We want LI to be one of the friendliest places on the internet, where lawyers and law students help each other with their career related queries and occasionally discuss other stuff that might affect their lives too. In other words:
1. Be kind, respectful and helpful to each other.
2. Be bona fide, truthful, genuine and curious.
3. Assume the best intention of others.
Therefore, in using the site, you must agree to do your best to uphold these community guidelines.
Note that what you find here is written and moderated by anonymous people on the internet.
Therefore everything you read here is very likely unverified, rumour, speculation and/or downright false.
In continuing to read anything here, you must therefore agree not to take anything you read here as factual and that you will exercise due caution, diligence and common sense before acting on any information you may come across here.
You also agree to report any inaccurate or malicious comments with the buttons. Moderators take action within 24 hours, as required and appropriate under law.
Our full terms and conditions apply too.
Do you solemnly agree to all of the above?
Btw,is the commenter accusing LI from SILF?
And yes, we do not keep any unencrypted original_ip_address in any database or log files, to the best of our knowledge (because if we intentionally did, what would be the point in going through the effort of encryption?). The original IP is used only to create the emojis, and is not written to any database or file.
In terms of why we go through the effort to store anything at all, even if encrypted: mostly to combat some spammy or malicious comments or bots, so we can block a single emojified IP address that posts a lot of crap in any 24 hour period.
But you're right, ultimately, you kind of have to trust that it works the way we say it does, and that we don't have a reason to want to have access to your personal information such as IP addresses or emails, and we don't want to secretly store such information. But like on any other website on the rest of the internet, the only real defense, if you're really worried, is to use a VPN or Tor, so we never even have access to your IP address in the first place and you don't even have to trust us to not ever store it.
So if I understand that correctly, what you are basically saying is that there are three layers to anonymize my IP address?
Layer 1: Original_ip_address ---- converted to ---> Salted_ip_address
Layer 2: Salted_ip_address ----- converted to -----> SHA384_hashed_ip_address
Layer 3: SHA34_hashed_ip_address --- converted to ---> 3 emojis
So even if I somehow reverse-engineer layer 3, reverse-engineering just layer 2 is, well, practically impossible, and reverse-engineering layer-1 is also super difficult because the 'salt' keeps on changing.
This begs the question - since no can decrypt the emojis to figure out what the original IP was (and not even LI can decrypt it because of layers 1 & 2)**, why even bother doing it? why are you even storing IP addresses?
**unless LI stores the 'Original_ip_address' along with the 'salt' used to create the 'Salted_ip_address', somewhere else in their database, because from there on they just have to carry out the steps for layers 2 & 3 to get the 3 emojis being used represent your IP. My guess is LI is storing the 'Original_ip_address' along with the 'salt' somewhere else in a different database.
If you're interested in technical details about whether this is strong enough, would welcome your feedback. Tldr, it is intended to be fairly cryptographically and practically secure. [If you're technically inclined, here are the boring details: your IP address is first 'salted' (sprinkled) with a random sequence of 40 letters that gets regenerated approximately daily, then 'hashed' with SHA384 (akin to a one-way encryption that can not be reversed), and then three partial character sequences of the hash are converted into three out of more than 1000 emojis. And even if it was theoretically possible to reverse engineer it, approximately after a day the old 'salt' is deleted and a new one is generated.]
Hope that helps and always happy for feedback and more tests.
@LegallyIndia But this is not really some strong encryption method is it? Isn't it the same as storing 'ABCD' as, lets say, 'DCBA'. Sounds more like a fun way to obfuscate things, rather than encryption.
Extra 0.50 p for troll or contested marking.
Koi judge case nahi sunege.
Further, this pseudonymous IP encryption key gets reset and thrown away every 24-48 hours, so even if we were really clever and really wanted to we couldn't deduce your actual IP from this after a day or two.
Of course, end of the day, you kind of have to trust us on this and despite our measures to safeguard your anonymity and using an encrypted https connection, it's theoretically probably possible for tracking at your ISP, law school, firm or Pegasus-spying or NSA level to deduce posts that you make.
In short, if you're really really really worried about this or you're leaking state secrets, probably don't use the internet, or if you are, use a VPN and/or Tor and other measures to protect your anonymity...