0

I will first describe how my site stores user information. Every personal information is first hashed by Sha1. The hashed string is then subtracted by substr($var, 2, 38) and then stored.

This includes all information on my website (email addresses used for login and password resets, passwords, IP addresses) except comments, which are stored in plain text.

Is this enough to consider my users anonymized (to me and to everyone else) even though they are registered under bits of strings that look like a set of random numbers and characters? Or is it still pseudonymization?

If so, what can I do to make users anonymous but still registered (required to login)? Is it even possible?

Improve this question
5
  • Anonymous to who? To you, the operator of the site? Or just to other people using the site?
    – Anders
    May 4, 2017 at 9:45
  • What kind of information is it that you hash?
    – Anders
    May 4, 2017 at 9:46
  • @Anders email addresses used for login and password resets, passwords and ip addresses
    – Nora Varner
    May 4, 2017 at 9:58
  • @Anders anonymous to me and everyone else
    – Nora Varner
    May 4, 2017 at 9:59
  • You need to consider if the hashes can be brute forced. This is especially an issue for IP addresses where there is a limited number of them. Also, e.g. the email hashes can be used to either deny of confirm is a certain email is registered on the site.
    – Anders
    May 4, 2017 at 12:05

2 Answers 2

Reset to default
0

Most people consider being anonymous to be a state in which who they are could not be determined using reasonable means.

If your site doesn't log where a user comes from and does not ask for an email address or phone number to confirm identity most would consider content posted to be anonymous in the context of the site.

If the system goes a step further and is only accessible by methods which defy normal traceability, such as over TOR, that goes a step further in ensuring anonymity.

The users ability to unmask themselves in their own content does not diminish the systems claim to be anonymous.

Improve this answer
3
  • Thank you. My website does ask for an email address on login form, but doesn't store email addresses. It stores the truncated hash of an email address. When users type their email address, its truncated hash is checked against the truncated hash stored in the database. If matched, the user is then logged in. I'm not sure if that's enough to call the system anonymous and if not, is there anything else I could do to make it so?
    – Nora Varner
    May 4, 2017 at 11:35
  • Your comment moves the discussion from one of anonymity to one of trust. You know that you are only storing a hash, you tell your customers you are only storing a hash, but no one knows with certainty that you are only storing the hash and not the email addresses. Now we move on to what is tagged to that identifier: are posts? or views? or owner/moderators of a particular forum or topic?
    – Jean-Michel Florent
    May 4, 2017 at 12:40
  • Posts are tagged. Above each post sits the identifier of the user that posted it. But the identifier is not a name nor a nickname. Rather a string given to user upon registration.
    – Nora Varner
    May 4, 2017 at 14:24
0

The limit between full anonymity and pseudo-anonymity is not that clear. One normally call pseudo-anonymity the state where it is still possible to know who was responsible for what.

And a site developper can not guarantee that his site enforces fully anonymity, unless he is at the same time the site administrator. Because even if the database does not keep IP addresses, and only keep hashes of the email addresses, underlying systems such as various proxys or reverse proxys could generate logs containing the IP source address, the time of the request, and the type or size of the request. On a not too busy site, that is enough to find the originating IP for any message. Other logs could also exists independently of the database. For example some authenticating libraries could log each successful login with the login name (normally a password is never willingly logged) and enough information (still the time...) to successfully link it with the IP source address of the request.

What I mean is that only a deep inspection of all logs existing on the platform hosting a site can guarantee the anonymity of the site. And I would not be very confident here, because security best practices require that logs are generated and kept enough time to be able to discover and analyse a possible attack, and those logs could be stolen or given to the authorities in case of a legal enquiry.

So the more you can do here is to claim that you do your best to preserve anonymity and never store, use or sell personnal data, and if possible show external audits proving it.

Improve this answer
2
  • Thanks. What do you mean by external audits? How do I show those?
    – Nora Varner
    May 4, 2017 at 14:28
  • @NoraVarner: I do not mean more than what I've written. A well accepted legal rule is that you cannot hold a proof for yourself, so the idea would be to find a third party that could say he looked at your system and found it ok. But I have no idea on where to find this nor on the possible cost...
    – Serge Ballesta
    May 4, 2017 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .