7 ms·
This brings up really good points. One of the best practices going forward is to minimize storage (and logging) of any personally identifiable information. Und
by rubbingalcohol 7y ago
This brings up really good points. One of the best practices going forward is to minimize storage (and logging) of any personally identifiable information.
Under GDPR, IP addresses can be considered PII, so it makes sense to set up an anonymizer for nginx ip address logs. There is a great Stack Overflow answer on this: https://stackoverflow.com/questions/6477239/anonymize-ip-logging-in-nginx https://stackoverflow.com/questions/6477239/anonymize-ip-log...
But also there's some app hygeine involved. At least one of the recent "data breach" notifications involved not an actual leak of personal information, but unsanitized logs containing personal information that should not have been shared intra-organizationally. I forget the company that did this, but they notified as if it had been a breach even though passwords had just been logged internally.
When testing it's convenient to do stuff like
```
console.log('username: ', req.body.username);
console.log('password: ', req.body.password);
```
but it's all too easy to forget about it when you're working on a million things. So a big part of the solution is mindfulness (do I _really_ need to log this?)
- ehsankia 7y agoAt least one? Almost every one of the recent "plaintext password" headlines, of which there has been half a dozen or more, were due to that. And I'm sure there are many more cases happening right now without being noticed. It definitely is big issue. And no, I don't think in most cases it's forgetting to remove the `console.log(req.body.password)`, but rather having a much wider `console.log(req)` which you didn't realize contains (or could in some other code path contain) a password. Or some log statement much deeper, 2-3 layers of abstractions away, logging some struct passing through the system, which happens to contain PII. It definitely isn't a trivial issue with a simple solution, as some people commenting on such headlines seem to imply.
- ikiris 7y agoIts not that hard when you taint structs with PII, so that the log library faults if it tries to log it.
- zbentley 7y agoAh yes, just handle tainting/laundering all data that flows into a system which is hooked up to thousands or hundreds of thousands of external data sources. Not that hard at all. /s
- pmoriarty 7y ago"Under GDPR, IP addresses can be considered PII, so it makes sense to set up an anonymizer for nginx ip address logs." One thing I wonder about is what you would do if, say, you have an abuser on your site that you need to ban due to behavior detected after the fact through a log file. If one needs their IP in order to ban them, but their IP is anonymized, what do you do?
- DiabloD3 7y agoOne way hash of the IP.
- jacquesm 7y agoThe search space is so small you can simply create a table with all of the hashes and use that to reverse the hash.
- thaumasiotes 7y agoMandatory IPv6 could finally be here! ;D
- GhettoMaestro 7y agoYou could always salt it.
- thaumasiotes 7y agoHow would that address the problem? Salts don't make hashes any less reversible.
- majewsky 7y agoSalts are only useful when you already know which hash to check e.g. because the user supplied the username that picks which password hash to check. When matching an IP against a list of salted hashes, you need to hash the input with every possible salt to compare against all hashes in the list. So for performance reasons, it's probably not feasible to use more than one salt (or a small number of salts). Then it's again very possible to reverse the list of salted hashes because the search space is number of all IP addresses times number of salts used, which is way less than the number of all hashes.
- hyperman1 7y agoThis: Under GDPR, IP addresses can be considered PII,so it makes sense to set up an anonymizer is wrong. First of all, PII is a legal definition from mostly the US. The GDPR talks about Personal Data, which is different. If any consultant is talking about GDPR and PII, he is confused, stop listening. Have fun reading the details here: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ Which doesn't matter all that much, because the next part of the line is way to broad: Is an IP adres Personal Data? Maybe, if you can use it to track an individual. But if you arent an ISP and don't actively try to identify anybody with an IP, stop worrying. Next question: Do you need it? In general, using them for keeping the website running is normal usage.So no need for consent. Using them for attack prevention might actually be an industry best practice, and then the GDPR requires you to keep them. Next question: If you need them, how to keep them safe? Throw logs away after a while, encrypt backups, etc... The GDPR has been hijacked by consulting companies to extract money from everybody, so they do their utmost best to sow paranoia with all kinds of weird urban myths. DOn't believe it. Basically, do the normal IT best practices and stop worrying.