Privacy Issue
-
My server is in Texas. That is where I unpacked the WordPress tarball.
Presently I am in SFBA (though not where I live).
Logging in to my WordPress install running on my server in Texas, my dashboard is showing advertisements for WordPress related events in the SFBA.
Not once during the install process did I agree to disclose the IP address of the client I use to WordPress.
A) Where is this hole in the code?
B) Can it be turned off with a setting?
C) If answer to B is no, is there existing plugin to disable it?
-
It was rather troubling to find this in the source:
$key = ‘community-events-‘ . md5( $location[‘ip’] );
Using an unsalted md5 as a key? Key for what, afraid to look (found that with a grep), but I will.
unsalted md5 is worthless.
In fact unsalted any hash algo is worthless for privacy. That’s why I hacked gravatar to salt it (yes, means custom images aren’t possible, but…)
- The topic ‘Privacy Issue’ is closed to new replies.