3 ms·

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprintin

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way. Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

beagle3 9y ago
> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids. I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries. edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).
- vertex-four 9y ago
  > I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?
  - beagle3 9y ago
    I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; <<>> DiG 9.7.1-P2 <<>> www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxxxx ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.amazon.com. IN AAAA ;; ANSWER SECTION: www.amazon.com. 1208 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 55 IN CNAME opf-www.amazon.com. ;; AUTHORITY SECTION: opf-www.amazon.com. 895 IN SOA ns-191.awsdns-23.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60 ;; Query time: 70 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; MSG SIZE rcvd: 147 Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.
    - jgrahamc 9y ago
      > Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address. We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4). https://blog.cloudflare.com/98-percent-ipv6/ https://blog.cloudflare.com/98-percent-ipv6/
      - beagle3 9y ago
        Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off. I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement). Can you share what percentage of customers have IPv6 turned off explicitly? Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?
        jgrahamc 9y ago
        Last time I looked >99% of Cloudflare sites have IPv6 enabled.
    - vertex-four 9y ago
      Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record. Unfortunately many sites can't be bothered to do that despite it being a 5-minute job, since not doing it doesn't currently break anything in most cases, and might break things for the minority with broken IPv6 configuration. Cloudfront now supports IPv6, so the reasoning for not enabling it on Amazon.com is likely similar.
      - jgrahamc 9y ago
        > Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record No, we don't. We operate a v6 to v4 gateway for you.

beagle3 9y ago

> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids. I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries. edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).

vertex-four 9y ago
> I haven't received an AAAA DNS record to any request I've made through several countries Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?
- beagle3 9y ago
  I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this: $ dig www.amazon.com AAAA @8.8.8.8 ; <<>> DiG 9.7.1-P2 <<>> www.amazon.com AAAA @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxxxx ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.amazon.com. IN AAAA ;; ANSWER SECTION: www.amazon.com. 1208 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 55 IN CNAME opf-www.amazon.com. ;; AUTHORITY SECTION: opf-www.amazon.com. 895 IN SOA ns-191.awsdns-23.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60 ;; Query time: 70 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; MSG SIZE rcvd: 147 Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.
  - jgrahamc 9y ago
    > Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address. We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4). https://blog.cloudflare.com/98-percent-ipv6/ https://blog.cloudflare.com/98-percent-ipv6/
    - beagle3 9y ago
      Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off. I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement). Can you share what percentage of customers have IPv6 turned off explicitly? Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?
      - jgrahamc 9y ago
        Last time I looked >99% of Cloudflare sites have IPv6 enabled.
  - vertex-four 9y ago
    Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record. Unfortunately many sites can't be bothered to do that despite it being a 5-minute job, since not doing it doesn't currently break anything in most cases, and might break things for the minority with broken IPv6 configuration. Cloudfront now supports IPv6, so the reasoning for not enabling it on Amazon.com is likely similar.
    - jgrahamc 9y ago
      > Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record No, we don't. We operate a v6 to v4 gateway for you.