Researchers Say They Found IP Addresses for ‘Anonymous’ Econ Forum Posts
Because people keep on acting like these researchers have retroactively removed the anonymity of this forum, or somehow everything was anonymous before this published, lets go over the facts:<p>1. ejmr made a system that includes hashes that could be trivially linked to ip addresses<p>2. ejmr claimed posts were anonymous<p>3. this researcher realized that the hashes could be trivially linked to ip addresses<p>4. the researcher presumably informed ejmr (as ejmr changed their scheme prior to publication)<p>5. the researcher published the findings<p>The posts made on the forum could be linked to ip addresses from step 1, if this series of events stopped at step 2 or 3, the posts would still not be anonymous, and forum users would still believe that they were.<p>We know that at step 3 this researcher realized that the forum posts were not anonymous, we have no way of knowing how many other people may have also discovered this.<p>At step 4, we know ejmr changed their hashing scheme to actually make it [maybe] anonymous, and despite now knowing their existing scheme was not anonymous they did not inform any existing users that their posts were not anonymous.<p>At step 5 the people using these forums finally discovered that their posts were not actually anonymous, because they were <i>never</i> anonymous. People on that forum, and commenters on HN, act like the researcher was responsible for the technical failure of ejmr, and somehow the act of telling people that their posts were not anonymous is what actually removed anonymity.<p>Because people continue to struggle with this, let&#x27;s imagine I made a forum where every post had an id that was computed as the first 10 characters of base64(rot13(ip || iso date)). A decade later someone goes &quot;hang on, this looks like base 64&quot;, and then publishes their findings: you can get a post&#x27;s IP address by decoding the truncated base 64 and reversing rot13.<p>Is that person responsible for de-anonymizing the users of my forum, or is it my fault for misrepresenting the anonymity of my forum?