7 ms·

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform anal

Who in their right mind would not store a visitor's IP address. How are you supposed to handle abuse or performance issues a visitor might have? Or perform analytics? It makes sense to not store if you're running some kind of privacy service.

jamie_ca 4y ago
Hash the IP so you can tie sessions, and do frequency analysis for abuse, without having the raw IP that can be geo-decoded?
- throwaway2016a 4y ago
  Hashing IPs is ineffective, the IP namespace is so small a rainbow table (or even brute force) would be trivial so effectively the hash of an I is identical to the IP itself. Unless you salt it but if you do that it becomes useless for analytical, fraud prevention, and security purposes. Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.
deleted 4y ago
[deleted]
kyriakos 4y ago
GDPR doesn't ask not to store it but it's a matter if how it's used once you do. For example it should be kept only as long as its needed, for example for the case of abuse if you are required to investigate abuse cases up to 3 months in the past you don't need to keep the IP assesses longer than that. If you do then you breach gdpr. In addition if the user requests his information deleted then unless that user is under investigation at the time you got 30 days to delete his data and forget he ever existed.
Tainnor 4y ago
> How are you supposed to handle abuse or performance issues a visitor might have? There is such a thing as "legitimate interests" in the GDPR. Storing certain IPs specifically as a measure against spammers and botnets should be fine, as long as that's really all you do with the data. > Or perform analytics? This is the heart of why the GDPR exists. You are not allowed to collect and analyse personal data about your users without a legitimate reason or their consent (a legitimate reason is not "it pays our bills"). Either ask the user for permission or only store aggregated data. Most companies just store a ton of data about users without having any clue what to with it, "just in case". If you collect data for specific purposes, you don't need it to necessarily include any personal info ("how many users clicked the red button instead of the blue one" doesn't require any PII, for example).
einpoklum 4y ago
> Who in their right mind would not store a visitor's IP address. Everyone who's mindful of site visitor's privacy. > How are you supposed to handle abuse or performance issues a visitor might have? How does a static website handle those issues? ... you've developed a warped default of what a website is. > Or perform analytics? You can base your analytics on voluntarily provided information from users. Or just, like, _not_ do them.

jamie_ca 4y ago

Hash the IP so you can tie sessions, and do frequency analysis for abuse, without having the raw IP that can be geo-decoded?

throwaway2016a 4y ago
Hashing IPs is ineffective, the IP namespace is so small a rainbow table (or even brute force) would be trivial so effectively the hash of an I is identical to the IP itself. Unless you salt it but if you do that it becomes useless for analytical, fraud prevention, and security purposes. Same goes for credit card numbers, as an aside, I saw a credit card number being hashed in an app I was consulting on once... don't do that. Rainbow tables are stupid simple on inputs that small.

deleted 4y ago

[deleted]

kyriakos 4y ago

GDPR doesn't ask not to store it but it's a matter if how it's used once you do. For example it should be kept only as long as its needed, for example for the case of abuse if you are required to investigate abuse cases up to 3 months in the past you don't need to keep the IP assesses longer than that. If you do then you breach gdpr. In addition if the user requests his information deleted then unless that user is under investigation at the time you got 30 days to delete his data and forget he ever existed.

Tainnor 4y ago

> How are you supposed to handle abuse or performance issues a visitor might have? There is such a thing as "legitimate interests" in the GDPR. Storing certain IPs specifically as a measure against spammers and botnets should be fine, as long as that's really all you do with the data. > Or perform analytics? This is the heart of why the GDPR exists. You are not allowed to collect and analyse personal data about your users without a legitimate reason or their consent (a legitimate reason is not "it pays our bills"). Either ask the user for permission or only store aggregated data. Most companies just store a ton of data about users without having any clue what to with it, "just in case". If you collect data for specific purposes, you don't need it to necessarily include any personal info ("how many users clicked the red button instead of the blue one" doesn't require any PII, for example).

einpoklum 4y ago

> Who in their right mind would not store a visitor's IP address. Everyone who's mindful of site visitor's privacy. > How are you supposed to handle abuse or performance issues a visitor might have? How does a static website handle those issues? ... you've developed a warped default of what a website is. > Or perform analytics? You can base your analytics on voluntarily provided information from users. Or just, like, _not_ do them.