A little more perspective from the TWS API g-list:
3a.
TWS/Gateway logfile encryption
From:
Richard L King
Date: Tue, 14 Aug 2018 06:58:42 PDT
It seems that IBKR have decided to start encrypting the log files produced by TWS and the Gateway (at least for live and paper accounts, though seemingly not for demo accounts). (Thanks to Charlie Cooper for alerting me to this.)
So if you have ever looked in a logfile to check that your API requests and responses are what you expected, or for any other reason, you’ll now be out of luck because you can’t read the logfiles any more!
I think this is an utter disaster. I frequently look at the logfiles for a variety of different purposes, and I’ve leant a lot over the years from the information they contain.
This appears to be a knee-jerk reaction on IBKR’s part to scare stories on the internet to the effect that ‘GDPR requires log files to be encrypted’.
Now I’m no lawyer, but this seems to me to be total rubbish. GDPR, quite rightly, demands that personal information be protected from unauthorised access (amongst many other things) but I’m not aware that GDPR anywhere mandates encryption as THE solution to data protection (it is certainly A solution in appropriate cases, but TWS/Gateway logfiles is not one of these).
For a start, the log files arguably contain no personal information. They do contain the account id, but as far as I’m aware not the user id and certainly not the password: the account id cannot be used to gain access to an account or to identify an individual. And of course they do (at least if the log level is set high enough) contain information about order requests and responses. So if some malicious person gained access to my computer, sure they could assume that my TWS log files relate to my account and therefore the logs would reveal details of my trades etc. But so what: if a malicious person gains unauthorised access to my computer, I have much bigger problems to worry about than them being able to deduce what trades I’ve made today.
Second, IBKR are of course responsible for protecting any personal data they hold about me, but they are not responsible for data on my computer – how can they possibly be? That’s my responsibility alone.
Third, anyone who is concerned about protecting the contents of their log files can easily make proper arrangements using operating system facilities, without making the log files inaccessible to themselves.
Fourth, we know nothing about how IBKR are doing this encryption, what strength it has etc.
I’d be happy for IBKR to provide an option somewhere in the settings for logfile encryption, but to simply make the logfiles unreadable by anyone is unutterably stupid. I presume they will be able to decrypt them themselves, but if we can’t take extracts from them and include them in bug reports etc, then a major part of the value of logfiles is lost.
I’d be interested to hear if anyone else has a view on all this.
Richard
View/Reply Online (#40490) |
Reply To Group |
Reply To Sender |
Mute This Topic |
Top ^ |
New Topic
3b.
Re: TWS/Gateway logfile encryption
From:
Jimmy
Date: Tue, 14 Aug 2018 07:05:53 PDT
I also use TWS & API log files for figuring stuff out.
If they are going to be encrypted, IB should provide a means for us to decrypt - an app, or sample code, that can decrypt log files (presumably by supplying a TWS username & password).
View/Reply Online (#40491) |
Reply To Group |
Reply To Sender |
Mute This Topic |
Top ^ |
New Topic
3c.
Re: TWS/Gateway logfile encryption
From:
Josh
Date: Tue, 14 Aug 2018 12:09:10 PDT
The logs can be decrypted by TWS and IB Gateway. In TWS, navigate to:
Classic TWS -> Account -> Diagnostics -> TWS Logs
Then logs can be viewed or decrypted and saved to disk. In Gateway,
File -> Gateway Logs
Unfortunately I can't comment on the legal ramifications of GDPR in particular, but please note the encryption is for other situations in additional to using a secure computer, such as uploading/storing logs at IB, or if a user decides to log into a public computer (where they may not be aware the logs are created). Encryption is not a decision which would be taken lightly.
Josh (IBKR)