CCPA Will Hit Dev Teams Harder Than GDPR • Hacker News Board

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#91

Post by darkr » Fri, Feb 01, 2019, 1:21 AM UTC

recursive wrote: post #72

saalweachter wrote: post #61

Earlier quoted context omitted.

IPv4 addresses are only 32 bits, which makes building rainbow tables almost trivial.

I thought salt was supposed to be unique per hashed value. Rainbow tables don't work in that case.

For passwords, yes, this is generally best practice. Also, the salt is normally stored with the hashed password, as it’s not regarded as a secret.

Modern GPUs can manage several thousand million SHA256 hashes/sec, so even with a salt per hash it’s not going to take long to get a given entry, given the 32bit address space of IPv4

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#92

Post by Pyxl101 » Fri, Feb 01, 2019, 1:24 AM UTC

icoe wrote: post #14

fuzzy2 wrote: post #7

ot: What's wrong with this website? It loads super slow and behaves very weirdly on my iPhone.

Apologies. We're using wix right now. We'll be moving off shortly.

I'm on a PC and the site was also behaving strangely for me. The site doesn't display a scroll bar, so I could not scroll down and read the article. It worked using a different browser.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#93

Post by SquishyPanda23 » Fri, Feb 01, 2019, 1:27 AM UTC

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Aren't IP addresses used as PII by companies to track users that have profiles but aren't logged in?

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#94

Post by DiabloD3 » Fri, Feb 01, 2019, 1:29 AM UTC

So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative?

It is a state law, they can't hassle you if you're not Californian and do not service their target market. Most of America doesn't live there, and California seemingly doesn't want you to do business there.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#95

Post by darkr » Fri, Feb 01, 2019, 1:31 AM UTC

thaumaturgy wrote: post #74

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

There's been a lot of FUD surrounding the logging of IP addresses for network diagnostic and abuse purposes as a violation of GDPR (and now CCPA), but I'm not aware of any cases where that alone was sufficient to cripple a business. Until I hear otherwise, I'm going to gamble that for now that's not the kind of reckless mishandling of personal information that regulators are trying to crack down on.

The advice we were given, and my general understanding is that you absolutely have the right to use IP addresses for network diagnostic and [anti-] abuse purposes. What you can’t do is leave those IP addresses lying around unsecured, share them with anyone who doesn’t have a legitimate requirement for access, or otherwise use them for random purposes. Also, you probably need a lifecycle policy so you don’t hang onto that data indefinitely.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#96

Post by gleenn » Fri, Feb 01, 2019, 1:36 AM UTC

DiabloD3 wrote: post #94

So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative? It is a state law, they can't hassle you if you're not Californian and do not service their target market. Most of America doesn't live there, and California seemingly doesn't want you to do business there.

Because there are a huge number of users in California, and it’s also the fifth largest economy in the world. Ignoring California is probably throwing away a big market.

You could say that about Europe to wrt GDPR but you should note that almost everyone is becoming GDPR compliant too because it’s a big market.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#97

Post by Novashi » Fri, Feb 01, 2019, 1:41 AM UTC

DiabloD3 wrote: post #94

So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative? It is a state law, they can't hassle you if you're not Californian and do not service their target market. Most of America doesn't live there, and California seemingly doesn't want you to do business there.

>So, devil's advocate here: why not just require your ToS to state that if the user is from the state of California, that they are to not use the service and find a local alternative?

Silently redirect them to a similar-enough site run by a partner company that's based in another state/country.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#98

Post by AmericanChopper » Fri, Feb 01, 2019, 1:41 AM UTC

SquishyPanda23 wrote: post #93

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

Aren't IP addresses used as PII by companies to track users that have profiles but aren't logged in?

I’d hope not. From the company’s perspective, there’s never any guarantee at all that an IP is going to be 1:1 to a real identity. IPs will be dynamically reassigned to new consumers constantly, and there are many situations where you’ll have many (some times very many) users sitting behind the same IP. The only situation I’ve come across where some level of PII has been retrieved from an IP are services that will be able to link an IP to a particular company’s office. I’ve seen that used in Account Based Marketing funnels where you can get information that ‘somebody at ACME Corp viewed these pages on your website’.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#99

Post by sheeper » Fri, Feb 01, 2019, 1:49 AM UTC

jarvuschris wrote: post #37

Counting an IP address as PII is kind of crappy, you need a court order to turn an IP alone into PII. Operators should be free to log traffic at the network level, PII should only come into play once you're asking someone to provide personal information.

CCPA will probably be amended at least once more before it goes into effect. If you feel that it shouldn't apply to non-membership website operators who merely log IP address and requested URL... consider writing to your California State Assemblymember and California State Senator, and possibly to the California Attorney General who will be publishing guidance regarding CCPA.

Amusingly enough, California consumers will not have privacy rights regarding any written comments sent to the California Attorney General.

Re: CCPA Will Hit Dev Teams Harder Than GDPR

#100

Post by afpx » Fri, Feb 01, 2019, 1:50 AM UTC

When using personal data is outlawed, only the outlaws will use personal data.

What about all of the state actors (and 'hackers') who are cracking corporations for data and building a massive database on everyone?