The impact of browser privacy changes on IP access

As major browsers look set to mask users’ IP addresses, publishers relying on IP address-based access should keep a watchful eye. By Rob Evans, chief network architect at Jisc.

For some time, it’s been clear that IP address-based recognition – the traditional way to provide access to research content – is outdated and flawed.

The problem is that it’s such a blunt tool. When you authenticate via IP address alone, you’re allowing access based on network routing location, not user credentials. So you don’t really know who’s accessing your content.

But on top of this, there’s now another challenge: the impact of browser privacy changes on IP address-based access.

Soon, major browser vendors are expected to enable masking of users’ IP addresses.

“IP masking will happen on an opt-in basis initially,” explains Kieran Prince, business development manager at OpenAthens. “But the more users adopt it, the less reliable IP access may become.”

In the face of the challenge, here’s what publishers should know and do.

The background: protecting user privacy

The reason this is happening is privacy. Privacy laws around the world restrict the processing of personal data or personal information, and in many cases IP addresses are considered to fall within the scope of these laws.

As a result, major vendors plan to give users more control over revealing their IP address to websites.

Many vendors already offer opt-in ways to mask IP addresses. Microsoft integrates an optional VPN into its Edge browser. Mozilla, maker of Firefox, offers the Mozilla VPN. Apple Safari users can mask their IP address via iCloud Private Relay for iCloud+ customers.

Google, for its part, says it will offer what it calls “IP Protection” in Chrome’s Incognito mode, though it's unclear at this stage if it will eventually become default in normal browsing mode.  Although coarse geolocation will still work when IP Protection is enabled, it’s unlikely to be precise enough to authenticate research users.

Meanwhile, privacy-focused browsers, such as Tor, already obscure IP addresses by default.

And masking may not happen solely at the browser level. If a user chooses a VPN for privacy or security, they are effectively masking their IP address; and in theory, devices could enable IP masking in future in other ways.

So how big is the problem?

On the face of it, browser privacy changes could have a big impact on IP address-based access.

Many publishers, particularly smaller ones, support IP address-based access as a primary access method. Where IP address masking is enabled by default, end users who currently use on-site access might find they are unable to access publishers’ resources.

Are workarounds available?

If you’re a publisher who uses IP address-based authentication, there are alternatives.

You could, for example, recommend that your library customers deploy a proxy service – which creates an IP address within the correct range, and allows access on this basis. Indeed, technologies that already mask public IP addresses, such as proxy services, will be unaffected.

At OpenAthens we do offer a proxy service. However, we believe there’s a much better option: single sign-on via federated access, which sets the standard for accessing digital content. Federated authentication allows granular control over who’s entitled to access content – with identities managed by the library, freeing up time for the publisher.

What else should publishers do?

This is a community-wide issue, so we suggest that you stay informed on how IP masking – and other browser privacy measures – will affect you.

For a list of resources, see our article on staying ahead of browser privacy changes.

And read our blog to find out why federated access is the future of authentication.