Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work from home. Why would a company I am about to do some work for ask for my IP address? What would they need it for? Should I be worried? Thanks

share|improve this question
2  
I don't understand why there are asking for your IP address. But be careful if they ask or try themselves to install something on your computer – VarunAgw Feb 3 at 21:40
4  
Just make sure you have a firewall that prevents connections being initiated from the outside into your home network (unless you specify exceptions), and they can't really do much with your IP other than use it in their firewall whitelist. – HorusKol Feb 4 at 1:14
80  
So I can put you in my development environment server's IP whitelist. You want control of your access, I want control of my access. It's a mutual protection thing. Even higher restrictions apply to the staging environment. I might not trust you enough to give you access there. – Fiasco Labs Feb 4 at 5:44
21  
When you connect to your company, they know your IP address anyway. What you're really telling them is that you own the IP address, not somebody else. – MSalters Feb 4 at 23:26
4  
This question reminded me of all the people back in the day in Quake 3 that would say "I've got your IP address" as a threat. Then I'd laugh. – Technik Empire Feb 6 at 0:49

10 Answers 10

This seems to be a persistent question. IP addresses aren't secrets. Every website you go to must know your IP address. There's no reason to not give away your IP address.

Many companies have firewalls that only allow certain addresses through to certain ports. This is a relatively common way of controlling access to resources with minimal effort.

However, most people don't have static IP addresses at home, and your IP address can suddenly change without notice. So just be aware that the IP you have today might not be the IP you have tomorrow.

share|improve this answer
    
Thanks Steve for your explanation, Though, if as you have written an IP address is dynamic and not static, does this mean access through their (the company) firewall would only be temporary. How often (on average if there is an average) does an IP change? Thanks again – Niall Feb 3 at 21:16
28  
@Niall There is no average. Mine only changes once every few months, but some of my friends on a different ISP get a new one about daily. – ceejayoz Feb 3 at 21:35
26  
Perhaps there should be a canonical answer for "what are the implications of giving away my IP address?". I've seen a lot of questions on Security.SE asking about IP adresses. Maybe making that the #1 Q/A Google result would diminish the amount of questions asked about it. – Chris Cirefice Feb 4 at 3:04
    
Comments are not for extended discussion; this conversation has been moved to chat. – schroeder Feb 4 at 21:20
1  
@ChrisCirefice See security.stackexchange.com/q/35160/10863 for the generic question. The answers are a bit specific, but the question is there. – Luc Feb 7 at 13:12

Why would a company I am about to do some work (working from home) for, ask for my IP address? What would they need it for? Should I be worried? Thanks

More than likely, they need to be able to white list your IP address, or IP range, to allow remote connections from your home. They need to know who's on their network, and why. There's nothing to worry about here.

Keep in mind, they will probably whitelist your dynamic IP range (likely 0-255), and not your actual IP address, unless it's static.

share|improve this answer
4  
@Niall If you found your IP address by a web search (e.g. whatsmyip.org ) then it must be your public one you're seeing. Your private IP address is used by your computer to talk to your router. It's not visible outside your home network. Your public IP address is the one your router uses to talk to the rest of the internet. If your public IP address changes every day, you must have a dynamic IP address, not a static one. – Simon B Feb 3 at 23:08
2  
@MarkBuffalo Using ipconfig/ifconfig will show you your INTERNAL IP address. The company would need the PUBLIC IP, which you can find by visiting a site like whatismyip.com – GroundZero Feb 4 at 15:38
1  
@GroundZero D'oh! I mixed up what he was saying. I skimmed his comment and thought he was asking for his private IP. That'll teach me to skim comments. Thanks for the catch. I'll fix that. – Mark Buffalo Feb 4 at 15:40
1  
@Niall: 192.168.xxx.xxx is private (typical for home router), 10.xxx.xxx.xxx is private (typical for a company, with a much more expensive setup). There is another range but I forgot the numbers because I have never seen it in real life. And 127.0.0.1 is "your computer". – gnasher729 Feb 4 at 23:25
4  
@mbomb007 Who decided that unplugging your modem at night is "good practice?" That sounds like a really annoying and rather useless practice to me, especially in the OP's case of working from home with a whitelisted IP address. He'd have to be calling them up and getting a new IP address whitelisted every time he gets a new lease, which could be daily if you do that. – reirab Feb 5 at 6:28

Since you share your IP on every occasion in the web, there is no problem. Usually the reason for this is that they want to whitelist your IP in their firewall to allow you to remotely access them. Apart from that: Giving away your IP can not really harm you.

Even if that one company knows your identity and can consequentially relate your IP to you, this does not imply that any third party can do so. There is no problem in giving someone your IP if that person knew your identity in the first place, no additional information is given.

Other third parties cannot find your name and physical address from your IP address, and you can’t find it from theirs.

Well at last not without help.

We’ve seen that using a whois lookup on an IP address will tell you the ISP that owns it. It’s that ISP that can then tell you who, exactly, that IP address is connected to.

Note that while they can tell you, that doesn’t mean that they will. That information is typically regarded as private and ISPs are not keen on giving it out. What they can and do respond to, however, are court orders.

share|improve this answer
    
Thanks AdHominen - I presume you mean you leak your Public IP on every occasion on the net - what happens if someone gets your Private IP and what exactly is your private IP? – Niall Feb 3 at 21:50
4  
@Niall, a private IP is simply one that can't be accessed from the public internet. For example, my home fileserver's IP is 192.168.1.10, while my desktop's is 192.168.1.6. I can access my fileserver from my desktop because both are on the same private-address network, but I can't access it from the library, because the fileserver doesn't have a public address. – Mark Feb 3 at 22:01
2  
@Niall if someone gets your private IP, nothing happens. He cannot use it, because it only works in your private network. Also there is a very very high chance your private IP is one of the 253 IPs in 192.168.1.[2-254] because that's the default in most home routers. – Josef Feb 4 at 11:48
1  
AdHominem your reasoning is flawed. There is a big difference between your IP address being associated with arbitrary web requests, and you explicitly declaring the link between your IP address and your personal identity. It's like, anyone knows that there is a house number 12 on Stack Overflow Street, but until you stand up in the town square and loudly declare that it's your house, your enemies probably won't have letterbombed it. – Lightness Races in Orbit Feb 5 at 11:22
    
I never even mentioned such difference. All I said was that you leak your IP everywhere anyways and that no one except your ISP can relate it to you as a natural person. – AdHominem Feb 5 at 11:27

Firewall whitelisting is the obvious answer, audit whitelisting might be the other.

If we know in advance to expect you to dial in from IPs associated with the northeastern US and all of a sudden we see you're successfully logging in from an IP address range in Guangdong, it's going to raise red flags.

share|improve this answer

Sounds like a poor man's VPN substitute. Normally the company's VPN should allow connections from anywhere, and then use one or two different authentication methods (or more).

It makes perfectly good sense to firewall off large blocks like China, but micromanaging IP addresses is a continuous administrative overhead.

Plus there are plenty of users who don't have static IP addresses, does your company update the ruleset every time someone blips their router/modem?

Answer No its not dangerous to share your IP, but it may be a sign of poor security practices masked by IP-based Access Lists.

share|improve this answer
13  
IP white listing isn't necessarily a sign of poor security practices if IP white listing is done in addition to a strong authentication method. The main reason for IP white listing is because IP white listing is enforced by a layer 3 firewall, which is a much faster and simpler device then higher layer firewalls that have to parse through more of the layers and/or maintain TCP sessions. IP blocking device can sift through a large volumetric attacks quickly and efficiently with modest hardware with little performance impact. – Lie Ryan Feb 4 at 14:53
1  
I upvoted this already, but I feel it needs re-iterating that IP whitelisting is a stopgap measure at best. It only works if you have a static address, it precludes the use of a general VPN from home, and it provides no security against attacks from behind your NAT, while making an implicit suggestion that you will be responsible for them. If you're working for a five person company, then maybe setting up the VPN isn't worth while, but for any bigger company, it is a sign of a lazy sysadmin. – Gordon Dove Feb 5 at 19:19

It's a common practice : for restricting an outside access to VPN and other services. You should not worry and use a static IP address - for your own safety, btw. Because if even someone will steal your password - he will not have your IP likely.

share|improve this answer
3  
That's assuming you can get a static IP address. My ISP does not offer them to residential customers. – Simon B Feb 3 at 23:03
    
@SimonB use a VPN service then, they are able to give you a single and your very own outbound IP – Alexey Vesnin Feb 3 at 23:06

Similar to [Alexey Vesnin] answer, we setup an external modem and firewall with an onion VPN connection. We configure the connection to run one specific application with username, password, and security questions. The firewall is configured for a static IP and mac address. If any other user/device tries to connect to that firewall it is kicked off. Employees can run personal internet through their own network card and firewall/router/modem.1

share|improve this answer

I work for a marketing and advertising agency. My company needs my IP address so that they can track how many times I visit ours, and our clients' websites (which we are monitoring to determine the effectiveness of our marketing and social media campaigns). Since I visit the site frequently to update blogs and edit content, my activities could skew the analytics.

share|improve this answer

It seems that it was not clearly stated yet in other answers: If you connect to any of your company servers, then they will immediately know your IP anyway (as would any other webserver). Knowing your IP most likely will also allow them to know your physical location (not very precise though).

If you want to hide your location for some reason, then you would need to use a proxy or something, but then again, they might not allow you in.

share|improve this answer

If you work at home and routinely connect to your company's website then they would have to know your IP since it would be in their logs. Who is doing the asking? Ask them for an explanation. No it is not routine as some have suggested. It may be that someone has been entering into their system to do something harmful and they are checking but, even then, all IPs are logged so it does not make any sense at all. Get an explanation and do not fail to mention that you understand that your IP should automatically appear in their logs so why do they have to ask for it.

share|improve this answer
2  
Telling an employer to search their logs to figure out your IP is asinine. A company should not have to parse gigs of log files because an employee didn't feel like providing their IP. See @Fiasco Labs answer to see why a company would need a WFM employee's IP. – cremefraiche Feb 7 at 4:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.