News for hackers. Stuff that matters.

A comment on DuckDuckGo Searches Are Not Anonymous. Parent comment

Re:DuckDuckGo Searches Are Not Anonymous by erikpukinskis on Wednesday May 19, 2010 @08:05PM (#1362813)
What if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?
[ Parent | on HN ]
Re:DuckDuckGo Searches Are Not Anonymous by epi0Bauqu on Wednesday May 19, 2010 @10:35PM (#1363102)
That embeds the IP in the process and could theoretically be reverse-engineered.
[ Parent | on HN ]
Re:DuckDuckGo Searches Are Not Anonymous by apgwoz on Wednesday May 19, 2010 @11:36PM (#1363185)
Are there session ids? I assume that HMAC(secret + sessionID + ip + search terms) would be fine.
[ Parent | on HN ]
Re:DuckDuckGo Searches Are Not Anonymous by epi0Bauqu on Thursday May 20, 2010 @10:25AM (#1364072)
No sessions.
[ Parent | on HN ]
Re:DuckDuckGo Searches Are Not Anonymous by apgwoz on Thursday May 20, 2010 @11:06PM (#1366251)
I see you do settings through a cookie or URL params. I'm out of ideas unless you hash the cookie + ip for a session ID fir that purpose.
[ Parent | on HN ]