jaryan patriot
kiwifarms.net
- Joined
- May 15, 2025
I'm no cybersecurity expert but isn't using the same salt for everything extremely bad? The function in the code doesnt seem to have any parameter besides the salt file itself.Apparently the algorithm that generates a "random" public ID for you in each thread is made by some retard. So if someone knows the server-side salt, they can brute-force your IP from the publicly visible hash with other publicly visible information, which is simply "post_time+thread_id+ip_address+salt"... Also I'd speculate one could brute-force the server-side salt too with this information with modern hardware, assuming it isn't ridiculously large. This is because you know the country of the poster thanks to the flag, so the IPv4 search space can be reduced to the networks of one single country. However, I notice there is a substr call that only takes 8 characters from the final hash, I personally have no idea how reasonable it is to brute-force an IP out of a truncated hash like this.
The threads mentioning this are getting nuked by mods.
You could possibly deduce it by making posts from your own IP and checking it against the poster ID you get, right?