com
I've taken special care to not hash user emails when generating avatars.
In addition by default:
* users are anonymous
* Gravatar is disabled
For default avatars I plan to fork https://github.com/Bekt/invatar (to add image caching)
I'm still building the MVP but I have a demo running here: http://www.remarkbox.com
I've taken special care to not hash user emails when generating avatars.
In addition by default:
* users are anonymous
* Gravatar is disabled
For default avatars I plan to fork https://github.com/Bekt/invatar (to add image caching)
This looks nice – I've been using [Isso](https://posativ.org/isso/) for the past year or so.
cool, never knew that existed.
[deleted]
Gravatar should stop their support for unsalted MD5 hashes. It's just too insecure when most people don't understand the implications of sharing a MD5 hash of a user's email.
The only way something like Gravatar works is by having something that's directly computable from the source email address (or whatever the identifying field is). Whether it's a MD5, SHA256, or whatever is irrelevant.
Similarly having it be a salted (instead of the currently unsalted) hash wouldn't help anything. The salt would need to be public for separate web sites to reference the same avatar for the same email address.
Short of authenticated requests to Gravatar (which again kills the point of how it all works), one alternative would be to make the computation function more expensive, either by performing multiple rounds of the hash function or switching to a "slow" hash function (ex: bcrypt or scrypt). The latter would require a fixed salt and wouldn't really work for the use case as it'd slow down any webpage that links to multiple gravatars to a crawl.
The real issue here is that the email address space is fairly predictable. If you want HASH($EMAIL) to be unpredictable then instead of [email protected] switch to ~ [a-z0-9]{16}\@example\.com.
Similarly having it be a salted (instead of the currently unsalted) hash wouldn't help anything. The salt would need to be public for separate web sites to reference the same avatar for the same email address.
Short of authenticated requests to Gravatar (which again kills the point of how it all works), one alternative would be to make the computation function more expensive, either by performing multiple rounds of the hash function or switching to a "slow" hash function (ex: bcrypt or scrypt). The latter would require a fixed salt and wouldn't really work for the use case as it'd slow down any webpage that links to multiple gravatars to a crawl.
The real issue here is that the email address space is fairly predictable. If you want HASH($EMAIL) to be unpredictable then instead of [email protected] switch to ~ [a-z0-9]{16}\@example\.com.
They need to provide avatar, given hash, i.e. implement a public getavatar(emailhash) function.
They don't need to provide hash given account, i.e. getemailhash(comment).
If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.
They don't need to provide hash given account, i.e. getemailhash(comment).
If someone uses a unique avatar they can be identified by bruteforcing emails, generating md5s, then querying gravatar, but I assume most users don't change from the default. You also couldn't prove it, because you may have missed a different email which has the same avatar.
[deleted]
> He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms.
Does this mean that other services using Gravatar are also leaking in this way?
Does this mean that other services using Gravatar are also leaking in this way?
Yes.
Docs here: http://sv.gravatar.com/site/implement/hash/
Docs here: http://sv.gravatar.com/site/implement/hash/
Specifically, the vulnerability discussed was Disqus's use of Gravatar. The "MD5 hash" provided by their API was strictly used to construct a Gravatar URL.
Yes, this is how Gravatar works.
(2013)
These idiots seem to suggest that leaking the MD5 of an email isn't leaking the email itself.
I wonder if 3 years later they are still that incompetent.
Might be old news but I missed it in 2013, and I would have never used Disqus since if I didn't.
I wonder if 3 years later they are still that incompetent.
Might be old news but I missed it in 2013, and I would have never used Disqus since if I didn't.
From the article:
> Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.
> Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.
Researchgruppen are part of the politically correct elite in Sweden, supported by basically mainstream media which is most likely the worst in the world when it comes to being objective which this articles just proves.
For people interested, the major news paper bought this information from "Researchgruppen" in order to seek, follow and harass everyday citizens and put their faces on the front pages telling the country they are racists. Sure maybe some were technically writing racists comments online, but the gestapo-moves from the news organizations in Sweden is just one of the many harassments you'll recieve if you have any critique what so ever against the large immigration numbers. They have used several illegal actions (credit checks for example) in order to find information on the people they were harassing. The people who got their faces put at the front pages did not get any chance to defend themselves or even tell their story.
This is also old news in Sweden.