12 ms·
There are only 2^32 possible IP addresses. You can brute-force that on a personal laptop.
by gizmo686 5y ago
There are only 2^32 possible IP addresses. You can brute-force that on a personal laptop.
- vgaldikas 5y agoThere's even less 'usable' ones, when you exclude private ranges etc...
- olliej 5y agoAnd if you further restrict to US service provider ranges
- xvector 5y agoIf you use a hard hash function you cannot brute force that on a laptop - not even a tenth of that. You can, however, spin up compute instances to brute force it in a few days if you have $50k lying around.
- zeroimpl 5y agoWhat are the odds that a website will run a computationally hard hash function on every single HTTP request just so it can log something less sensitive than an IP address?
- josefx 5y agoThe website could cache the hash for an hour or two.
- xxs 5y ago>force that on a laptop They said: "personal computer", which could easily have 2x GPUs and 16+ cores. Heck, laptops nowadays can have a pretty good discrete GPU. Using password grade hash with a =nonce= is absolutely no way to be accomplished per each request. The nonce would have to be the same for multiple uses - hence NOT a 'nonce'. The sharing of the said non-nonce would require a form a replicated Map (or IP-sticky processing with a local map). It's rather convoluted solution for absolutely no benefit as it's still not hard to brute force. Storing it in such a way - slow hash + salt yields no benefits for debugging either, so I wonder why would you do so? Password hashes are useful for proving a match with an unknown plain text (while making it expensive to brute force) - so what would be the exact purpose of having non-nonce+IP?