News for hackers. Stuff that matters.

A comment on Companies must stop using Google Analytics. Parent comment

Re:Companies must stop using Google Analytics by ericpauley on Tuesday July 04, 2023 @09:36AM (#36586458)
No matter what strategy you use to hash IPs, if you can correlate to an IP you can find the original IP by just trying all options. It doesn’t matter what you do because 4B unique possibilities is just too low to prevent brute forcing while maintaining utility.

If you use a random salt, then you need to store it or else the stored value has no utility. However you implement retrieval of that salt it can just be brute forced.

[ Parent | on HN ]
Re:Companies must stop using Google Analytics by worksonmine on Tuesday July 04, 2023 @11:28AM (#36587949)
The salt could be stored as a cookie and you can follow the session but never be able to reverse the hash yourself. Any match you get in the brute-force attempt might as well be a collision.

The entropy can be in the salt, you're all making it sound way too easy. The requirement is "non-reversible". Given infinite time everything can be brute-forced, but this is the mossad/not-mossad problem.

It's good enough for storing passwords, where the salt is plain-text.

[ Parent | on HN ]
Re:Companies must stop using Google Analytics by ericpauley on Thursday July 06, 2023 @10:19AM (#36616208)
That’s just unique identifiers with extra steps.
[ Parent | on HN ]