Hacker News new | ask | show | jobs
by dllthomas 4867 days ago
That would not work, as stated. The search space is way too small. Simply exhaustively building a table mapping hash to IP address is tractable.

This could be ameliorated by including a site-specific secret in the hashed value; I'm not comfortable calling that "secure" but it does address this particular flaw.

1 comments

Yes, but given a single hash you are only able to reduce to 200 candidate IPs.
If a site specific secret is present you would not be able to do that - unless the site will act as an oracle for you and doesn't care about you making several billion requests.