Starting a new service and considering ? It's a good practice to go IPv6 for a number of reasons:1) IPv4 is exhausted, 2) IPv6 offers much better privacy thanks to the client address rotation, 3) IPv6 greatly simplifies P2P, 4) slightly better performance & latency

@kravietz Individual IP addresses get rotated, but still within the same subnet. A subnet can easily represent only a single person. Selling IPv6 as privacy enhancing is really stretching the truth.

I'm also not convinced it gives better performance or latency, given that everywhere I have IPv6 it's going via tunnels.

@irl

My IPv6 address today is

2a02:390:79ef:0:bc7c:b971:4e32:1c20

Most detailed information you will get from WHOIS is 2a02:390:7000::/36 registered to my ISP somewhere in UK. And tomorrow the IP will be different.

@kravietz ISPs do dynamic addressing with IPv4 too. This is no different.

This is not a feature of IPv6, it's how they've chosen to manage addressing, which could be applied to any addressing scheme.

A recent-ish paper showed that even /48 aggregation can still uniquely identify a single customer.

https://arxiv.org/pdf/1707.03900.pdf

If you're using your computer at work, you were probably getting more privacy from IPv4 NAT aggregation than you are from IPv6 address rotation, most enterprises will have fixed addressing to make network management easier.

@irl

Ok, this makes perfect sense - looks like privacy extensions offer privacy protection equivalent to an ISP-scale NAT.

@kravietz Not really, because each IP address is still individually indentifiable. You just need to be able to re-link IP addresses when they change. You could do this with a cookie, for example, and then you know the user to IP address mapping and can link it into the history of the user again. Unless IPv6 can remove the need for a persistent identifier by using throwaway addresses for each connection or something like that, the claim that it helps privacy isn't accurate. Better to focus on things like how management of networks can be simplified, and how we needed more address space anyway.

Privacy is a good thing to want, and we should do things that improve privacy, but we should do IPv6 for other reasons.
Follow

@irl

> by using throwaway addresses for each connection

This is technically possible. I've seen some services using this technique to bypass Google search query limits by switching their egress IPv6 address every 5 minutes or so. Of course this works only as long as Google doesn't enforce limits per subnet but switching is easy. Choosing a new IPv6 address *per connection* is also technically possible with /etc/gai.conf, the client software would just need to actually do it.

Β· Β· 0 Β· 0 Β· 0
Sign in to participate in the conversation
Mastodon πŸ” privacytools.io

Fast, secure and up-to-date instance. PrivacyTools provides knowledge and tools to protect your privacy against global mass surveillance.

Website: privacytools.io
Matrix Chat: chat.privacytools.io
Support us on OpenCollective, many contributions are tax deductible!