Gah - found this kinda stuff all over IoT... Giving a talk on it at BSides London on it. But here, on a production system, there is no excuse for this... No excuse!!
I love things like this https://github.com/masonicboom/ipscrub … "NOTE: this is not a cryptographically secure RNG, but for the following threat model, that is ok." AKA "anyone can trivially deanonymize all IP addresses with the available information". Good job. random(). Not Even Once.
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
return 42;
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Horribly designed, but a cool idea. I'd probably have a rolling table of daily HMAC keys from /dev/random, expunging them when they go out of the required period, then do HMAC-SHA256(ip, k[day]) for the hashing.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.