Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That would not work, as stated. The search space is way too small. Simply exhaustively building a table mapping hash to IP address is tractable.

This could be ameliorated by including a site-specific secret in the hashed value; I'm not comfortable calling that "secure" but it does address this particular flaw.



Yes, but given a single hash you are only able to reduce to 200 candidate IPs.


If a site specific secret is present you would not be able to do that - unless the site will act as an oracle for you and doesn't care about you making several billion requests.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: