> There’s just one problem: truncated IP addresses are still personal data under GDPR

Was as part of a security audited by [insert big Japanese telecom] where the exact opposite was stated.

I'm so happy doing implementation and not having to deal with compliance.

Such a long blog post about privacy failure due to correlation and no mention of things like https://en.wikipedia.org/wiki/K-anonymity

Disappointing.

AI slop

I'm unconvinced of 3/4 arguments against HMAC. "You cannot reverse it" sounds like the actual goal we were trying to reach and, similarly, "too slow for such a small input" seems like a self-solving problem. Is it perhaps an AI-generated list of "reasons for not choosing HMAC"?

I get the author has a specific destination in mind (IPCrypt) and a goal that's not properly stated ("but what if I want to do network analysis on top of the data?"), but I'm that case I wish they had dedicated more time to those details. In particular: if addresses from the same subnetwork share a prefix, how does that preserve privacy? If all users from (say) Taiwan land under the same prefix, then I'm back to where I started.

The main issue with this article is that it claims to be about anonymization, but reject HMAC because it's not reversible, and promotes IPCrypt because it is. Except that if it's reversible, it's not anonymization, it's pseudonymization.