4 ms·

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective. But then in reality one IPv4 /32 is often many

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective. But then in reality one IPv4 /32 is often many users due to NAT. Doesn't that make privacy better with v4?

AgentME 6y ago
In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.
- saurik 6y ago
  Except now you are potentially leaking information about the individual computers in the lower 64 bits; if you generate those randomly for every single connection then you can mitigate that, but is that how this is actually being implemented or are they just doing periodic cycling? With NAT you were just guaranteed that this would always be safe.
  - Reelin 6y ago
    > With NAT you were just guaranteed that this would always be safe. Another safety benefit of NAT is that if you use a private IP address block (ex 192.168/16) you can be reasonably certain that your devices aren't publicly routable without bothering to actually check the router firewall configuration. This is particularly nice for home networks - I don't usually want my home devices to be reachable from the internet at large. To understand what I'm getting at here, imagine trying to walk an elderly relative through verifying their firewall configuration over the phone. A simple command to check the IP address was enough with NAT.
- swinglock 6y ago
  In mobile networks I've only ever seen one UE get one /64, meaning most IPv6 users in the world does not share their /64 with anyone else, if I'm not very mistaken. I think this is standardized in 3GPP but I won't dig for it. Other sites should get a /56, including home users. That's in RFC 6177. This is a best practice RFC of "shoulds" rather than "musts" so technically it's still IPv6 if your ISP only give you a /64 for your site... but it's wrong. Your LAN devices (if you only have one LAN in your site, typical for a home) could still all be in the same /64. But the difference between one home and one person is small in the context of tracking for purposes of advertisement and besides, the trackers get extra bits per device which were hidden when the same devices were behind one IPv4 NAT. Poorly hidden, as all devices probably had different user-agents or resolutions and a hundred other things to fingerprint anyway but still, slightly less accessible.

AgentME 6y ago

In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.

saurik 6y ago
Except now you are potentially leaking information about the individual computers in the lower 64 bits; if you generate those randomly for every single connection then you can mitigate that, but is that how this is actually being implemented or are they just doing periodic cycling? With NAT you were just guaranteed that this would always be safe.
- Reelin 6y ago
  > With NAT you were just guaranteed that this would always be safe. Another safety benefit of NAT is that if you use a private IP address block (ex 192.168/16) you can be reasonably certain that your devices aren't publicly routable without bothering to actually check the router firewall configuration. This is particularly nice for home networks - I don't usually want my home devices to be reachable from the internet at large. To understand what I'm getting at here, imagine trying to walk an elderly relative through verifying their firewall configuration over the phone. A simple command to check the IP address was enough with NAT.
swinglock 6y ago
In mobile networks I've only ever seen one UE get one /64, meaning most IPv6 users in the world does not share their /64 with anyone else, if I'm not very mistaken. I think this is standardized in 3GPP but I won't dig for it. Other sites should get a /56, including home users. That's in RFC 6177. This is a best practice RFC of "shoulds" rather than "musts" so technically it's still IPv6 if your ISP only give you a /64 for your site... but it's wrong. Your LAN devices (if you only have one LAN in your site, typical for a home) could still all be in the same /64. But the difference between one home and one person is small in the context of tracking for purposes of advertisement and besides, the trackers get extra bits per device which were hidden when the same devices were behind one IPv4 NAT. Poorly hidden, as all devices probably had different user-agents or resolutions and a hundred other things to fingerprint anyway but still, slightly less accessible.