Hacker News Reader

"hash - An MD5 hash value made of the concatenation of YOUR_APPLICATION_KEY + EMAIL + CODE"

Stop using unsafe keyed hashes: http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-has...

That's a red flag that these guys don't know what they're doing and thus not to be trusted to handle my authentication.

Seriously, HMAC was built for this exact purpose. The primary design goal of HMAC was to combat insecure ad-hoc keyed hash schemes exactly like this. I saw this a couple months ago on moonshado's SMS API and after going back and forth with someone from their team I just let it go because they obviously didn't get it. For anyone who cares about security, this is a huge red flag.

The HMAC library in Python still uses MD5 (http://docs.python.org/library/hmac.html) which is known to be exploitable with hash collisions. My opinion is that its not too difficult to roll a MAC setup using some SHA based hash.

The constructor for the Python HMAC library just defaults to MD5; you can pass any of the hashlib modules to it via the digestmod parameter. I don't know why it doesn't default to something more secure, but it's no challenge to do.

Reply on news.ycombinator.com