Request for feedback: Security log

[loftar]

From time to time, I get requests from people to look up whether other people have been logging in on their account, and I'd like to enable them to do so without having go through me. I can't seem to find the thread, but a while ago, I asked publicly if people would feel comfortable with a "security log" section under the account profile, and somewhat understandably many were not comfortable with IP addresses being "visible".

I've been mulling over it at low intensity since then, and eventually came up with a way to obfuscate IP addresses in a way that should be less controversial, but still useful for trying to figure out what's been happening. To post a concrete example, and also to demonstrate how I think this information should be insensitive enough to share publicly, here's what the log would look like for my account:

seclog.png

As can be seen, IP addresses themselves are "tokenized", but in the Address Table at the bottom of the page, you can still see country information, and information about shared bytes in the addresses. The reason shared bytes can be important is because it can allow you to see (or at least guess) whether two addresses come from the same ISP, for instance. Specifically, the "shared prefix" images work such that, if the color of a box changes from one row to the next, that means that the corresponding byte in the address is different between those two addresses (the table is sorted such that addresses with shared prefixes are next to one another in it). In the example table, then, that means that addresses 5 and 6 share their first two bytes, which is also true between addresses 0, 2 and 4.

In addition to the actions that can be seen on my account, the log also contains records of changed passwords and changed e-mail addresses (without the actual e-mail addresses being visible).

What do you think? Is this something I should actually add to the website?

[ubersheva]

Yes, this can be useful.
Also why would you log in from Kazakhstan?

[shubla]

and information about shared bytes in the addresses. The reason shared bytes can be important is because it can allow you to see (or at least guess) whether two addresses come from the same ISP, for instance. Specifically, the "shared prefix" images work such that, if the color of a box changes from one row to the next, that means that the corresponding byte in the address is different between those two addresses (the table is sorted such that addresses with shared prefixes are next to one another in it). In the example table, then, that means that addresses 5 and 6 share their first two bytes, which is also true between addresses 0, 2 and 4.

So some rich man who has money to acquire bunch of ip addresses can easily figure out all bytes of my ip?

Good idea but slightly overengineered maybe.

[loftar]

Also why would you log in from Kazakhstan?

Well, let's just say that's an example of why the log can be useful. ^^

Good idea but slightly overengineered maybe.

Any better ideas?

[APXEOLOG]

I don't think anyone will care about exact IP. It doesn't mean anything nowdays. Just display country code insteaed of the "Address %d" and remove the Address section

[Archiplex]

Out of curiosity, why would it be controversial to expose the exact IP's?

It'd mean account sharers would know each other's IP, though given they're already trusting each other to share an account I don't think that matters too much. Otherwise, no real downside to bad actors getting their IP's shown anyways?

[loftar]

Out of curiosity, why would it be controversial to expose the exact IP's?

Ordinarily I'd agree with you that it's not a big deal, but in this particular case I want to hide it for the same reason I'm not showing the e-mail address of the account, namely that, if someone does manage to illegitimately gain access to someone else's account, then it's probably not unlike that that would be the kind of person who might go further and use the same password on the e-mail account itself, or start running exploit scanners against the victim's router, and so on.

[displaced]

cool, but why not just implement 2FA? (if there is a concern for safety)

[noindyfikator]

cool, but why not just implement 2FA? (if there is a concern for safety)

that would be so good

[shubla]

cool, but why not just implement 2FA? (if there is a concern for safety)

Why not indeed.
Only disadvantage I see is when people lose their 2FA tokens and didn't take up the recovery codes.