MD5 hash extension attack breaks API authentication in Flickr (and others) 17 years ago
Attacker controls the length of the message so he can make the padding be only 9 bytes long
HN user
juli
7 karma
Posts0
Comments3
No posts found.
Sites using this vulnerable signing method must add a warning to their documentation.
Flickr authentication spec lists ludicorp.com authors,
Flickr's API Signature Forgery Vulnerability 17 years ago
MD5 is not the problem here, SHA1 is also vulnerable to the extension attack. They should use HMAC.