111–120 of 179 posts
Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.
Throwaway for obvious reasons.
Earlier quoted context omitted.
I thought salt was supposed to be unique per hashed value. Rainbow tables don't work in that case.
For passwords, yes, this is generally best practice. Also, the salt is normally stored with the hashed password, as it’s not regarded as a secret. Modern GPUs can manage several thousand million SHA256 hashes/sec, so even with a salt per hash it’s not going to take long to get a given entry, given the 32bit address space of IPv4
Earlier quoted context omitted.
And that’s problematic for someone trying to understand if their business operations are legal.
Courts are not run by robots, judges are generally smart people. I agree - I think most people overthink the whole IP == PII nonsense. I think it’s more likely that IP + other factors, and your USE (or misuse) is where things become more gray.
When using personal data is outlawed, only the outlaws will use personal data. What about all of the state actors (and 'hackers') who are cracking corporations for data and building a massive database on everyone?
> When using personal data is outlawed, only the outlaws will use personal data. This argument only works if you feel the thing being outlawed is good (it is most commonly used in the context of privacy). To your statement I would respond the same way as I would respond to "When shooting people is outlawed, only the outlaws will shoot people": sounds good to me!
Earlier quoted context omitted.
Courts are not run by robots, judges are generally smart people. I agree - I think most people overthink the whole IP == PII nonsense. I think it’s more likely that IP + other factors, and your USE (or misuse) is where things become more gray.
I think the whole point of the rule of law (versus rule of authority) is to remove some of the massive ambiguity about enforcement and make the courts a bit more “robotic” and regular. You don’t want a situation where it’s luck of the draw on a judge, or where the ambiguity allows selective enforcement against people one judge or prosecutor particularly dislikes.
But we also have to have a certain pragmatism when deciding how to behave in a society with an impossible legal system. How much effort should I, as a developer or as a consultant to business owners or as a systems administrator, spend on purging IP addresses versus all the other things that need attention?
For that we look to how the law is applied in practice.
I was active on Slashdot back when the DMCA was first proposed and then fought its way into becoming law. There is no topic about which HN is as rancorous as Slashdot was about the DMCA. What does the situation look like now, twenty years later? Yes, there are and have been and continue to be abuses of the DMCA, but not at the internet-destroying scale that Slashdot predicted.
So I'm not going to tell you to ignore IP addresses in your log files. That's up to your judgement. But I'm going to ignore them in mine, until I see a reason to do otherwise, and when it's a topic of discussion with others, I'll tell them that according to a strict reading of the law, logged IP addresses may be a liability, but that there have been exactly 0 cases to date which have been only about some business having IP addresses in its logs for abuse and diagnostic purposes.
Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.
Household IP Targeting - https://www.vicimediainc.com/ip-targeting-direct-mail-intern...
Or even just your ISP (who for sure know your IP addr and your address) - https://arstechnica.com/information-technology/2017/03/how-i...
The larger issue that we (HN tech people) treat IPs as fallible because we're thinking of it like an absolute. The advertising side of the Internet looks at them like a goldmine b/c even a 75% correlation to "truth" can still make their ads reach the people they're trying to reach in a much cheaper way.
Earlier quoted context omitted.
Aren't IP addresses used as PII by companies to track users that have profiles but aren't logged in?
I’d hope not. From the company’s perspective, there’s never any guarantee at all that an IP is going to be 1:1 to a real identity. IPs will be dynamically reassigned to new consumers constantly, and there are many situations where you’ll have many (some times very many) users sitting behind the same IP. The only situation I’ve come across where some level of PII has been retrieved from an IP are services that will be…
Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.
Earlier quoted context omitted.
Or maybe we should express less confidence in our assertions about medicine? After all, most of the time, people are writing about things they don't know all that much about.
To be honest, one or the other should be the case. Either wild speculation on medicine and law should be fine (this is my position). Or, people should fear medical speculation as much as they do legal speculation (I think this is the more pathetic option).
More to the point -- that idea of a "legal hack" could fail to hold up in court for a variety of reasons, and really the idea of a legal hack in general is really not how anyone who has any experience with the law would expect it to work, at least in the United States. And in a lot of cases, if you try to outwit it through a loophole when you know the spirit of the law, that's even worse.
The more pathetic option is people wildly speculating on things they know nothing about as opposed to educating themselves, or at the very least humbly being aware of their own ignorance. Your position is one that has gotten many like you in trouble they can't get out of. It'll bite you too, if you're ever foolish enough to act on it.
To anyone out there with a dim view of professional opinions: get a professional opinion when it comes to things like this. Be an adult. Do not try and DIY it. These are situations where the risk reward calculus contains very little reward on one end for remaining compliant and extreme negative consequences on the other end. Learn how to manage the professional opinion haver. The good ones will save you a world of pain with the ounces of prevention that you'll never regret investing in.