Anonymizing IP's

Looking for an Extension? Have an Extension request? Post your request here for help. (Note: This forum is community supported; while there is an Extensions Development Team, said team does not dedicate itself to handling requests in this forum)
Anti-Spam Guide
Locked
User avatar
richey
Registered User
Posts: 636
Joined: Mon Feb 18, 2002 4:26 pm
Location: now@Cyberspace
Contact:

Anonymizing IP's

Post by richey »

To increase privacy (and comply with some privacy laws) it would be great if there was an extension that would allow to anonymize user's IP numbers after a certain amount of time.

The code for it already exists: https://github.com/geertw/php-ip-anonymizer

Ideally, the extension would allow to configure the timeframe (like: 6 months) when stored IP numbers in posts would be anonymized by PHP's cron system.

kind regards,
r.
.
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Anonymizing IP's

Post by david63 »

I am not sure what "privacy law" an IP address need to comply to but after six months most IP addresses will not be an issue as they will be well out of date and there is actually an argument that IP addresses should be retained as an audit trail.
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
richey
Registered User
Posts: 636
Joined: Mon Feb 18, 2002 4:26 pm
Location: now@Cyberspace
Contact:

Re: Anonymizing IP's

Post by richey »

I'm aware of the value of IP addresses for auditing purposes (double registrations etc.).

However, in the EU there are strict privacy laws, and users have the right to demand their "personal information" to be deleted - IP addresses belong to personal information according to a couple of lawsuits that have been filed during the last few years. As you may know, unfortunately in such cases, it's usually small website hosters like me who get threatened with lawsuits and receive lawyer's blackmailing letters (with fee payment forms attached) if we're not complying with existing legal fine-print by 100% while fartbook, Google & Co. don't.

If an extension (or such a feature) existed, I could extend the privacy declaration on my board that - let's say, after 3 months - IP addresses are automatically anonymized, so no user could cause me any trouble if he wants to 'leave' and have 'all his information deleted'. The posts could remain in the board as they usually don't contain identifiable information, he/she could "anonymize" his/her email address (by changing it to a non-existing one, thus disabling his own access to the board) and his IP would be anonymized after a couple more weeks anyway.

cheers, r.
Last edited by richey on Tue Jun 06, 2017 1:51 pm, edited 2 times in total.
.
User avatar
Brf
Support Team Member
Support Team Member
Posts: 53379
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Anonymizing IP's

Post by Brf »

richey wrote: Tue Jun 06, 2017 1:45 pmif he wants to 'leave' and have 'all his information deleted'. The posts could remain in the board as they usually don't contain identifiable information, he/she could "anonymize" his/her email address (by changing it to a non-existing one, thus disabling his own access to the board) and his IP would be anonymized after a couple more weeks anyway.
It would be simpler to delete that user completely, and leave their posts behind. Then their Email address is gone.
infinitiv
Registered User
Posts: 166
Joined: Sat Nov 15, 2014 3:47 pm
Location: PL
Name: Ficjusz

Re: Anonymizing IP's

Post by infinitiv »

Brf wrote: Tue Jun 06, 2017 1:49 pm
richey wrote: Tue Jun 06, 2017 1:45 pmif he wants to 'leave' and have 'all his information deleted'. The posts could remain in the board as they usually don't contain identifiable information, he/she could "anonymize" his/her email address (by changing it to a non-existing one, thus disabling his own access to the board) and his IP would be anonymized after a couple more weeks anyway.
It would be simpler to delete that user completely, and leave their posts behind. Then their Email address is gone.
But the IP still remains in posts table.
User avatar
Mick
Support Team Member
Support Team Member
Posts: 26456
Joined: Fri Aug 29, 2008 9:49 am

Re: Anonymizing IP's

Post by Mick »

richey wrote: Tue Jun 06, 2017 7:59 amand comply with some privacy laws
Illuminate please, what laws, do you have links?
  • "The more connected we get the more alone we become" - Kyle Broflovski©
  • "The good news is hell is just the product of a morbid human imagination.
    The bad news is, whatever humans can imagine, they can usually create.
    " - Harmony Cobel
User avatar
richey
Registered User
Posts: 636
Joined: Mon Feb 18, 2002 4:26 pm
Location: now@Cyberspace
Contact:

Re: Anonymizing IP's

Post by richey »

https://www.whitecase.com/publications/ ... some-cases

As a webmaster/forum hoster, I'd really prefer to be able to 'forget' about such things by informing users beforehand that their IP's are 'safe' on my board (instead of having to clean up everything by hand on request), and save time when someone wants to have their private information deleted.
.
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Anonymizing IP's

Post by david63 »

That report specifically states that unless there is sufficient other data present with the IP address to identify a user then it does not fall within the scope of the EU data privacy laws.

In standard phpBB there is no other "personal" data that can be used in conjunction with a user's IP address that could be used to identify them - now if you have other "add ons" that add that data then the issue is with the add on.
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
Brf
Support Team Member
Support Team Member
Posts: 53379
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Anonymizing IP's

Post by Brf »

infinitiv wrote: Wed Jun 07, 2017 9:17 am
Brf wrote: Tue Jun 06, 2017 1:49 pm It would be simpler to delete that user completely, and leave their posts behind. Then their Email address is gone.
But the IP still remains in posts table.
Why would it matter since the post is no longer attached to the user?
User avatar
richey
Registered User
Posts: 636
Joined: Mon Feb 18, 2002 4:26 pm
Location: now@Cyberspace
Contact:

Re: Anonymizing IP's

Post by richey »

In many board (including mine) it has come to the practice to suggest users to "anonymize" their account by entering a crazy email address and changing the password (so they won't be able to access it anymore by themselves as well).
That way, posts can remain in the forum (which is prefered by forum hosters in most cases), but the user's real email address is detached from the account (which is what most users are actually interested in when asking for their account to be 'deleted': to avoid potential spam). So the IP from the posts table remains linked to the account (and it could theoretically be used to track a user or reveal his real identity), although that would hardly cause any harm.
.
User avatar
Brf
Support Team Member
Support Team Member
Posts: 53379
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Anonymizing IP's

Post by Brf »

But if you delete the user account, then there will not be an account to link anything to anymore. Just leave the posts intact.
User avatar
david63
Registered User
Posts: 20646
Joined: Thu Dec 19, 2002 8:08 am

Re: Anonymizing IP's

Post by david63 »

richey wrote: Wed Jun 07, 2017 1:10 pm it could theoretically be used to track a user or reveal his real identity
Please explain how this can be done within standard phpBB
David
Remember: You only know what you know and - you don't know what you don't know!

I now no longer support any of my extensions but they will start to become available here
User avatar
canonknipser
Registered User
Posts: 2096
Joined: Thu Sep 08, 2011 4:16 am
Location: Germany
Name: Frank Jakobs
Contact:

Re: Anonymizing IP's

Post by canonknipser »

I agree with the OP that board owner should be able to anonymize IP's, There is very seldom a need to store the posters IP for the whole lifetime of a post and it's against the "need to know"-principle.
With standard phpBB, it's quite easy to find out the IP the post was made from, the ISP where that IP belongs to (via whois service) and maybe (if it is a static IP) eg. the company network. It's just in the post information area, giving "IP", "posts made from this IP", "Other IP used by the user", all IPs with a link to the whois service.

Apart from that, there are some legal calls for "telecommunications data retention", which often affects ISPs, but normal board owners should very seldom have legal needs to store communications data eternally.

For a limited period it is useful to check session keys, or to identify multiple accounts from one user (there may be other usecases as well). But storing the data forever is not very useful and maybe against the law in some country or against board owners principles
Greetings, Frank
phpbb.de support team member
English is not my native language - no support via PM or mail
New arrival - Extensions and scripts for phpBB
User avatar
richey
Registered User
Posts: 636
Joined: Mon Feb 18, 2002 4:26 pm
Location: now@Cyberspace
Contact:

Re: Anonymizing IP's

Post by richey »

Any new developments with this?

I am looking for a plugin or function to remove the last 3 digits of the IP number after, let's say, 3 months.
Is there a "phpbb native" way to do this (or maybe a "dirty code hack" that could help to achieve it?)

Any help appreciated...

thanks!
.
User avatar
HiFiKabin
Community Team Member
Community Team Member
Posts: 6670
Joined: Wed May 14, 2014 9:10 am
Location: Swearing at the PC, UK
Name: James
Contact:

Re: Anonymizing IP's

Post by HiFiKabin »

This topic is six years old. I suggest that you start a new topic in Extension Requests to see if anyone can fulfil what you require

Closing
Locked

Return to “Extension Requests”