4 ms·

Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and us

Normally what happens is: you request a prefix from the ISP (call it a /56, which is 256 subnets of /64 size each), then you pick one /64 from the prefix and use it for your network. Your computers then assign themselves randomly-selected addresses from the /64. The prefix might be 2001:db8:1:2300::/56, the first network 2001:db8:1:2301::/64, and the machines on that network 2001:db8:1:2301:random:numbers:go:here. The ISP knows who has which prefix, because they handed them out, but the allocation of IPs inside that prefix is handled entirely by the end-user network. The ISP isn't involved in it, so they have no idea which IP is which computer. With NAT the LAN-side IPs are hidden from the ISP. In v6 the ISP can see the LAN part of the address, but without any way to identify which machine is using which IP that doesn't give them any extra information. All they get is the prefix and a random number. Computers typically change the random number on a regular basis too so you can't even do any long-term analysis on it.

4bpp 8y ago
Oh, I see where the misunderstanding is. In cases like the one addressed in Belgium, the ISP actually assigns the same outward-facing IP address to multiple unrelated customers, and NAT is performed on the ISP side. Somebody who has merely recorded the IP address that made a request therefore has no legal way of determining that it came from you or someone close to you, rather than a number of complete strangers who were assigned the same address, unless the ISP maintains a record of what connections were mapped. As far as I know, in the US this is mostly common for mobile providers. If we are just talking about a NAT in your home LAN, this won't help you for privacy/security: law enforcement and whoever else still know that the IP address is yours.
- Dagger2 8y ago
  That would normally be called CGNAT. Yes, that does change things somewhat... except what's actually going to happen is that people will record the port number and the time as well as the IP, and the ISP is going to record every single connection you make in a big database, and then bill you for the privilege of doing it. Law enforcement will still be able to identify you, now your ISP has a record of everything you've done, and you're still dealing with the headaches of NAT all the time. Doesn't really seem worth it to me.
  - 4bpp 8y ago
    As far as I know, several court cases in Germany have confirmed[1] that the mapping of dynamically assigned IP to customer identity may only be stored for 7 days. I imagine the same upper bound, or an even tighter one, applies to the records you are talking about. [1] https://www.e-recht24.de/news/datenschutz/10387-datenschutz-speicherung-ip-adresse.html https://www.e-recht24.de/news/datenschutz/10387-datenschutz-... (in German)
    - pseudalopex 8y ago
      ISPs use port logs for the same reasons as address logs so I imagine a court would treat them the same.
    - Dagger2 8y ago
      Around here I'd expect something more like a 7 year minimum to be more likely... Limiting the timeframe does improve the costs and the privacy impact, but the ISP will still need to build and run all of the logging infrastructure, and the end result is that you'll still be identifiable.

4bpp 8y ago

Oh, I see where the misunderstanding is. In cases like the one addressed in Belgium, the ISP actually assigns the same outward-facing IP address to multiple unrelated customers, and NAT is performed on the ISP side. Somebody who has merely recorded the IP address that made a request therefore has no legal way of determining that it came from you or someone close to you, rather than a number of complete strangers who were assigned the same address, unless the ISP maintains a record of what connections were mapped. As far as I know, in the US this is mostly common for mobile providers. If we are just talking about a NAT in your home LAN, this won't help you for privacy/security: law enforcement and whoever else still know that the IP address is yours.

Dagger2 8y ago
That would normally be called CGNAT. Yes, that does change things somewhat... except what's actually going to happen is that people will record the port number and the time as well as the IP, and the ISP is going to record every single connection you make in a big database, and then bill you for the privilege of doing it. Law enforcement will still be able to identify you, now your ISP has a record of everything you've done, and you're still dealing with the headaches of NAT all the time. Doesn't really seem worth it to me.
- 4bpp 8y ago
  As far as I know, several court cases in Germany have confirmed[1] that the mapping of dynamically assigned IP to customer identity may only be stored for 7 days. I imagine the same upper bound, or an even tighter one, applies to the records you are talking about. [1] https://www.e-recht24.de/news/datenschutz/10387-datenschutz-speicherung-ip-adresse.html https://www.e-recht24.de/news/datenschutz/10387-datenschutz-... (in German)
  - pseudalopex 8y ago
    ISPs use port logs for the same reasons as address logs so I imagine a court would treat them the same.
  - Dagger2 8y ago
    Around here I'd expect something more like a 7 year minimum to be more likely... Limiting the timeframe does improve the costs and the privacy impact, but the ISP will still need to build and run all of the logging infrastructure, and the end result is that you'll still be identifiable.