3 ms·

IPv6 Privacy Extension as defined in RFC 4941 is commonly implemented and prevents this from being an issue.

by sliken 8y ago

JohnFen 8y ago
"Prevents" is overstating this a bit. The IPv6 Privacy Extension is a hack that doesn't completely mitigate this sort of problem. It's just better than nothing, and is all we have.
- sliken 8y ago
  How so? With IPv4 you reveal the IP of your IP Masq/Nat router, which is often inside your home/business. It can be dynamic or static, but generally changes pretty slowly. There might be a single person behind that IP, or 100s. With IPv6 your /64 is often inside your home/business. It can be dynamics or static, but generally changes pretty slowly. There might be a single person behind that /64, or 100s. Different outgoing connections see different IPv6 addresses, and they change over time (slowly). Most importantly just like a mac address, the outgoing connections never use the IPv6 address based on mac address. So how does the privacy extension not protect the privacy of users by hiding the mac address?
  - JohnFen 8y ago
    > So how does the privacy extension not protect the privacy of users by hiding the mac address? I never said it didn't. I stated that people overstate the protection the facility provides, not that it didn't provide protection. The deficiencies of the privacy extensions have been discussed widely for years. A quick internet search will show the various criticisms and responses better than any reply I can make here will. I should, however, clarify what I was trying to say -- I was not trying to say the privacy extensions aren't worthwhile. They're great, and people should use them! What I was trying to say is that people often think of them as a panacea or a 100% solution. They aren't exactly that (what is?), and the nature of the design of the privacy extensions are such that they make other important network management activities more difficult. My main criticism of PE (and it's not a showstopper sort of criticism) is that the extensions are hacky and it shows. They were thought up after-the-fact to try to mitigate a security mistake made in the original IPv6 protocol.
    - sliken 8y ago
      Sure, but the original parent was complaining about the mac address (not any larger privacy issues) and the PE does a good job of hiding the mac address and is enable by default in many common operating systems (Mac, Windows, Ubuntu, etc.)

IPv6 Privacy Extension as defined in RFC 4941 is commonly implemented and prevents this from being an issue.

by sliken 8y ago

IPv6 Privacy Extension as defined in RFC 4941 is commonly implemented and prevents this from being an issue.

"Prevents" is overstating this a bit. The IPv6 Privacy Extension is a hack that doesn't completely mitigate this sort of problem. It's just better than nothing, and is all we have.

sliken 8y ago
How so? With IPv4 you reveal the IP of your IP Masq/Nat router, which is often inside your home/business. It can be dynamic or static, but generally changes pretty slowly. There might be a single person behind that IP, or 100s. With IPv6 your /64 is often inside your home/business. It can be dynamics or static, but generally changes pretty slowly. There might be a single person behind that /64, or 100s. Different outgoing connections see different IPv6 addresses, and they change over time (slowly). Most importantly just like a mac address, the outgoing connections never use the IPv6 address based on mac address. So how does the privacy extension not protect the privacy of users by hiding the mac address?
- JohnFen 8y ago
  > So how does the privacy extension not protect the privacy of users by hiding the mac address? I never said it didn't. I stated that people overstate the protection the facility provides, not that it didn't provide protection. The deficiencies of the privacy extensions have been discussed widely for years. A quick internet search will show the various criticisms and responses better than any reply I can make here will. I should, however, clarify what I was trying to say -- I was not trying to say the privacy extensions aren't worthwhile. They're great, and people should use them! What I was trying to say is that people often think of them as a panacea or a 100% solution. They aren't exactly that (what is?), and the nature of the design of the privacy extensions are such that they make other important network management activities more difficult. My main criticism of PE (and it's not a showstopper sort of criticism) is that the extensions are hacky and it shows. They were thought up after-the-fact to try to mitigate a security mistake made in the original IPv6 protocol.
  - sliken 8y ago
    Sure, but the original parent was complaining about the mac address (not any larger privacy issues) and the PE does a good job of hiding the mac address and is enable by default in many common operating systems (Mac, Windows, Ubuntu, etc.)