5

I am building a social-media type website. I am going to have the users create a profile with their name, email and phone number. When a post is created I plan to have a spot in the database that holds the username of that user.

What I am wondering is if I should log the IP address of the person who created the post, in the case that the user does post something and the police may need to be notified. (An example would be the student in Rolla, Missouri who 'anonymously' posted and threatened to shoot up a school).

From this answer:

All you can really do with an IP is find out who is responsible for the IP block with a whois lookup.

If this is the case would it even be worth keeping the IP addresses?

Lastly, if this isn't too broad of a question, what are some things I could/should store about a person who makes a post, without invading privacy of the people who do nothing wrong?

Community
  • 1
Dallas
  • 165
  • 4

1 Answers1

6

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like notifying the user in case you identify multiple IPs are connected at the same time, block consecutive attempts, etc.

But for your specific example, I think you don't need to worry about that as most of the webservers (with default settings) will generate a useful log. In case of an extreme case (as you commented), you can go to those logs and correlate times and actions (URL, POST) to identify IP addresses.

As said, an IP is not entirely a good identifier to locate a person, but if its given to the police, they may request to the ISP (who owns that IP block) for personal details. Depending on local laws, the ISP should or should not give such information.

By the way, if you are asking their phone number (and verifying through an SMS), that is by far more useful than the IP. Just handle that phone number to the police and they will know what to do with it.

Personally I dislike when a website asks for my phone number. I think is too private and in most of the cases unnecessary (unless the user wants another way to protect their account).

lepe
  • 2,194
  • 2
  • 17
  • 29
  • Great, Thank you for the feedback in both respects. One of the main reasons we are going with phone numbers is to hopefully prevent lots of spam accounts, But I do agree completely with it being a bit annoying. – Dallas Jun 23 '16 at 01:54
  • 1
    Considering the increasing number of CGNs (especially for mobile internet), you might need to log the source port too for the police to be able to identify the owner. – user2313067 Jun 23 '16 at 05:22
  • 1
    @Dallas There are other methods to prevent spam accounts. Use those before asking for a phone number (as per Iepe's last paragraph). –  Jun 23 '16 at 08:20
  • 1
    @user2313067 depends on what the law says. I'm pretty sure you can get away with not logging the port. – André Borie Jun 23 '16 at 09:50
  • 1
    I agree you can get away with it. Depends on how helpful you want to be if it happens. – user2313067 Jun 23 '16 at 09:50