In a UX-focused discussion titled “Hide IPs behind a button like emails,” darkpixlz proposes hiding IP addresses behind a clickable button—similar to how emails are hidden—to increase privacy and log admin access, arguing IPs can reveal location, ISP, and other sensitive data. Jagster counters that IPs are trivial to obtain via server logs and are less useful for identifying users than emails, especially since disposable emails are common and should be banned. darkpixlz replies that while email abuse is manageable (e.g., blocking/spam reporting), IPs expose more sensitive info like location and ISP. Stephen disagrees, stating emails are more critical since they’re personally owned and can be permanently compromised, whereas IPs are temporary and change across networks. Jagster further argues IPs rarely reveal accurate location (citing examples from Finland, London, and the US), contain no other sensitive data, and are already easily accessible to admins—adding that shared IPs often cause rate-limiting issues (e.g., error 429). The debate centers on whether IPs warrant the same privacy treatment as emails, with differing views on sensitivity, identifiability, and technical feasibility.
When a user views an email, it’s stored in the logs.
The thing is, IPs are visible without having to click a button
But, IPs are freely visible to admins without having to click a button and without logging.
Instead of showing it, there should be a button similar to the “Show” button for emails.
If anything the opposite is true. You sign up for an email address and own that account. If the account is attacked then the consequences can be significant. Attack a mailbox just right and the user can lose access to it permanently.
IPs are allocated to you from a pool and your last IP will change as you move between devices and networks - home/school/work/cell connection and coffee shop for example.
I would be much more concerned about who you allow to see your users data, than their ability to unmask an IP address.
Location… rarely and it is almost never accurate. Yes I know I’m living in small country and in bigger countries where an ISP can be even town related, plus domestic roaming can be sometimes problematic, the situation can be slightly different, but I doubt anywhere you can be pinpointed accurate. Here in Finland, EU my location is always at least 100 km off.
That is true in Europe and IP didn’t show my location accurate in London (well… that is still part of Europe, sorry ), New York or Los Angeles.
Other sensitive info? There is not any.
And still… an admin can find out your IP really easily even when it is not shown on side of Discourse.
From my point of view whole IP is just noise, and the biggest single reason why admins are struggling with error 429 — because so many are sharing same IP.
), New York or Los Angeles.