Hacker News new | ask | show | jobs
by upon_drumhead 1061 days ago
the topic_id could be considered a salt, no?
2 comments

The topic_id would be shared for everyone who posted on it. For each topic_id, it is then a matter of hashing 4 billion IPs to match each post to the topic. A different salt applied to each user so that would require the 4 billion hashes for each user post to a topic (topic_id+IP+salt).
There's no user accounts on the system.

I would consider the topic a salt - the problem is that the input is so small - just a 32 bit number which makes the "password" (user ip) fast to break.

The sane solution would be to generate large random ids per ip address, topic. And burn the mapping after some time.

topic_id is public information, and predictable. It's neither secret, nor random.
This is a weird use case (deliberately making the hash public) and the usual concept of a salt feels weird here. Any kind of server-side secret would have effectively stopped this attack, even if it was the same in every hash.