3 ms·

all the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you

by apgwoz 16y ago

all the other person has to do then is perform a search to see the secret terms. granted, it's better than it showing up in plain text in the referrer, but you could easily write a script to scrape the actual terms...

mike-cardwell 16y ago
Yes, you're right. I didn't think of that.
erikpukinskis 16y ago
What if you use the IP address of the user as a seed for the encryption? Then if someone else used the same key from a different IP they'd get different search terms?
- epi0Bauqu 16y ago
  That embeds the IP in the process and could theoretically be reverse-engineered.
  - apgwoz 16y ago
    Are there session ids? I assume that HMAC(secret + sessionID + ip + search terms) would be fine.
    - epi0Bauqu 16y ago
      No sessions.
      - apgwoz 16y ago
        I see you do settings through a cookie or URL params. I'm out of ideas unless you hash the cookie + ip for a session ID fir that purpose.