Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

insidehighered.com

Post reply on HN
Print view View original

31–40 of 80 posts

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#31

Post by usaar333 »

fbdab103 wrote: post #23
upon_drumhead wrote: post #13

Earlier quoted context omitted.

the topic_id could be considered a salt, no?

The topic_id would be shared for everyone who posted on it. For each topic_id, it is then a matter of hashing 4 billion IPs to match each post to the topic. A different salt applied to each user so that would require the 4 billion hashes for each user post to a topic (topic_id+IP+salt).

There's no user accounts on the system.

I would consider the topic a salt - the problem is that the input is so small - just a 32 bit number which makes the "password" (user ip) fast to break.

The sane solution would be to generate large random ids per ip address, topic. And burn the mapping after some time.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#32

Post by randomgg »

olliej wrote: post #25
mutant_glofish wrote: post #21

Earlier quoted context omitted.

I don't think the aim of this "research" is helping to fix the security defects of EJMR.

no, the research was something-something-humanities-economics-whatever. In doing the research they - random academics, not some nation state, or criminal organisation - were able to find that the posts were not anonymous, and extract the location of posters so it was not hard. They clearly informed the forum owner, because the forum owner fixed the issue (though notably did not tell anyone that their posts were not a…

If you find a security vulnerability, I don't think the right course of action is to spend thousands of dollars of GPU time to determine as many IPs as you possibly can, then write an economics paper about it.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#33

Post by fbdab103 »

raverbashing wrote: post #27
bagels wrote: post #8

Earlier quoted context omitted.

Username = hex(sha1(topic_id + ip))[10-14] Notably, no salt used

But the question is: how many collisions with IPs there are by showing only 4 digits of the hash I think there's where the anonymity claims might have come from

Assuming even distribution of four hex values: 16^4 = 65k potential IP collisions. From my quick skim of the paper, the authors made some assumptions about posting tendencies (frequent posters likely to comment on multiple topics) and looked for enriched patterns of IP addresses. An IP address assigned to multiple topics within a short timeframe is more likely to be real. As a control set, they took a different four values of the hash function (eg true function samples [10:14], false set took [11:15]) and used that as their statistical threshold.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#34

Post by [deleted] »

timmytokyo wrote: post #16
droptablemain wrote: post #11

So what's next? Get these people fired from their jobs for having unapproved ideas? Also, who decides what is or is not toxic?

From [1]: Snippets of posts with IP addresses at Harvard, Stanford, Yale, University of Chicago, and the National Bureau of Economic Research headquarters include: "Rapefugees Welcome!!!!! - Merkel"; "bietches are fugly"; and "Its about ching chong taking bubba's job and bubba putting on a white pointy hood in response." [1] https://www.businessinsider.com/harvard-yale-toxic-posts-ejm...

[deleted]

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#35

Post by NoZebra120vClip »

randomgg wrote: post #32
olliej wrote: post #25

Earlier quoted context omitted.

no, the research was something-something-humanities-economics-whatever. In doing the research they - random academics, not some nation state, or criminal organisation - were able to find that the posts were not anonymous, and extract the location of posters so it was not hard. They clearly informed the forum owner, because the forum owner fixed the issue (though notably did not tell anyone that their posts were not a…

If you find a security vulnerability, I don't think the right course of action is to spend thousands of dollars of GPU time to determine as many IPs as you possibly can, then write an economics paper about it.

Someone else is going to do it anyway. And you need a proof of concept. If you write "N thousand users may be exposed", perhaps you will include some proof of that.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#36

Post by bagels »

upon_drumhead wrote: post #13
bagels wrote: post #8

Earlier quoted context omitted.

Username = hex(sha1(topic_id + ip))[10-14] Notably, no salt used

the topic_id could be considered a salt, no?

topic_id is public information, and predictable. It's neither secret, nor random.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#37

Post by throwaway290 »

mutant_glofish wrote: post #21
olliej wrote: post #20

Earlier quoted context omitted.

Since when is it ok to create a forum that is not anonymous and then advertise it as an anonymous forum that is safe for whistleblowers?

I don't think the aim of this "research" is helping to fix the security defects of EJMR.

EJMR changed their scheme before this went public. Why?

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#38

Post by raverbashing »

fbdab103 wrote: post #33
raverbashing wrote: post #27

Earlier quoted context omitted.

But the question is: how many collisions with IPs there are by showing only 4 digits of the hash I think there's where the anonymity claims might have come from

Assuming even distribution of four hex values: 16^4 = 65k potential IP collisions. From my quick skim of the paper, the authors made some assumptions about posting tendencies (frequent posters likely to comment on multiple topics) and looked for enriched patterns of IP addresses. An IP address assigned to multiple topics within a short timeframe is more likely to be real. As a control set, they took a different four…

Sounds like there's some margin for plausible deniability there, especially if they can make it match different universities in the same range

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#39

Post by throwaway290 »

olliej wrote: post #19

Because people keep on acting like these researchers have retroactively removed the anonymity of this forum, or somehow everything was anonymous before this published, lets go over the facts: 1. ejmr made a system that includes hashes that could be trivially linked to ip addresses 2. ejmr claimed posts were anonymous 3. this researcher realized that the hashes could be trivially linked to ip addresses 4. the research…

I think the mainstream take is that black or white hat hinges on responsible disclosure?

If that happened, the forum has completely mishandled this and the blame is squarely on them. If it didn't then I guess it's an open question.

Re: Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts

#40

Post by HeartStrings »

olliej wrote: post #20
mutant_glofish wrote: post #6

Since when trying to dox people is called academic "research"?

Since when is it ok to create a forum that is not anonymous and then advertise it as an anonymous forum that is safe for whistleblowers?

Since when answering a question with a question is considered an intellectually honest debate?
Post reply on HN