Timeline for Is there any actual security benefit to restricting foreign IP addresses?
Current License: CC BY-SA 4.0
30 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 28, 2023 at 3:41 | comment | added | user5623335 | If Apple are blocking connections to Apple.com from Kenya, even displaying a message saying sorry but there is too much fraud from your country, then I think it is safe to copy the big boys. | |
| Jun 7, 2022 at 14:09 | answer | added | questioner | timeline score: 0 | |
| Sep 19, 2019 at 11:32 | comment | added | user3819867 | @Davidmh They gave advice based on a call, they can argue that they were not targeting the EU, the tweak was granted after specific permission granted by the data subject. | |
| Sep 19, 2019 at 11:27 | comment | added | Davidmh | @user3819867 if that were the case, a VPN does not solve the issue, and since they explicitly recommended it, they cannot even argue that you bypassed their security systems willingly. | |
| S Sep 19, 2019 at 10:20 | history | suggested | Peter Mortensen | CC BY-SA 4.0 |
IP is a protocol; it is IP addresses that are static, blocked, assigned, bound, fetched, accessed, tried, resolved, checked, banned, generated, tracked, chosen, detected, dynamic, grabbed, scanned, whitelisted, shared, have different representations, that devices have, etc., not the protocol itself.
|
| Sep 19, 2019 at 10:18 | review | Suggested edits | |||
| S Sep 19, 2019 at 10:20 | |||||
| Sep 18, 2019 at 20:11 | comment | added | Relaxed | Meanwhile the paragraph in which you found this quote (and the whole chapter) is about the establishment criteria defined in article 3(1), i.e. “activities of an establishment of a controller or processor in the Union”. Assuming the health care provider is based in the US and does not have any operation or subsidiary in Europe, it would not fall under article 3(1). Data collected by an American processor about an American resident visiting Europe might still fall under the regulation but that would be under article 3(2), not 3(1). | |
| Sep 18, 2019 at 20:10 | comment | added | Relaxed | @user3819867 Your conclusion is not necessarily wrong but the linked document and the quote are not about that. Recital 14 is about the distinction between legal and natural persons, it certainly does not mean that the GDPR applies to everybody everywhere all the time, the processing must still meet the criteria laid out in article 3. If it weren't so, putting a firewall would achieve nothing, the regulation would also cover American citizens who never left the US. | |
| Sep 18, 2019 at 16:00 | comment | added | WoJ | @user3819867: (...) a single US citizen that stays four months in the EU (thus becoming resident) (...) Staying four months in the EU does not make you a "resident". The EU Resident Card is something one applies for (there are restrictions), and then there is the "Long Term Resident" status you acquire after 5 years. | |
| Sep 18, 2019 at 14:07 | comment | added | Džuris | I'm not a security expert either, but shouldn't someone mention DDOS attacks explicitly? It seems that geo-bans could significantly impair worldwide botnets. | |
| Sep 17, 2019 at 18:28 | answer | added | Steve Sether | timeline score: 3 | |
| Sep 17, 2019 at 16:21 | answer | added | Guntram Blohm | timeline score: 9 | |
| Sep 17, 2019 at 11:07 | comment | added | user3819867 | “The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data”. Even if it weren't so, a single US citizen that stays four months in the EU (thus becoming resident) can potentially cost you up to 4% of your turnover. Would you open that for debate or would you shut it off by a simple technical step? | |
| Sep 17, 2019 at 10:12 | comment | added | schroeder♦ | @user3819867 has a valid point, because it is not just about "clients" or "customers" but visitors to the site. If the site has tracking tech that would require a notice to data subjects, then it can make sense to block EU visitors in order to reduce the privacy notice and compliance headache. Lots of US companies block EU visitors for this reason (newspapers are an annoying example right now). | |
| Sep 17, 2019 at 10:03 | comment | added | sleske | @user3819867: Just because someone connects from Europe does not mean they are an "EU client". GDPR only applies to "EU residents", not to US residents who happen to be in Europe. So an IP block is not necessary for GDPR compliance, it's enough to check people's addresses (presumably you need the address during client signup anyway). | |
| Sep 17, 2019 at 10:03 | comment | added | TripeHound | @user3819867 From what I've seen (but am not an expert) I don't think the GDPR applies to US-held data of a US person who happens to be in Europe when they want to access it. | |
| Sep 17, 2019 at 9:31 | vote | accept | Matthew Nichols | ||
| Sep 17, 2019 at 9:10 | comment | added | user3819867 | A health care provider typically handles sensitive data. If they open up to EU clients, they need to cover for GDPR's strict guidelines. IMHO they dodged a bullet there from a legal angle. | |
| Sep 17, 2019 at 7:08 | comment | added | thomasrutter | There are ongoing technical challenges inherent in this: actively maintaining your geo IP list due to new allocation (less relevant in IPv4 now) and redistribution of existing IP blocks between countries in an RIR or between RIRs. You've also got the expansion of new IPv6 blocks, the growing use of carrier NAT, etc | |
| Sep 17, 2019 at 5:35 | review | Close votes | |||
| Sep 24, 2019 at 3:05 | |||||
| Sep 17, 2019 at 5:23 | comment | added | Zaibis | Or security.stackexchange.com/q/146070/56061 | |
| Sep 17, 2019 at 5:19 | comment | added | Zaibis | Possible duplicate of Is blacklisting IP addresses a waste of time? | |
| Sep 17, 2019 at 0:45 | history | became hot network question | |||
| Sep 17, 2019 at 0:00 | history | tweeted | twitter.com/StackSecurity/status/1173748543519109122 | ||
| Sep 16, 2019 at 16:53 | history | edited | schroeder♦ |
edited tags
|
|
| Sep 16, 2019 at 16:42 | answer | added | schroeder♦ | timeline score: 169 | |
| Sep 16, 2019 at 16:41 | comment | added | Ghedipunk | It may mitigate the random port scans that come from botnets. It's like a picket fence; kids aren't going to run into your yard, but it's not going to stop a burglar who has targeted your house. | |
| Sep 16, 2019 at 16:38 | history | edited | schroeder♦ |
edited tags; edited tags
|
|
| Sep 16, 2019 at 16:35 | review | First posts | |||
| Sep 16, 2019 at 18:56 | |||||
| Sep 16, 2019 at 16:33 | history | asked | Matthew Nichols | CC BY-SA 4.0 |