4 ms·
Minor point from the blog: > The only thing we store about you is your hashed IP address when you upload a gif. It's impossible for us to get your original IP
by VMG 13y ago
Minor point from the blog:
> The only thing we store about you is your hashed IP address when you upload a gif. It's impossible for us to get your original IP address from this.
What algorithm do you use? It's not that hard to brute force all 2^32 IPv4 addresses with SHA2 -- (even less if you exclude improbable ones)
- kefka 13y agoLet me tell you a little secret: Apache has these things called logs that can "reveal" the IP address of another computer. And so can the evil hacker tool 'netstat'. Do you trust this service or not? Don't trifle around with stupid shit like this.
- lotyrin 13y agoWhat if he's not being paranoid, but instead pointing out how paranoid and flawed the concept he has pointed out is?
- Sir_Cmpwn 13y agoWe're running on nginx, and we told it not to log IPs. You'll obviously have to take our word for it. Even if you don't take our word for it, it's no worse than most other sites, which do log your IP. EDIT: Or you can run a self-hosted instance of MediaCrush, it's open source: https://github.com/MediaCrush/MediaCrush https://github.com/MediaCrush/MediaCrush
- kefka 13y agoThat was precisely my point: TCP doesn't work with a spoofed IP connection while maintaining state. So you usually have to use your IP address or a middleman like TOR or a proxy. And then you have to trust the endpoint: you. And frankly, I get sick of the undue and infinity-about paranoia. It gets tiring hearing again and again.
- VMG 13y agoThe scenario described in the blog is an attacker gaining access to the database containing the IP hashes.
- Sir_Cmpwn 13y agobcrypt. It'd take roughly 40 years to reverse a single hash on one modern CPU. A truly dedicated adversary with lots of resources could tie a single uploaded image to a single IP in about a week of hardcore hashing with thousands of CPUs.
- noir_lord 13y agoMeh, You just hash all 4 billion with bcrypt. I'm an idiot, bcrypt generates and appends it's own salt to break rainbow tables, but I'll leave the above.
- Sir_Cmpwn 13y agoNo, because bcrypt uses a unique salt for each upload. Research bcrypt in a little more detail, it's the best choice for IP obsfucation.