Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Will Hit Dev Teams Harder Than GDPR

tonic.ai

Post reply on HN
Print view View original

71–80 of 179 posts

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#71

Post by gregmac »

saalweachter wrote: post #61
ghayes wrote: post #58

Earlier quoted context omitted.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

IPv4 addresses are only 32 bits, which makes building rainbow tables almost trivial.

Yeah, though a salt would at least mean you'd have to rebuild the table for each site/database/whatever. However I'm having a hard time seeing how to really protect against this.

The IP is a an identifier, so unlike password salt (where the user is the identifier) you need a way to know what the salt is to hash the IP, and it needs to be consistent.

You can do a lookup table of IP-to-salt, but this either gives away your list of addresses (if only containing IPs you've seen) or is huge (entire ipv4 range), and either way doesn't prevent rainbow tables.

You can have a static salt for the entire site, but again this is not really helping much against rainbow tables (beyond requiring recalculating the table, once).

Is there a mitigation I'm not thinking of?

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#72

Post by recursive »

saalweachter wrote: post #61
ghayes wrote: post #58

Earlier quoted context omitted.

Could you salt and perform a one-way hash on the IP address and store that? It would alleviate a large amount of leakage issues while still giving you uniqueness counts.

IPv4 addresses are only 32 bits, which makes building rainbow tables almost trivial.

I thought salt was supposed to be unique per hashed value. Rainbow tables don't work in that case.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#73

Post by heavenlyblue »

Novashi wrote: post #41
figgis wrote: post #31

Earlier quoted context omitted.

>So if a random company gets breached, everyone involved from cloud providers to ISPs are also responsible because they facilitated moving and storing the data and they are just hosting code? ISP's aren't (supposed to be) "storing" that data. They are transferring bits between computers. You on the other hand are hosting a website with some sort of form that people input PII into. You are accepting that PII, whether…

>You on the other hand are hosting a website with some sort of form that people input PII into. That's what cloud providers do! If there's a spirit-of-the-law that is supposed to protect them, this would be a good time to write that in!

Do they specifically mention rental cars in the code of law, when they say that the driver can't drive over the speed limit?

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#74

Post by thaumaturgy »

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

There's been a lot of FUD surrounding the logging of IP addresses for network diagnostic and abuse purposes as a violation of GDPR (and now CCPA), but I'm not aware of any cases where that alone was sufficient to cripple a business.

Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#75

Post by sjjshzvuiajhz »

alkonaut wrote: post #39
gwbas1c wrote: post #4

Great article, until the end. Who uses PII in test data derived from real customers? That's just an absurd practice to begin with, and no one who takes security seriously would even consider doing this.

I have never seen a “dev” instance of a DB that wasn’t just a snapshot of the prod DB from earlier. I admit haven’t seen many - but I have seen zero of any other kind (e.g. anonymized or synthetic)

Just going to throw out there that I’ve never seen a dev database that was anything other than fake data, or internal dogfood data. Have worked at major public tech companies and late-stage startups.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#76

Post by skybrian »

carbocation wrote: post #66
jordigh wrote: post #48

Earlier quoted context omitted.

Because it is super-risky to consider these things on their own merits if you are not the kind of person who regularly interacts with judges and juries. Laws are something that are applied within a particular kind of, ah, culture. You have to be familiar with the body of work of that culture and how they will likely interpret the law. Trying to interpret laws in ignorance of that culture is likely to lead to interpre…

Does everyone downvote all medical speculation in the numerous health threads on this site? No. It's fine for people to speculate about medical ideas, legal ideas, etc. Especially on a forum like this where there is no pretense that people are offering genuine legal advice.

Or maybe we should express less confidence in our assertions about medicine?

After all, most of the time, people are writing about things they don't know all that much about.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#77

Post by carbocation »

skybrian wrote: post #76
carbocation wrote: post #66

Earlier quoted context omitted.

Does everyone downvote all medical speculation in the numerous health threads on this site? No. It's fine for people to speculate about medical ideas, legal ideas, etc. Especially on a forum like this where there is no pretense that people are offering genuine legal advice.

Or maybe we should express less confidence in our assertions about medicine? After all, most of the time, people are writing about things they don't know all that much about.

To be honest, one or the other should be the case.

Either wild speculation on medicine and law should be fine (this is my position).

Or, people should fear medical speculation as much as they do legal speculation (I think this is the more pathetic option).

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#78

Post by mises »

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Especially considering many home connections don't even have static ips any more. Websites can't tell whether or not the IP is static or dynamic; it would be pretty silly for them to use it too.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#79

Post by msla »

thaumaturgy wrote: post #74
jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

There's been a lot of FUD surrounding the logging of IP addresses for network diagnostic and abuse purposes as a violation of GDPR (and now CCPA), but I'm not aware of any cases where that alone was sufficient to cripple a business. Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

> Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

And you're probably right until they do otherwise.

The problem with badly-drafted laws is that they can be used to attack people who are annoying but who haven't done anything wrong... except for technically violating a law which is "supposed to" mean something else but which can be read to penalize some harmless activity the gadfly happened to engage in.

So, maybe you'll be patient when I'm not comforted by people telling me to not worry about it.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#80

Post by amenghra »

gregmac wrote: post #71
saalweachter wrote: post #61

Earlier quoted context omitted.

IPv4 addresses are only 32 bits, which makes building rainbow tables almost trivial.

Yeah, though a salt would at least mean you'd have to rebuild the table for each site/database/whatever. However I'm having a hard time seeing how to really protect against this. The IP is a an identifier, so unlike password salt (where the user is the identifier) you need a way to know what the salt is to hash the IP, and it needs to be consistent. You can do a lookup table of IP-to-salt, but this either gives away…

You could encrypt instead of hash, and then have some policy (e.g. the decryption library/service/piece will only allow decrypting ciphertext newer than 30 days).

If you need the ability to group ciphertexts without decrypting them, you could create a scheme which will make cryptographers cringe, but could be justified in this specific case.

Post reply on HN