3 ms·

>Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your bu

>Ip adresses are needed for security anslysis in case of attacks, for example People repeat this a lot, but it sounds like complete nonsense. Why does your business need to perform “security anslysis in case of attacks”? Do you get paid to do that? Why would you need IP addresses for that?

jexah 8y ago
One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.
- beojan 8y ago
  You can do that with a hash of the IP.
  - ryanlol 8y ago
    How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
    - beojan 8y ago
      Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.
      - blibble 8y ago
        there's only 4 billion possible IPs, you can reverse the entire search space in a few hours the only way round this is to make the webserver spend a non-trivial amount of time running some derivation function on the IP for each and every request (remember you can't cache the result if the entire point is not to store the IP)
        hennsen 8y ago
        And all that stuff is super complex... for a number which is not person bound and personally identifying in the furst place. Only with a lot more effort. So my critique is, the lawmakers should have made actions to use ip‘s to identify persons illegal, but not storing ips themselves.
        zaarn 8y ago
        IP is person bound and personally identifying, in a lot of countries you can trace back an IP to a list of people and with an additional information like a last name or a timestamp you can fairly reliable identify a single person.
        hennsen 8y ago
        How would all these things be legal just because an IP in a logfile isn’t?
        zaarn 8y ago
        Largely they aren't. It's not important that they are legal or illegal. The problem is that it's possible and that is where the GDPR hooks in.
        hennsen 8y ago
        It’s probably also possible to identify people based on the combination of their car color, built timestamp, model and specifically ordered extras. Shall storing these, without a name, be made illegal then and forcing someone to save these in a database to hire a lawyer to ubderstand their legal position? Just because if the name is added to such a database of cars produced, it will be personal identifying? Put another way: If the goal is to prevent certain actions by making them illegal and a given boundary can already ensure that, whats the point in widening that boundary even more?
        8y ago

jexah 8y ago

One obvious case is DoS attacks. Rudimentary attacks can be mitigated by blocking IP addresses of the attacker. Another example is logging requests to secure sections of the site and/or server and perform IP blocks on fishy activity.

beojan 8y ago
You can do that with a hash of the IP.
- ryanlol 8y ago
  How would this work? You can't just sha256 IPs as that'd be trivial to reverse, no different from storing the plaintext. I don't see why the IPs would ever have to hit the disk for this purpose, just keep them cached in RAM for a few minutes.
  - beojan 8y ago
    Salt the hashes, perhaps use PBKDF2. The problem is solved for passwords, just treat IPs like low entropy passwords.
    - blibble 8y ago
      there's only 4 billion possible IPs, you can reverse the entire search space in a few hours the only way round this is to make the webserver spend a non-trivial amount of time running some derivation function on the IP for each and every request (remember you can't cache the result if the entire point is not to store the IP)
      - hennsen 8y ago
        And all that stuff is super complex... for a number which is not person bound and personally identifying in the furst place. Only with a lot more effort. So my critique is, the lawmakers should have made actions to use ip‘s to identify persons illegal, but not storing ips themselves.
        zaarn 8y ago
        IP is person bound and personally identifying, in a lot of countries you can trace back an IP to a list of people and with an additional information like a last name or a timestamp you can fairly reliable identify a single person.
        hennsen 8y ago
        How would all these things be legal just because an IP in a logfile isn’t?
        zaarn 8y ago
        Largely they aren't. It's not important that they are legal or illegal. The problem is that it's possible and that is where the GDPR hooks in.
        hennsen 8y ago
        It’s probably also possible to identify people based on the combination of their car color, built timestamp, model and specifically ordered extras. Shall storing these, without a name, be made illegal then and forcing someone to save these in a database to hire a lawyer to ubderstand their legal position? Just because if the name is added to such a database of cars produced, it will be personal identifying? Put another way: If the goal is to prevent certain actions by making them illegal and a given boundary can already ensure that, whats the point in widening that boundary even more?
        8y ago