1

I would like to implement a "Login from a suspicious location" email for my users.

The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the distance between the current login and the geographically closest prior login for a threshold.

The problem I'm seeing is that to achieve this, I would need to store the latitude and longitude of all the prior logins attached to the user. This is a problem because even though I'm taking maximum precautions, I try to assume everything in my SQL database may be public knowledge someday after a breach. I don't want to be storing information that could be upsetting to users following a breach.

Is there a strategy I can follow to determine if a login is from an atypical location? I can only see two theoretical ways to achieve this, but I haven't been able to come up with a suitable solution to either.

  1. Keeping the accurate location, but use a hypothetical one-way-function to anonymize ownership.
  2. Determine the distance between two or more locations without ever knowing the real world locations

Has anyone else tackled this problem in a privacy conscious way?

Improve this question
2
  • You don't have to store the accurate location, just store an approximate location (maybe just the country). Because of ISP NATs, GeoIP often doesn't give a very accurate location anyways, so storing an accurate location really doesn't make sense.
    – nobody
    Feb 2, 2021 at 17:33
  • My original thinking with precise location is that some people who live along borders, or in countries with free travel between them like the European Union may see a high number of country-change. Possibly even commuting to work in a different country. I suppose though after a handful of logins from two countries I could consider both of those countries expected for that user.
    – anthonyryan1
    Feb 2, 2021 at 18:31

1 Answer 1

Reset to default
2

You have several options:

1. Give users a choice

Ask users if they would like to enable a feature which alerts them when there is a login attempt from a location that is far away from their previous login attempts; and inform them that in order to do so, you will need to save data from where they have logged in.

By disabling this feature by default, you show that you care about your user's privacy and if a user wishes to trade in a potential loss in privacy for potentially higher security, that is their explicit choice.

2. Just use the data you already have

It is not universally agreed on whether IP addresses are personal data or not, so depending on where you are operating, storing a user's previous IP addresses may be possible. However, even under GDPR, you can require users to consent to storing the IP addresses they have used to log into the service.

You can then use the IP addresses to look up which geographic region they belong to. While the level of detail varies somewhere between "this country" or "this part of this city", it's good enough for your purposes. If you know the user keeps logging in from Switzerland, and suddenly you have a login attempt from China, then that is suspicious. It really doesn't matter where exactly in Switzerland, or where exactly in China.

I'm sure there are more options, but I can't really think of any right now that aren't just re-hashes of these ideas.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .