5 ms·

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what add

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

srockets 2y ago
An IP address in itself is not an identity, but it can be easily resolved to one. This is why IP address are considered PII, and are handled like such by any competent security organization.
- fiso64 2y ago
  >but it can be easily resolved to one Do you have any source to back that up? Last I heard a random person or company won't have a way to find out the real identity given just an IP in general.
  - srockets 2y ago
    Per multiple opinions I got from people whose job was to advise me on the matter, a 2016 ECJ ruling[0] suggests that it doesn't matter if a provider can find a person from their IP address or any other detail, but that there exists a scenario where it is possible. I am not sure how the CCPA treats IP address, but unless you're at Google or Facebook, it doesn't matter. Few can afford to build separately for the EU and the rest of the world, and hence err on adapting the strictest interpretation. -- [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62014CJ0582 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
  - paledot 2y ago
    But the threat actor in this case is a state, which does have that ability. (And data brokers of varying degrees of shadiness can and do provide this info to anyone for a price.)
matheusmoreira 2y ago
> I suspect governments and ISPs all keep historical logs of who was assigned what address. They do. It's often required by law.
- VelesDude 2y ago
  1 maybe 2KB of storage for the IP addresses of an individual for a year. Of course they are doing it even if accidentally.
  - Sayrus 2y ago
    You may need a bit more than that. Especially for shared IPs or when using CGNAT as you need which IP and Port-range was used and during what time-range.
zzz999 2y ago
[dead]
refurb 2y ago
It can be used to identify a location, but not an individual. I assume it could be easily challenged in court (network was compromised, “i give out my WiFi to anyone who visits my home”) without other supporting evidence.
- BodyCulture 2y ago
  It would be great to have the discussion open for people with actual knowledge and experience of the issues. To keep the discussion interesting, please do not assume or guess, thanks!
- Adrox 2y ago
  Not in Germany, where you are responsible for the Wifi access, see hundreds of copyrights fines each year... Anyway, it puts the persons living in that location on the radar of the police, and other evidence can be collected (For example by getting a warrant and taking all electronics out of the "location").
  - immibis 2y ago
    Apparently in Germany you can do public wifi now, but you have to register as a telecommunications provider, and comply with all law enforcement requests to wiretap your wifi.

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

srockets 2y ago

An IP address in itself is not an identity, but it can be easily resolved to one. This is why IP address are considered PII, and are handled like such by any competent security organization.

fiso64 2y ago
>but it can be easily resolved to one Do you have any source to back that up? Last I heard a random person or company won't have a way to find out the real identity given just an IP in general.
- srockets 2y ago
  Per multiple opinions I got from people whose job was to advise me on the matter, a 2016 ECJ ruling[0] suggests that it doesn't matter if a provider can find a person from their IP address or any other detail, but that there exists a scenario where it is possible. I am not sure how the CCPA treats IP address, but unless you're at Google or Facebook, it doesn't matter. Few can afford to build separately for the EU and the rest of the world, and hence err on adapting the strictest interpretation. -- [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62014CJ0582 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- paledot 2y ago
  But the threat actor in this case is a state, which does have that ability. (And data brokers of varying degrees of shadiness can and do provide this info to anyone for a price.)

matheusmoreira 2y ago

> I suspect governments and ISPs all keep historical logs of who was assigned what address. They do. It's often required by law.

VelesDude 2y ago
1 maybe 2KB of storage for the IP addresses of an individual for a year. Of course they are doing it even if accidentally.
- Sayrus 2y ago
  You may need a bit more than that. Especially for shared IPs or when using CGNAT as you need which IP and Port-range was used and during what time-range.

zzz999 2y ago

[dead]

refurb 2y ago

It can be used to identify a location, but not an individual. I assume it could be easily challenged in court (network was compromised, “i give out my WiFi to anyone who visits my home”) without other supporting evidence.

BodyCulture 2y ago
It would be great to have the discussion open for people with actual knowledge and experience of the issues. To keep the discussion interesting, please do not assume or guess, thanks!
Adrox 2y ago
Not in Germany, where you are responsible for the Wifi access, see hundreds of copyrights fines each year... Anyway, it puts the persons living in that location on the radar of the police, and other evidence can be collected (For example by getting a warrant and taking all electronics out of the "location").
- immibis 2y ago
  Apparently in Germany you can do public wifi now, but you have to register as a telecommunications provider, and comply with all law enforcement requests to wiretap your wifi.