Editing Mediawiki/Anonymous IP Hash
From Bibliotheca Anonoma
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
By default, MediaWiki displays IP Addresses of an anonymous editor in edit history. This obviously has a chilling effect on anonymous user participation. | By default, MediaWiki displays IP Addresses of an anonymous editor in edit history. This obviously has a chilling effect on anonymous user participation. | ||
Line 12: | Line 8: | ||
Here's the gist of my anon ID hack to MediaWiki. I can't really package it as an extension or anything because it involves hacking things that | Here's the gist of my anon ID hack to MediaWiki. I can't really package it as an extension or anything because it involves hacking things that | ||
apparently aren't supposed to be hacked, but it's not hard to do. - Halcy <!-- Note that this mod makes banning IPs quite hard. Maybe if there was a way to just not show the IP address to non-Admin users, and still store the IP in the database, that would be better. But on the flip side, tanasinn.info seems to be doing fine with it | apparently aren't supposed to be hacked, but it's not hard to do. - Halcy <!-- Note that this mod makes banning IPs quite hard. Maybe if there was a way to just not show the IP address to non-Admin users, and still store the IP in the database, that would be better. But on the flip side, tanasinn.info seems to be doing fine with it. --> | ||
1. Add the following to your LocalSettings.php: | 1. Add the following to your LocalSettings.php: | ||
Line 27: | Line 23: | ||
// Expiry time for hashes: dmY = new ID per day, WY = per week. | // Expiry time for hashes: dmY = new ID per day, WY = per week. | ||
$key = $IP.'PUT RANDOM PADDING HERE'.gmdate('dmY'); // | $key = $IP.'PUT RANDOM PADDING HERE'.gmdate('dmY'); // for bcrypt, the key string can only be 72 characters, so the RANDOM PADDING should be 49 characters (72 - 16 - 8) | ||
return 'ID:'.substr(password_hash($key, PASSWORD_BCRYPT, $options), 'id'), 8, 8); // uses bcrypt level 10 | return 'ID:'.substr(password_hash($key, PASSWORD_BCRYPT, $options), 'id'), 8, 8); // uses bcrypt level 10 | ||
} | } | ||
Line 34: | Line 30: | ||
The ID is a truncated hash, which, although it increases the risk of collisions, [http://www.perlmonks.org/?node_id=111524 that may be a benefit rather than a liability when it comes to IPs.] | The ID is a truncated hash, which, although it increases the risk of collisions, [http://www.perlmonks.org/?node_id=111524 that may be a benefit rather than a liability when it comes to IPs.] | ||
{{Note|Obviously | {{Note|Obviously you'd change the padding "PUT RANDOM TEXT HERE" to some random text: this functions as the salt and reduces the risk of brute force attacks. Just bang on the keyboard for a bit, or if you want to be truly random, get an RNG or just roll some dice. Make sure it is up to 49 characters, [http://php.net/manual/en/function.password-hash.php since the max size of a string for bcrypt is 72 characters.]}} | ||
{{Warning|Static salts are a necessary evil here since we need to ensure that IDs stay with a user for a day/week. We mitigate this risk by changing the salt monthly. Obviously in passwords, always use random salts.}} | {{Warning|Static salts are a necessary evil here since we need to ensure that IDs stay with a user for a day/week. We mitigate this risk by changing the salt monthly. Obviously in passwords, always use random salts: this isn't a password though.}} | ||
{{Warning|While it is certainly miles better than bare IP addresses, hashing is [https://www.phillips321.co.uk/2012/04/04/cracking-an-md5-of-an-ip-address/ not an absolutely safe way to protect IPs]. We use bcrypt and a good salt, so it can stop attackers for quite a long time: but not forever. Maybe 5-10 years or so.}} | {{Warning|While it is certainly miles better than bare IP addresses, hashing is [https://www.phillips321.co.uk/2012/04/04/cracking-an-md5-of-an-ip-address/ not an absolutely safe way to protect IPs]. We use bcrypt and a good salt, so it can stop attackers for quite a long time: but not forever. Maybe 5-10 years or so.}} |