Why IP address truncation fails at anonymization(00f.net)
00f.net
Why IP address truncation fails at anonymization
https://00f.net/2025/10/27/ip-anonymization/
6 comments
The main issue with this article is that it claims to be about anonymization, but reject HMAC because it's not reversible, and promotes IPCrypt because it is.
Except that if it's reversible, it's not anonymization, it's pseudonymization.
[deleted]
> There’s just one problem: truncated IP addresses are still personal data under GDPR
Was as part of a security audited by [insert big Japanese telecom] where the exact opposite was stated.
I'm so happy doing implementation and not having to deal with compliance.
Was as part of a security audited by [insert big Japanese telecom] where the exact opposite was stated.
I'm so happy doing implementation and not having to deal with compliance.
Such a long blog post about privacy failure due to correlation and no mention of things like https://en.wikipedia.org/wiki/K-anonymity
Disappointing.
Disappointing.
AI slop
I get the author has a specific destination in mind (IPCrypt) and a goal that's not properly stated ("but what if I want to do network analysis on top of the data?"), but I'm that case I wish they had dedicated more time to those details. In particular: if addresses from the same subnetwork share a prefix, how does that preserve privacy? If all users from (say) Taiwan land under the same prefix, then I'm back to where I started.