Security issue: IP of specific delegate can be found

[simonmorgenthaler]

It's possible to find the IP of a specific delegate (or all delegates)

[mrv777]

If you use the API whitelist and block everyone but yourself, is this still possible?

I only know how to do this with an open API, which the API whitelist provides an easy solution to prevent.

Idea, maybe when you do bash lisk.sh coldstart, it asks if you want the node to be a public peer or not, adjusting the API whitelist in config.json as needed. Maybe even promoting for your forging passphrase to add in there too. Simplifying the setup to this two step menu instead of opening up the config.json file yourself and editing it (even though that's really not that difficult to do :) )

[fix]

I think there is no way (at least not known to me) to prevent such feature:

• delegate must be reachable by all delegates blocks in a very decent time (< 5s)
• active delegate forges blocks every 16 min

Those footprints are impossible to hide imho.