nextcloud / nextcloud/suspicious_login
GDPR Compliance, use hashed IP addresses / user names
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 106
- Forks
- 32
- Avg merge
- 8h 33m
- Merged PRs (30d)
- 10
Description
Congratulations to another very interesting and sophisticated app in the nextcloud ecosystem! Thank you for your efforts.
But it might be objected that this app is not GDPR compliant at the actual development stage, regarding Art. 5(1)(c).
After what I could see from the database entries, this app saves usernames, IP addresses (both unhashed) and login dates. As long as it is technically possible to work with hashed IP addresses and probably hashed usernames, too, I do not think it is legally compliant in the means of ‘data minimisation’.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the database entries and the login data handling described in the issue. Determine whether IP addresses and usernames can be hashed while preserving suspicious-login detection, and clarify the required GDPR data-minimisation outcome with maintainers. Done should mean the agreed stored data is minimised without losing the app's stated purpose.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100