29

I have read a lot of users saying that you have to hash IP addresses - and a lot of others who say I don't have to because it is not private information.

I use IP addresses for identifying users, because they can download files but have limited traffic (per day).

Are there articles or blog posts where this is illustrated or opinions from people who know more about privacy things like this?

I obviously tried searching on Google - but there are almost no suitable results.

  • 9
    Why? What threat are you trying to protect against? Without a threat profile or attack vector, how would we judge whether hashing IPs might be a suitable and effective response to the threat? – a CVn Dec 2 '14 at 14:11
  • 2
    An ip address it's not private information. Just like an address, it's something you can just find(there is a limited number of ips). The question is, what can you link with those IP addresses? Can you link them with a services that you are offering? Can people be traced or identified based on the services you offer? Are you a site that offers some services that people would rather not be linked with? – sir_k Dec 2 '14 at 14:14
  • 1
    Related: How secure can IP based login be? – a CVn Dec 2 '14 at 14:19
  • 30
    Hashing a IPv4 address doesn't achieve anything -- it can trivially be reversed by exhaustive input enumeration. – CodesInChaos Dec 2 '14 at 14:26
  • 2
    @ponsfonze - depends how badly the attacker wants them. Since hash calculations are easily parallelized, he can compute the entire space in any arbitrary length of time (well, no less than one second) by using more compute resources. 1000 16 core servers can do it in in around 70 hours, and it would cost around $60K on Amazon if the attacker doesn't have a botnet that can do the work for him. If he knows something about who he's looking for (internet provider, country, etc), he may be able to greatly reduce the search space. – Johnny Dec 3 '14 at 20:58
38

So IPs can in fact be considered to be PII (or personally identifiable information) in some cases, so you're right to want to consider whether you need to protect them. Generally this doesn't mean, however, going to any additional lengths beyond how you would protect other PII, say, email addresses for example.

In any case, traditional hashing is likely going to be an ineffective mechanism. There are only 4 billion IP v4 addresses potentially in existence, and the reality is that you're probably dealing with a far smaller address space that that. This means that it's relatively easy for an attacker with the hashes to compute the IP addresses that result in those hashes. Salting is generally not useful in this case, because you presumably want to know when two requests are associated with the same IP address, and you will not be able to easily compare an existing hashes to the hash of the IP address associated with a new request if all of the hashes are uniquely salted.

You could, potentially use a keyed hash without a salt, using a function like HMAC. This, presuming you can keep the key secure will lead to hashes that can be compared to each other, but also cannot be associated to the IP addresses that were used to create them by an attacker who has the hashes, but not the key. If the key is obtained by the attacker however, this is no more secure than traditional hashing.

Generally speaking, I'd suggest that the risk here doesn't demand the complexity of a mitigation of this level. I think the complexity you're adding (and need to maintain) probably outweighs the additional security you'd get. However, if for your application does in fact require you to consider IP addresses to be sensitive enough to warrant extraordinary protection, consider using a keyed hash function.

  • Thank you for the answer. I totaly agree with "the complexity you're adding (and need to maintain) probably outweighs the additional security you'd get". I sadly can't +1 your question – Luca Steeb Dec 2 '14 at 14:31
  • 3
    I would also add that storing the IPs in a "non-reversible" manner is counter productive as it prevents you from being able to track security threats against your site. If you don't have an accessible IP address in the log file, then you can't report relevant information in the case of an attack on your systems. – AJ Henderson Dec 2 '14 at 15:46
  • A nice trick with a keyed hash would be to store the key in memory that you mark as not swappable to disk. Then a power outage will wipe your ability to reconstruct the hash<->ip map. Throw away the key every 2 days and your logs past the last day are no longer useful... – Yakk Dec 2 '14 at 17:02
  • "a keyed hash without a salt" - that's another word for pepper right? e.g. have some constant secret random string in my code (and not in the DB), say UUID, that I append to each IP before I hash it right? – Ohad Schneider Aug 12 '17 at 10:15
23

No. (with possible caveats)

The risk posed by storing data depends entirely on what data you collect and how you use it.

If you log IP addresses only then there should be no problem.

If your log contains IP addresses and names you start getting closer to the boundary, but are still probably okay in most jurisdictions.

If your log contains IP addresses, names, actual addresses, health or medical information etc then you will fall foul of a few regulations. That said, the requirement is to encrypt the PII, not the IP address, although sometimes IP address can be PII (see Xander's answer).

My caveat is if you provide a service to users in regimes that may punish users, then hashing may help them be safer, as if you are forced to give up your logs they will not necessarily help.

  • I only log the filename they download and how much traffic they have left - thats it, so I think not hashing is okay – Luca Steeb Dec 2 '14 at 14:19
  • 5
    There are only about 4.3 billion possible IPv4 addresses. (Sure it gets "better" if you allow IPv6.) Without knowing the hashing algorithm in use, I dare say a few hours on a single PC and maybe 1-2 TB storage would be plenty to provide a lookup table for every IP address hash. Storage might even be slower than direct hashing (unless you go SSD and basically store hashtables rather than lists). – a CVn Dec 2 '14 at 14:21
  • Agreed - @Xander made the same point. I should mention keyed hashing. – Rory Alsop Dec 2 '14 at 14:46
  • 1
    If you're logging banking or medical information unencrypted, you would foul many regulations, whether or not IP address is in it. – Lie Ryan Dec 3 '14 at 0:11
  • 1
    Lie - that's exactly what I said in my 2nd last paragraph. – Rory Alsop Dec 3 '14 at 11:04
9

This clearly depends on the jurisdiction! In Germany, IP addresses are considered personal information! See e.g. here or here if you speak German.

It says, basically, that you are allowed to store the IP only as long as you need it to provide the service! This means on a website, you have to delete it after you sent all IP packets to the destination (which basically means you are not allowed to log it in any usual way, only store it in the webserver memory) There are exceptions e.g. for fraud prevention on e-commerce sites. But then you have to delete it after you don't need it anymore (which is after you got the money)!

You should be fine if you remove the last block of the IP address, because then it doesn't identify a single person anymore. That's also suggested by several government related organisations as the proper way! Hashing IPv4 addresses won't work, because it is easy to calculate the IP from the hash. I don't know what is suggested for IPv6 addresses. Removing the last few bits won't work obviously, because usually one gets a /64 subnet!

The same in Austria where you even have to notify a government agency that you are handling personal data!!! You could in theory even get a fine if you don't register there! I don't know of any case, but the law says so.

  • Ich basically need it to provide the Service. When do I have to delete them? When german visitors access my website, does it mean that in theory this law or rule only applies to them, or does it depend on the server location? – Luca Steeb Dec 3 '14 at 13:36
  • 1
    You have to delete them at the time you don't need them to provide the service anymore! And you have to be able to prove that you really need them to provide the service, and there is no alternative without storing person related data! If the German law applies is more complicated. If you, your company or your servers are in Germany, it generally applies (to all users accessing your site, not only German users!). If you, your company and your servers are not in Germany, it depends if you provide service to Germans etc... You should consult a lawyer for the details! – Josef Dec 3 '14 at 14:06
  • 1
    Thats really complicated.. I live in germany, but the server is not in germany – Luca Steeb Dec 3 '14 at 14:40
  • 2
    If you are in Germany, German law applies! (I assume you are not working for some company from a different country!) – Josef Dec 3 '14 at 16:06
1

If you are storing medical information, the be aware that in the United States, the Health Insurance Portability and Accountability Act (HIPAA) defines an IP address as "Protected Health Information"

  • Why the down vote? The request was "for articles, blog posts, or opinions" and this should qualify. – Moby Disk Dec 3 '14 at 21:09
  • 1
    I didn't downvote, but we prefer detailed answers (especially when there are already some other fairly extensive answers). A small tidbit is often better as a comment or an edit to another more comprehensive answer. – D.W. Dec 4 '14 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.