4 ms·
I always feel a need to state this to folks who are not aware of geolocation and ip addresses: Geolocation based on IP is very unreliable and should be used onl
by GhettoMaestro 7y ago
I always feel a need to state this to folks who are not aware of geolocation and ip addresses: Geolocation based on IP is very unreliable and should be used only for soft-analytics at best.
Example: It is not fit for security postures (in theory). One can dump all the CURRENT v4 routes being advertised out of China and block them via blackholes/firewalls/etc. However immediately after that a rogue operator could hijack a non-China affiliated prefix, use it for badness, and then release the hijacked prefix.
Most Geolocation services that are static (point in time) will not detect the above scenario. BGP-based monitoring services will, but that's a step up $$$ wise.
- jv22222 7y agoI've found it useful to see what country someone is in and know if you should be taking GDPR measures for the user.
- GhettoMaestro 7y agoBe careful with that logic: While prefixes are supposed to be regionally-allocated, they can and DO move around occasionally. You could find yourself in a situation where you are referencing outdated geolocation information, resulting in a potential violation of GDPR.
- jfk13 7y agoMaybe you should treat all your users' privacy and data with proper respect, regardless of what country you think they're in.
- ohyeshedid 7y agoThis is the correct approach.
- reroute1 7y agoWhat if your idea of proper is different then that countries laws?
- epsteinisntdead 7y agoI don't think this is meant for anything BUT soft analysis. Otherwise, the lack of reliability would be painfully obvious to most people here, I think.
- ricardobeat 7y agoWhat would you recommend for legally mandated country-of-origin filters?
- kjs3 7y agoYes, but... There's a tradeoff. No, geolocation isn't perfect, and it's often oversold, but it can be useful in a security context. Simple (admittedly reductionist) example: say I have no admin-types in China, and don't expect to. It's pretty simple operationally to grab the 'China range', block port 22/tcp (or whatever the hackers are after today), reduce my risk surface area by a billion IPs or so, get that noise out of the logs (maybe collect statistics on the rule for trending/anomalies), and then have more bandwidth to spot the edge cases where a hijacked block is coming after me. Far from a 100% solution, but maybe a 90% solution. Another tool in the toolbag. Your risk model may vary.