3 ms·

Don't log ip addresses, or anonymise them.

by dbbk 9y ago

akvadrako 9y ago
How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.
- grabeh 9y ago
  You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
  - akvadrako 9y ago
    Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
    - grabeh 9y ago
      If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?
      - akvadrako 9y ago
        Nothing to do with the isp - but if you have users so you know who they are and then you also track people by ip network, you are now storing tracking logs that can be identified with a specific user. For example if hacker news did this and one of your comments contained your city or company, now they can connect your account to an anonymized analytics user.
- teamhappy 9y ago
  Google Analytics drops the last octet IIRC. Hashing isn't anonymizing because the hash can later be used to re-identify a user. (See https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
  - Sylos 9y ago
    Since there are legitimate use-cases where you need to be able to somehow identify requests coming from the same IP (protection against DDoS), you would be allowed to do it, given that you take reasonable steps to protect the user (such as deleting the logs after a few days when there's no suspicious activity). And then hashing the IP addresses would be such a reasonable step, too, since it removes location information from the stored data.

Don't log ip addresses, or anonymise them.

by dbbk 9y ago

Don't log ip addresses, or anonymise them.

How would you anonymise an IPv4 address? Hashing isn't enough, because that would be easy to brute force. And you can't create a table mapping IPs to anonymized-IPs, because then you are still storing them.

grabeh 9y ago
You could just remove parts of the IP address so it could no longer be used to identify a unique individual. For example, if you removed the last 3 digits, it could no longer be used on IP lookups (presumably), or an ISP would not be able to disclose the particular individual that is associated with the user account that the IP is linked to, because there is insufficient information available. Here's Google's approach: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
- akvadrako 9y ago
  Removing the last 3 digits would often uniquely identify a larger company or a city and if you only have 1 user from that city/company, those records would be easy to connect. Maybe Google is hoping the EU will accept that balance of concerns, but it doesn't sound like it realises the spirit of the law.
  - grabeh 9y ago
    If your reference to 'you' means someone running a site who only has possession of a reduced IP address, then how would connection work? Or are you saying that if I went to an ISP with the reduced IP address, they could disclose details of the person, if they only had 1 account within the range of IP addresses that the restricted IP address covered? This doesn't seem particularly likely to me? I thought ISPs hold a block of IPs and dole them out on that basis, and so resulting in only a loose connection between IP address and location? On large companies, that would be out of scope, because whilst the reduced ISP may be linked to 1 large company, the assumption would be that the large company had multiple employees. On that basis although the account may be linked to a particular employee, no one employee could be singled out because multiple people would be relying on the same base IP potentially I would have thought?
    - akvadrako 9y ago
      Nothing to do with the isp - but if you have users so you know who they are and then you also track people by ip network, you are now storing tracking logs that can be identified with a specific user. For example if hacker news did this and one of your comments contained your city or company, now they can connect your account to an anonymized analytics user.
teamhappy 9y ago
Google Analytics drops the last octet IIRC. Hashing isn't anonymizing because the hash can later be used to re-identify a user. (See https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...)
- Sylos 9y ago
  Since there are legitimate use-cases where you need to be able to somehow identify requests coming from the same IP (protection against DDoS), you would be allowed to do it, given that you take reasonable steps to protect the user (such as deleting the logs after a few days when there's no suspicious activity). And then hashing the IP addresses would be such a reasonable step, too, since it removes location information from the stored data.