And my point was how do you "brute force" an algorithm that is only run on the IP address that an anonymous node at PerlMonks is posted via?

All security is relative and has the potential to be broken. So by your logic, we should just abanodon all of it.

If somebody can spoof TCP from arbitrary IP addresses, I doubt they'll be wasting their considerable resources trying to sniff out the IP address of some "anonymous" poster to PerlMonks.

A more realistic privacy concern is somebody realizing that some other anonymous poster is posting through their same corporate firewall. Which would simply be another reason to post "anonymously" by registering as "codejunkie" via some gmail account.

So, no, I don't consider "brute force" a big concern for an anonymous posting IP addressing hash function. But privacy concerns certainly should be raised before something like this is implemented (something I only give moderate odds of ever happening).

Well, again, perhaps I am not understanding the proposal here, but to spell out what I have in mind...

1. Some monk (perhaps not Anonymous Monk, but a registered user) posts a message from IP address "a.b.c.d".
2. Along with the message, some hash of "a.b.c.d" is posted as well.
3. The hash is such that "a.b.c" is separate from "d".
4. Another monk can look at hash("a.b.c") and make many guesses as to what "a.b.c" is. This is the brute force.
5. Now the other monk has the source IP of the original monk's access. This probably gives a pretty good idea of the original monk's location, which the original monk may not have wanted to be public.

There are only 16_777_216 possibilities for "a.b.c", and that's if I search every country and every IP block that I know isn't registered to anyone.

I think I just now figured out the disconnect here. You're saying that the algorithm for hashing IP addresses here won't be public. As such, there won't be a way for people to try a dictionary attack against it. This is why you talk about spoofing IP addresses. Without a public algorithm, the only way to run dictionary attacks would be to spoof IP addresses and see what the site calls them.

...and now I see you say exactly that in Re^7: monastery mark-upedness (brute force)

You also seem to be saying that this won't be used on registered users (only the literal Anonymous Monk). If that's the case, I don't see how it would help with sock puppetry, but that doesn't really concern me.

OK, glad that's all cleared up. Thanks for your patience.

Also consider this lesson from Bruce Schneier:
http://www.schneier.com/blog/archives/2007/11/using_google_to.html

As far as I can see, the hash algorithm wouldn't have to be known in order to attempt this attack. It would only have to be used enough on the internet that it might be indexed with it's plaintext by Google or whatever search engine.

The only defense against this would be a roll-your-own algoritihm, and then you don't have the benefit of peer review in the cryptanalytic community.

---

#my sig used to say 'I humbly seek wisdom. '. Now it says:
use strict;
use warnings;
I humbly seek wisdom.

Yes, the not helping with sock puppetry is one reason why I give low odds of this ever being implemented. On the balance of privacy vs. discouraging abuse, I don't see posting even a hash of source IP for non-anonymous nodes as a worthwhile trade-off at this point. So I don't yet see an acceptable discouragement other than the convoluted idea of providing a level power that enables one to compare the source IPs of two specific nodes, which itself seems likely not worth the convolutedness for the theorized gain.

But as anonymous trollery will almost certainly eventually become an annoying problem again, posting a hash of source IP for anonymous nodes may become worth implementing.

- tye