News for hackers. Stuff that matters.

A comment on The Nightmare Letter: A Subject Access Request Under GDPR. Parent comment

Re:The Nightmare Letter: A Subject Access Request Under GDPR by geofft on Saturday March 17, 2018 @02:46PM (#16608397)
This seems like a very good reason to have a law about it: if the only reason you log IP addresses is that it's on by default and you haven't thought about the risks of storing it, you should think about it for your production servers. Otherwise it's purely a risk and has no benefit. (And the risk is to your users, not you, so it makes sense that a law would be needed to give your users the ability to complain about that needless risk.)

If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by jimktrains2 on Saturday March 17, 2018 @04:39PM (#16608949)
What's the risk of storing an IP address. IP addresses aren't people and most people have a carrier natted or rotating address.

The real question is what value does storing the IP address even hold?

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by alam2000 on Sunday March 18, 2018 @06:44AM (#16611290)
The IP address is like a temporary phone number. It could not pinpoint the person persistently but can be tracked down with the help of ISP.

Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by jimktrains2 on Sunday March 18, 2018 @07:19AM (#16611407)
It's not a phone number because it doesn't need to resolve back to anything in particular. With carrier grade nat for instance, it could be shared by many people. At best it's shared by a house.

With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern.

Geoinformation can also change daily. Figuring it out afterwards isn't reliable.

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by hotwire on Saturday March 17, 2018 @07:09PM (#16609537)
- You can identify trends and patterns in your traffic

- You can figure out where in the world your traffic is coming from

- It can be helpful in responding to security incidents

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by jimktrains2 on Saturday March 17, 2018 @07:21PM (#16609599)
- arbitrary user, session and request IDs

- this can be done and then discard the address

- how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?

[ Parent | on HN ]
Re:The Nightmare Letter: A Subject Access Request Under GDPR by chopin on Monday March 19, 2018 @04:39AM (#16616891)
If it doesn't have value, why storing it then?
[ Parent | on HN ]