undefined | Better HN

0 pointsbeojan8y ago0 comments

Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.

0 comments

3 comments · 1 top-level

blibble8y ago· 2 in thread

there's only 4 billion possible IPs, you can reverse the entire search space in a few hours

the only way round this is to make the webserver spend a non-trivial amount of time running some derivation function on the IP for each and every request (remember you can't cache the result if the entire point is not to store the IP)

hennsen8y ago

And all that stuff is super complex... for a number which is not person bound and personally identifying in the furst place. Only with a lot more effort. So my critique is, the lawmakers should have made actions to use ip‘s to identify persons illegal, but not storing ips themselves.

zaarn8y ago

IP is person bound and personally identifying, in a lot of countries you can trace back an IP to a list of people and with an additional information like a last name or a timestamp you can fairly reliable identify a single person.

1 more reply

j / k navigate · click thread line to collapse