Should IP addresses and ports be considered confidential?

Question

I'm dealing with a client who is "concerned about security" and they're demanding all files containing ports and IP addresses (config information essentially) must be encrypted.

My view is that IP addresses and ports are essentially public. The file may give away the nature of the server but this sort of "partial secrecy" to me doesn't really add anything to security other than a false sense of security.

Should this sort of information be stored encrypted?

Edit: One small issue is that it's a mobile device so adding encryption is actually a fairly significant overhead as it's a fairly arduous task for the processor and will cause a performance hit.

Answer 1

My view is that if the customer's asking for it, you may as well do it.

I really don't see a point to it though, as access to configuration files means the system is already heavily compromised.

Answer 2

There is never any harm in keeping as much information private as is possible. The less you give a potential hacker the harder their job will be.

However, the biggest thing to note is as you say, a "false sense of security". As long as the words "noone will hack us they don't know our ip address" are never uttered then that's fine. As soon as you think that this one level of obscurity is enough to keep you safe then you have a problem.

Answer 3

Well, an IP address could be considered personally identifiable information depending on who you ask. If you client wants it, you might as well do it. Depending on why you don't want to encrypt it, you might consider obfuscation as another simple alternative. As long as these are sufficiently randomized, I would assume your client should be happy.

Answer 4

Your question is subjective. But yes, you should encrypt your config data, it makes sense. As for that being confidential, it really depends on why? Your best to do what the Client asks.

I agree with Robin, obscurity is not security, if someone were to find out your IP, which is possible, and they port scan you, it may become apparent what attack vector they can use.

Answer 5

There is no harm in ecrypting the file. If the client is happy then do it. I hope it wont be a much of a problem when it comes to development.

But what I would do is also educate the client that "encrypting the ip" DOES not mean that everythign is safe. You can explain about the restricting access through firewall (if possible) is more secure than encrypting.

More over I don't think this is a common practise to encrypt. So you beter document is properly about how you do it and why you do it ;-) so that future programmers know why it has been done.

Answer 6

I think most OS-es have standard support to request all open network connections. (netstat, under Windows XP, Linux.) So, if the application is actually using the IP addresses to connect with the systems, then encrypting is clearly not enough. However, if the application can only be started with a password then I could imagine a use for encryption, making it a bit more difficult to see the information when the application is not running.

Answer 7

The way I look at it is, an IP address isn't in itself privileged, but it's useful information for an intruder to have. Why make it easy for him to get it? Encrypting the data may simply annoy him and slow him down while he gets that information through other means, but the longer the intrusion takes the more costly it is for him and the greater the risk that he'll be caught and stopped.

Locking my wooden front door won't stop a determined burglar, but it'll slow him down and make him attract the attention of the neighbors if he tries to break in. Compared to the cost of installing the door, that's worth it!

Answer 8

Well with a simple portscan the attacker will have the information anyhow. As some other guys allready wrote it will provide a false sense of security.

Answer 9

The answer is without doubt YES. It's not a real programming answer; this is the opinion of a number of official privacy watchdogs in Europe. IP addresses are considered to be similar enough to physical addresses; they might not 100% reliable identify a single personal but they are still personal data. As such, they come under the relevant legislation (Safe Harbour provisions etc). Your client has every right to take the European market into account, so this request makes perfect sense from a business/legal perspective.

The better question is in fact whether they should ever be stored non-encrypted. If you as a programmer are building a system where you are storing IP addresses from outside your company, you'd better check with the legal dept. which laws would apply to your company.