Ask HN: Does HN store IP addresses to identify users? does HN store IP addresses for the purposes of identifying user accounts? I wonder if HN was hacked if "anonymous" posts would be linked back to actual people even though no email address is on the account. EDIT after comments: OK so maybe HN should be clear that anonymity is not likely if HN is hacked. HN sort of presents as being a "safe" place to post anonymously but it's an illusion. |
IPv4 address space is so small, any hashing can reversed with brute force.
They use cookies assuming you are logged in. I wish they do store IPs in order to prevent password brute-forcing attacks.
> I wonder if HN was hacked if "anonymous" posts would be linked back to actual people even though no email address is on the account.
You should be more concerned about your email account being linked to your HN username, fortunately you don't have to provide your email here.
> OK so maybe HN should be clear that anonymity is not likely if HN is hacked. HN sort of presents as being a "safe" place to post anonymously but it's an illusion.
It's pseudonymous forum, if you wish to be anon - head over to 4chan instead.
For one, an attacker would not necessarily get your current IP address.
But even if they did have your current IP address... so what? The most someone could find from that is your general region; maybe your city or a city next to yours if they're lucky. There's no way they're doxing you from that unless they think they can successfully SE the ISP and don't mind risking jail for it.
The real security risk would be the leaked password hashes. That would be much, much more likely to result in people being doxed (and worse).
There's no DB, the site has always been described as storing everything in memory using Lisp closures, and on flat files. I don't know whether that makes Hacker News more or less secure than average, though.
I don't think I've seen that represented anywhere, and I don't think a news site really should be
What is the utility of correlating someone's IP address? General location? Whether users share IPs?
This kind of thing is done by everyone. Social Networks and Ad Networks.
Have a look at this: https://panopticlick.eff.org Your web browser is likely to have a fingerprint making it unique across websites. Sign up to one site with your name, then that can be easily correlated to you.