4 ms·

OT: does IPv6 make it easier/harder for websites to track you?

mrweasel 5y ago
NAT is no longer a thing, all devices just have a globally unique IP. So your IP allow is a pretty strong indicator, it seems like that alone would make tracking easier. There’s nothing in IPv6 to prevent tracking or offer more anonymity.
- rk06 5y ago
  NAT can be used in conjunction with IPv6 for security purposes. It is still a thing
  - Dagger2 5y ago
    It was never a thing. NAT isn't security.
  - tsimionescu 5y ago
    How do you think NAT gives you security?
    - tgsovlerkhgsel 5y ago
      Without active measures to allow it, you can't reach ports on a machine behind NAT. If I accidentally run an SSH server where user 'root' and an empty password gives you root access, you still won't be able to get in. Accidentally configuring port forwarding is a lot harder than accidentally disabling an on-host firewall.
      - tsimionescu 5y ago
        You can just as easily run a firewall as a NAT, in fact most home routers support both. And, just like NAT, by default they don't allow any connections from the outside.
      - Dagger2 5y ago
        This is not actually true. NAT rewrites the apparent source address of outbound connections, which has no impact on inbound connections -- any inbound connection that worked before you started NATing your outbound connections will continue to work after you start doing so. You need a firewall for security, and NAT doesn't do anything in that regard other than make it harder to understand what's going on.
- techsupporter 5y ago
  As I recall, this was seen as a concern in the early days so "privacy extensions" were added to the implementation standard for IPv6. Macintosh, Windows, iOS, and Android all rotate their auto-configured IPv6 addresses at a regular interval. It used to be a day but I think I've seen it as short as an hour: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...
- mistaken 5y ago
  That's not quite true. IPv6 has privacy extensions which generate randomized suffixes. A website would still be able to track you with the common prefix. Tracking the prefix is more or less the same as tracking an IPv4 address. If you're worried about tracking than you're better off using a VPN than a NAT gateway (both of which is also possible with IPv6).
gruez 5y ago
Assuming your ISP gives you a /64 (and not /128), easier. With ipv4, all the traffic coming out of your house is from one ip, so the ip provides household level granularity. With ipv6 each device has a distinct address, which means the ip provides device-level granularity.
- stephen_g 5y ago
  That’s not true, all serious devices (except maybe IoT crapware) implement privacy extensions, so your computers and devices make requests from different, randomised address (within your allocated subnet obviously).
  - saurik 5y ago
    They don't make literally every single request from a different address off a fully shared prefix (as if you just randomize the final bits but also maintain some unique prefix bits, you still lost), so it is still worse than IPv4 with NAT, much worse than CGNAT, and AFAIK in most cases isn't much (if at all) better than assigning everyone a unique sticky address.
shakna 5y ago
IPv6 has a few extensions, that have been implemented in just about every OS, to make things more private. [0][1][2] To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016. [0] https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941 [1] https://datatracker.ietf.org/doc/html/rfc7217 https://datatracker.ietf.org/doc/html/rfc7217 [2] https://datatracker.ietf.org/doc/html/rfc7721 https://datatracker.ietf.org/doc/html/rfc7721
- gruez 5y ago
  >To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016. Not really. According to the wikipedia article[1], you still have an unique address per device. It rotates daily, but you still can uniquely identify a device on a daily basis. This wouldn't be possible with ivp4 with NAT. [1] https://en.wikipedia.org/wiki/IPv6#Stateless_address_autoconfiguration_.28SLAAC.29 https://en.wikipedia.org/wiki/IPv6#Stateless_address_autocon...
  - shakna 5y ago
    If you read RFC7721 which I linked above, you'll find that "SLAAC temporary addresses" is the bare minimum (from 2012), but not the recommended process (over a decade later). And is therefore not what most platforms use today. > DHCPv6 temporary addresses have the same properties as SLAAC temporary addresses (see Section 4.6). On the other hand, the properties of DHCPv6 non-temporary addresses typically depend on the specific DHCPv6 server software being employed. Recent releases of most popular DHCPv6 server software typically lease random addresses with a similar lease time as that of IPv4. Thus, these addresses can be considered to be "stable, semantically opaque". [DHCPv6-IID] specifies an algorithm that can be employed by DHCPv6 servers to generate "stable, semantically opaque" addresses. [0] The very last line of that Wikipedia paragraph points you to RFC8064 [1], which is a standard, and completely obsoletes the early "SLAAC temporary addresses", and makes the rest of the paragraph nothing but historical information. (The mention of Windows XP should stand out as a red flag, there.) > By default, nodes SHOULD NOT employ IPv6 address generation schemes that embed a stable link-layer address in the IID. [0] https://datatracker.ietf.org/doc/html/rfc7721#section-4.7 https://datatracker.ietf.org/doc/html/rfc7721#section-4.7 [1] https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064

NAT is no longer a thing, all devices just have a globally unique IP. So your IP allow is a pretty strong indicator, it seems like that alone would make tracking easier. There’s nothing in IPv6 to prevent tracking or offer more anonymity.

rk06 5y ago
NAT can be used in conjunction with IPv6 for security purposes. It is still a thing
- Dagger2 5y ago
  It was never a thing. NAT isn't security.
- tsimionescu 5y ago
  How do you think NAT gives you security?
  - tgsovlerkhgsel 5y ago
    Without active measures to allow it, you can't reach ports on a machine behind NAT. If I accidentally run an SSH server where user 'root' and an empty password gives you root access, you still won't be able to get in. Accidentally configuring port forwarding is a lot harder than accidentally disabling an on-host firewall.
    - tsimionescu 5y ago
      You can just as easily run a firewall as a NAT, in fact most home routers support both. And, just like NAT, by default they don't allow any connections from the outside.
    - Dagger2 5y ago
      This is not actually true. NAT rewrites the apparent source address of outbound connections, which has no impact on inbound connections -- any inbound connection that worked before you started NATing your outbound connections will continue to work after you start doing so. You need a firewall for security, and NAT doesn't do anything in that regard other than make it harder to understand what's going on.
techsupporter 5y ago
As I recall, this was seen as a concern in the early days so "privacy extensions" were added to the implementation standard for IPv6. Macintosh, Windows, iOS, and Android all rotate their auto-configured IPv6 addresses at a regular interval. It used to be a day but I think I've seen it as short as an hour: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...
mistaken 5y ago
That's not quite true. IPv6 has privacy extensions which generate randomized suffixes. A website would still be able to track you with the common prefix. Tracking the prefix is more or less the same as tracking an IPv4 address. If you're worried about tracking than you're better off using a VPN than a NAT gateway (both of which is also possible with IPv6).

gruez 5y ago

Assuming your ISP gives you a /64 (and not /128), easier. With ipv4, all the traffic coming out of your house is from one ip, so the ip provides household level granularity. With ipv6 each device has a distinct address, which means the ip provides device-level granularity.

stephen_g 5y ago
That’s not true, all serious devices (except maybe IoT crapware) implement privacy extensions, so your computers and devices make requests from different, randomised address (within your allocated subnet obviously).
- saurik 5y ago
  They don't make literally every single request from a different address off a fully shared prefix (as if you just randomize the final bits but also maintain some unique prefix bits, you still lost), so it is still worse than IPv4 with NAT, much worse than CGNAT, and AFAIK in most cases isn't much (if at all) better than assigning everyone a unique sticky address.

shakna 5y ago

IPv6 has a few extensions, that have been implemented in just about every OS, to make things more private. [0][1][2] To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016. [0] https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941 [1] https://datatracker.ietf.org/doc/html/rfc7217 https://datatracker.ietf.org/doc/html/rfc7217 [2] https://datatracker.ietf.org/doc/html/rfc7721 https://datatracker.ietf.org/doc/html/rfc7721

gruez 5y ago
>To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016. Not really. According to the wikipedia article[1], you still have an unique address per device. It rotates daily, but you still can uniquely identify a device on a daily basis. This wouldn't be possible with ivp4 with NAT. [1] https://en.wikipedia.org/wiki/IPv6#Stateless_address_autoconfiguration_.28SLAAC.29 https://en.wikipedia.org/wiki/IPv6#Stateless_address_autocon...
- shakna 5y ago
  If you read RFC7721 which I linked above, you'll find that "SLAAC temporary addresses" is the bare minimum (from 2012), but not the recommended process (over a decade later). And is therefore not what most platforms use today. > DHCPv6 temporary addresses have the same properties as SLAAC temporary addresses (see Section 4.6). On the other hand, the properties of DHCPv6 non-temporary addresses typically depend on the specific DHCPv6 server software being employed. Recent releases of most popular DHCPv6 server software typically lease random addresses with a similar lease time as that of IPv4. Thus, these addresses can be considered to be "stable, semantically opaque". [DHCPv6-IID] specifies an algorithm that can be employed by DHCPv6 servers to generate "stable, semantically opaque" addresses. [0] The very last line of that Wikipedia paragraph points you to RFC8064 [1], which is a standard, and completely obsoletes the early "SLAAC temporary addresses", and makes the rest of the paragraph nothing but historical information. (The mention of Windows XP should stand out as a red flag, there.) > By default, nodes SHOULD NOT employ IPv6 address generation schemes that embed a stable link-layer address in the IID. [0] https://datatracker.ietf.org/doc/html/rfc7721#section-4.7 https://datatracker.ietf.org/doc/html/rfc7721#section-4.7 [1] https://datatracker.ietf.org/doc/html/rfc8064 https://datatracker.ietf.org/doc/html/rfc8064