Re:No Cookie for You
by jedberg on Thursday December 17, 2020 @01:45PM
(#25458772)
A one way hash of an IPv4 address is no more private than the address itself. If you know the has algorithm, you can build a rainbow table of all the hashes in under a second. Even with a random salt it doesn't take long to build a rainbow table with all possible salts.
[ Parent
| on HN ]
Doesn't that depend on the size of the salt?
To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.
Re:No Cookie for You
by mattlondon on Thursday December 17, 2020 @03:38PM
(#25460096)
If the salt is a random 64bit number (for example) then "finding out" the salt is not trivial.
And unless I'm missing something, it seems easy to add plenty of bits to the salt until it's no longer practical to reverse.
Re:No Cookie for You
by YetAnotherNick on Thursday December 17, 2020 @03:49PM
(#25460223)
@mattlondon: The salt is known to plausible, that is the only way someone can hash it.