Top all-time · #6713
Nat McHugh
Personal blog · natmchugh.blogspot.comsecurityprogramming
Nat McHugh's personal blog at natmchugh.blogspot.com covers security and programming. Since 2014, 11 different Hacker News readers have linked it 11 times. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers cite Nat McHugh's blog as a source for hash-collision examples, including two PHP files with the same MD5 hash and a JPEG that doubles as a zip file. Comments link to it as reference material.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Transient Random-Noise Bursts with Announcements
What Hacker News says?
Yes, if you open the file as text you will find the magic number of icc profile (acsp) follwoed by a bunch of random bytes and that of zip (PK/x03/x04). It is quite easy to append arbitrary data to JPEG files [0] and however there is no guarantee that it will survive image processing, so it was necessary to hide it within an ICC profile. As for zip, unzip will happily decode any data stream as long as it makes sense…
Comment linking /2014/10/how-i-created-two-images-with-same-md5.html
on “JPEG image of Shakespeare which is also a zip file containing his complete works”Submitted How I created two images with the same MD5 hash as a story · 193 points
HN discussionThat was just a MD5 collision - an image that has same MD5 hash as some other image (in this case some CP). This is uncommon yet possible thing - see this example[0]. [0] https://natmchugh.blogspot.com/2014/11/three-way-md5-collisi...
Comment linking /2014/11/three-way-md5-collision.html
on “Apple says photos in iCloud will be checked by child abuse detection system”Submitted Create your own MD5 collisions as a story · 7 points
HN discussionyou only want to guarantee that the image didn’t change But if the algorithm allows you to find hash collisions, you can’t guarantee that the image didn’t change based on the MD5 hash value? e.g. https://natmchugh.blogspot.com/2014/11/three-way-md5-collisi... Obviously that example is a chosen prefix collision, but this data is coming from an untrusted source after all, so there’s really nothing to stop the attacker…
Comment linking /2014/11/three-way-md5-collision.html?m=1
on “Deprecating SHA1”Submitted How to make two binaries with the same MD5 hash as a story · 4 points
HN discussionhttp://natmchugh.blogspot.com/2014/10/how-i-made-two-php-fil... https://s3-eu-west-1.amazonaws.com/md5collisions/a.php https://s3-eu-west-1.amazonaws.com/md5collisions/b.php Obviously a contrived example, but given the above and other weaknesses md5 should not be considered safe for verifying file contents (at least from a security perspective).
Comment linking /2014/10/how-i-made-two-php-files-with-same-md5.html
on “Why it's hard to write a dupefinder”Submitted How to make two binaries with the same MD5 hash (2015) as a story · 2 points
HN discussionSubmitted Hash Collisions Reading List as a story · 2 points
HN discussionSubmitted How I created two images with the same MD5 hash as a story · 2 points
HN discussionSubmitted Create your own MD5 collisions as a story · 1 points
HN discussion