I would like to implement a "Login from a suspicious location" email for my users.
The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the distance between the current login and the geographically closest prior login for a threshold.
The problem I'm seeing is that to achieve this, I would need to store the latitude and longitude of all the prior logins attached to the user. This is a problem because even though I'm taking maximum precautions, I try to assume everything in my SQL database may be public knowledge someday after a breach. I don't want to be storing information that could be upsetting to users following a breach.
Is there a strategy I can follow to determine if a login is from an atypical location? I can only see two theoretical ways to achieve this, but I haven't been able to come up with a suitable solution to either.
- Keeping the accurate location, but use a hypothetical one-way-function to anonymize ownership.
- Determine the distance between two or more locations without ever knowing the real world locations
Has anyone else tackled this problem in a privacy conscious way?