Hacker News Reader

Seriously, HMAC was built for this exact purpose. The primary design goal of HMAC was to combat insecure ad-hoc keyed hash schemes exactly like this. I saw this a couple months ago on moonshado's SMS API and after going back and forth with someone from their team I just let it go because they obviously didn't get it. For anyone who cares about security, this is a huge red flag.

View on HN

The HMAC library in Python still uses MD5 (http://docs.python.org/library/hmac.html) which is known to be exploitable with hash collisions. My opinion is that its not too difficult to roll a MAC setup using some SHA based hash.

The constructor for the Python HMAC library just defaults to MD5; you can pass any of the hashlib modules to it via the digestmod parameter. I don't know why it doesn't default to something more secure, but it's no challenge to do.

Reply on news.ycombinator.com