3 ms·
> Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades. Yeah, and the defaults for mongodb is to let
by capableweb 6y ago
> Default setup for apache has been to log IP addresses, useragents, and requests, in the access log for decades.
Yeah, and the defaults for mongodb is to let anyone edit the database, at least it used to be so. Doesn't mean you should run it like that.
You can, as soon as you receive a request, hash the IP address and store the hash instead of storing the cleartext IP. If there is no way of reversing the hash (which there shouldn't, wouldn't be much of a hash then), you're not storing any IP anymore, and it's not personal data.
Strikes me as very weird someone who supposed to be high-level developer or employee at one of the biggest companies in the world don't know how not build applications that stores personal information. But since that company is Google, it hardly surprises anyone.
- iso1210 6y agoNot much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) There's nothing wrong with storing individual IPs temporarily for security and functionality purposes, but you're still collecting them - if nothing else they'll show up in your netflow sessions and your netstat output
- capableweb 6y ago> Not much point in hashing a (v4) IP, there's 4 billion of them, trivial to undo (you won't be able to change the salt) I didn't know! Here is my IP as a sha256, please reverse it and show me you actually know what you're talking about: 20adfe5288d85b6279dc65eff126828c0b20b896cb853caef9de0d6251e46169
- iso1210 6y agoTo do that I'd have to calculate 4 billion sha256 hashes. This quote is from 2012: "I do 622 million SHA-256's per sec on a Radeon HD5830." You might have salted it or encoded in a 'clever' way like hex or words or whatever, but as you know the method you can do it.