3 ms·
Salt and hash the IP or something so the RP can see the user's IP is the same as the bank's; but not necessarily _what_ the IP is...?
by jwally 1y ago
Salt and hash the IP or something so the RP can see the user's IP is the same as the bank's; but not necessarily _what_ the IP is...?
- perihelions 1y agoYou want the website to (1) look at a visitor's IP address, and (2) compare a cryptographic hash of that same IP address, to test for equality? Did you forget that (1) they have that IP address to begin with?
- jwally 1y agoGiven the static nature of most residential IP addresses, what stops this from happening today? If I subpoena facebook, google, chase, and pornhub - I can unmask who you are by correlating your IP and profile info. If I want higher certainty, I can further narrow down time windows.