Threat Model? The threat is EU regulation. Mitigate by 'pseudoanonymisation', as called for by Reg. (EU) 2016/679. Technically this makes no sense. Legally, it's perfect to avoid a €20 million lawsuit.https://twitter.com/marcan42/status/999643376168325121 …
-
-
Replying to @BSZaidan
Legally it's nonsense, because if I can extract the original IP addresses, it's not anonymisation, it's masturbation. If I can crack the hashes on a laptop in a few minutes, for zero cost other than electricity, any competent judge will rule that it was not effectively anonymisedpic.twitter.com/ARIxlvh9gk
2 replies 1 retweet 1 like -
Also, even if such a stupidly broken scheme would pass legal muster, there is *no freaking reason* to not just fix the problem instead of exposing yourself. There is absolutely no excuse for bad crypto and bad random number generators. Period.
1 reply 0 retweets 1 like -
-
Replying to @BSZaidan
I filed an issue. I have no reason to believe the author won't fix it, yet. Just complaining about the orig version. I'm not actually interested in the plugin myself, because I don't need stats and hashed IPs are not useful to me. I just started truncating the last octet for now.
1 reply 0 retweets 1 like -
I.e. hashed IPs are only useful if you want to do precise correlation of lots/all logs in a time window, but the only reason I keep logs (for a limited time) is for debugging and abuse, and for that I care more about knowing the ISP/country than individual IPs.
1 reply 0 retweets 0 likes -
Replying to @marcan42
Short of encrypting log files, there's nothing I'm aware of that can do what GDPR requires. That's where this one falls short, too.
1 reply 0 retweets 0 likes -
Replying to @BSZaidan
I don't think anyone (without a lawyer army) *knows* what you can/can't, must/must not do for GDPR compliance yet. For corporate stuff, it's the lawyers' problem, not mine. Personal stuff, I don't use trackers/ads and have reduced log retention, waiting for better info ¯\_(ツ)_/¯
1 reply 0 retweets 0 likes -
Replying to @marcan42
We won't know until the first lawsuit. In my case, I'm retaining logs for 7 days for 'reasons of service abuse' and then deleting it until further notice.
1 reply 0 retweets 0 likes
I went with 14 days for now (and only 24 bits of IPv4s, 48 of IPv6s). We'll see what happens.
-
-
48 bits could be too many bits. Many providers give a /48 subnet per customer.
1 reply 0 retweets 0 likes -
Could be, though AIUI the whole GDPR thing is about natural people, and assigning a /48 to an individual is rare. My hosting provider gives me a (single) /48 for me to use across all my servers, but I haven't seen any residential ISPs doing that for individuals.
1 reply 0 retweets 0 likes - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.