3 ms·
The salt is stored in plaintext alongside the hash and simply concatenated. If your scheme, for example, is h := H(ip, salt) := sha256(ip :: salt), bruteforcing
by sweetjuly 3y ago
The salt is stored in plaintext alongside the hash and simply concatenated. If your scheme, for example, is h := H(ip, salt) := sha256(ip :: salt), bruteforcing is simply a matter of trying all values of ip:
for i in 0..<(1<<32):
if H(i, salt) == h:
return i
- worksonmine 3y agoThe salt doesn't have to be plain-text, that's an implementation detail in the common password hashing algorithms for obvious reasons. The requirement was that the hash should be non-reversible. Store the salt in a (http-only) session cookie and concatenate it to the IP before the hashing rounds. Put your entropy in the salt and any brute-force attempt is theoretical. For every session you need to compute the exact combination of IP + salt (which isn't even known to the server).
- 3np 3y agoAt that point, what value does the salted+hashed IP address give you over a randomly generated number (say, a UUID) per session?
- worksonmine 3y agoNone, I'm not arguing for the solution. Proxying through a PHP script just to keep using Google Analytics is overkill when private self-hosted solutions exist. I'm simply showing how you can anonymize IPs even from yourself, if the goal is to anonymize from only Google and not the server it could be useful across sessions. The solution being overkill does not mean my first comment 'That's why you use a salt, which is what I assume is meant by "non-reversibly"' is wrong.