2

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents becomes publicly available. As one step to prevent vote fraud, I'm thinking about storing parts of the IP address. Only parts of it — if I were to store the whole IP, the forum would no longer be so very anonymous.

IP addresses are like 111.222.333.444. Which parts of the IP address would you recommend that I store? (If any?)

And what about IPv6, which parts of an IPv6 number?

As far as I know, the initial part of the IP address identifies the Internet Service Provider. And the last digits identify the computer within the ISP's network. What about storing parts _22 and _44, ___._22.___._44?

(Hashing the IP doesn't seem like an option, since there are only 4e9 IPs and it therefore would be relatively easy to crack the hash, i.e. test all 4e9 IPs and find out which one results in a given hash. And hashing a secret value + the IP also won't work, since people are supposed to remain anonymous even if the secret value is exposed.)

(Bloom filters is an option, but I'm thinking they'd require rather much storage space, something like 5KB per comment.)

  • Related question: security.stackexchange.com/q/18123/9487 – KajMagnus Mar 1 '14 at 4:17
  • 3
    How are you going to handle NAT - i.e. many humans sharing the same Internet IP address at the same time? Additionally, for an anonymous forum, you should plan on a reasonable number of Tor users who will be sharing IP addresses. I think you've also got contradictory requirements - if users are truly anonymous, you can't enforce one vote per human. Perhaps you have a different operational definition of anonymity that you're using? – Anti-weakpasswords Mar 1 '14 at 8:07
  • @Anti-weakpasswords I was thinking about using cookies and browser fingerprints. — If people got access to the database, they wouldn't be able to identify anyone, because the cookies and fingerprints wouldn't map to any IP number or email address or anything. However (!) if someone got access to your computer and to the database, they'd be able to link your computer to your activity in the database. So you would be anonymous only as long as both your computer and the database weren't compromised / seized / stolen. — Do you think this makes sense for an anonymous forum? – KajMagnus Mar 1 '14 at 9:53
  • 5
    Just my 2 cents here: you're talking about building a very anonymous forum, and yet you want to store cookies, browser fingerprints, and even a way to identifiy users via their IP address. I would describe that as a major design flaw. – ack__ Mar 1 '14 at 10:14
  • 1
    @KajMagnus - I would recommend weighing the "anonymity" aspect against the "tracking" aspect, and then be very clear to your users about that. For the "anonymity" aspect, store NOTHING. Not browser fingerprints (identifying information), not cookies that wise anonymous users delete, not IP addresses, not anything any all - and make sure your logs are either just not there at all, or contain none of that. And your firewall logs. And so on. For voting, maybe list "Anonymous votes" separately from "NOT Anonymous votes"? – Anti-weakpasswords Mar 1 '14 at 17:55
4

For IPv4, there isn't a good option. The address space is effectively entirely in use, so any partial storage means that one person voting can potentially block others from voting. The numbers towards the left generally represent ISP, geographic area, etc. -- things that an attacker might be able to figure by other means. The numbers towards the right generally represent individual users.

Which parts of the address you store determines the pattern of which users' votes block which other users, and to some extent how much privacy is provided. For example, if you store the three right-most parts of the address, a user can't block other people from his ISP from voting but will block random people scattered around the globe; an attacker who can guess the user's ISP can figure out their full IP address. On the other hand, storing the three left-most parts means an attacker knows immediately which ISP and probably geographic location a user is from, but can't identify the individual; one voter from a small ISP (or the nation of Qatar) can block all others.

IPv6 is different. Essentially, the upper half of the address is assigned by the ISP to the user, while the lower half is generated by the individual device (see IPv6 stateless autoconfiguration and IPv6 privacy extensions).

If you store only the lower half of the address, someone who gets a copy of the database may be able to confirm that someone they suspect is participating actually is, but can't go the other direction and generate a list of participants. If the user has an OS with privacy extensions enabled, confirmation is impossible, but so is preventing duplicate voting.

If you store only the upper half (or only part of the upper half), the situation is essentially the same as with IPv4.

0

I could hash the IP to 16 bits and store those 16 bits. Then there'd be 65 536 possible hashed values, and for each one of those hashes, there'd be roughly 65 536 possible IPs that maps to that value.

Or hash the IP to only 8 bits, so that there'd be only 256 possible hashes, each one stemming from any one of roughly 2^(32 - 8) = 16 777 216 IPs.

This would hide all parts of the original IP.

However, 1) given an IP number, it would be possible to find out if it had likely visited the website, by hashing it and looking for the hash. Also, 2) if the website (with the database with the IP hashes) is related to a certain not-very-large city, then an attacker with access to the IP hashes could enumerate all IP addresses in vicinity of the city, and then only a few of those IPs would match the hashes in the database. In this way, it might be possible to find the real IPs of the people in the city who visited the website. — So, for small villages, one could/should use shorter hashes.


This would be for regular users (i.e. non-anonymous users). I wouldn't want to keep their IP addresses forever, so after a while the IPs could be converted to hashes instead. For truly anonymous users, nothing should be remembered I suppose.

(Answering my own question.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.