Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This seems like a very good reason to have a law about it: if the only reason you log IP addresses is that it's on by default and you haven't thought about the risks of storing it, you should think about it for your production servers. Otherwise it's purely a risk and has no benefit. (And the risk is to your users, not you, so it makes sense that a law would be needed to give your users the ability to complain about that needless risk.)

If you make the active decision that you specifically want the IP addresses, great, you can do that. Just have a strategy for keeping that sensitive data secure and getting rid of it at some point.



What's the risk of storing an IP address. IP addresses aren't people and most people have a carrier natted or rotating address.

The real question is what value does storing the IP address even hold?


The IP address is like a temporary phone number. It could not pinpoint the person persistently but can be tracked down with the help of ISP.

Other information you can retrieve from IP address is geolocation information such as https://www.ip2location.com


It's not a phone number because it doesn't need to resolve back to anything in particular. With carrier grade nat for instance, it could be shared by many people. At best it's shared by a house.

With regards of tracking you with the help of the ISP, if you have someone with those resources, it's not you storing an IP address that's their biggest concern.

Geoinformation can also change daily. Figuring it out afterwards isn't reliable.


- You can identify trends and patterns in your traffic

- You can figure out where in the world your traffic is coming from

- It can be helpful in responding to security incidents


- arbitrary user, session and request IDs

- this can be done and then discard the address

- how so? What does knowing the address months later help? Something like fail2ban and other automated systems, sure, but long term logging?


If it doesn't have value, why storing it then?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: