4 ms·

It's not wholly logical, but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using rando

It's not wholly logical, but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4, and that it's more easily possible to configure a VPN that leaks IPv6 traffic via non-VPN routes. I don't agree that disabling IPv6 improves privacy, but there is some foundation for the idea.

gruez 4y ago
>but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4 Are privacy address per machine or per connection? My impression is that they're the former, which still makes them worse than IPV4 + NAT.
- zaarn 4y ago
  Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Stable-Privacy is just like having an IPv4, but if your prefix changes the suffix changes, so you can't be easily traced across prefix changes. For desktops, normal privacy should be configured.
  - gruez 4y ago
    > Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Sounds like it's still worse than IPV4 + NAT, because your address + port tuple changes with each connection, whereas with ipv6 it's the same across connections for 10 minutes.
    - zaarn 4y ago
      With IPv4 + NAT your address does not change for 24h in most connections, while with IPv6 it changes every 10 minutes. IPv6 is better for privacy there. The outgoing port for IPv6 is also still randomized, so if you look at it over 2 days, on IPv4 you get two IPs doing a series of connections while with IPv6 you have potentially thousands for each device doing connections, with no way to correlate them.
- stop50 4y ago
  Ipv6 addresses can be static, halfrandom and random. in an older version the mac is used to create ipv6 addresses, but a few years ago privacy extensions were created that create random addresses for each ipv6 networkdevice in an computer that is regulary changed.
  - duskwuff 4y ago
    > a few years ago privacy extensions were created More than a few. RFC 3041 was published in January 2001. https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041
    - stop50 4y ago
      And there are still devices that don't implement it.
Sunspark 4y ago
I don't agree either, and in fact, NAT is awful it breaks core functionality of the internet. I am old enough to remember the days when everyone had a unique IP address and things like FTP and all the rest would "just work". Now you have to have all sorts of elaborate mechanisms like STUN, etc. to find a third server to coordinate handshaking so video chat can work, sometimes necessary to be relayed through the third server instead of directly between the two clients.
- krylon 4y ago
  > things like FTP and all the rest would "just work". I remember reading about one or more web browsers dropping FTP support entirely not very long ago. Sic transit gloria mundi. EDIT: Just in case it is not clear, I wholeheartedly agree with you!

gruez 4y ago

>but I think they might be working under the assumption that IPv6 addresses are usually "more public" (when accidentally not using random privacy addresses?) than NATed IPv4 Are privacy address per machine or per connection? My impression is that they're the former, which still makes them worse than IPV4 + NAT.

zaarn 4y ago
Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Stable-Privacy is just like having an IPv4, but if your prefix changes the suffix changes, so you can't be easily traced across prefix changes. For desktops, normal privacy should be configured.
- gruez 4y ago
  > Privacy Addresses are for a time slice of connections. You can cycle a new address every 10 minutes but the OS will keep old addresses until all connections over these addresses have been closed. Sounds like it's still worse than IPV4 + NAT, because your address + port tuple changes with each connection, whereas with ipv6 it's the same across connections for 10 minutes.
  - zaarn 4y ago
    With IPv4 + NAT your address does not change for 24h in most connections, while with IPv6 it changes every 10 minutes. IPv6 is better for privacy there. The outgoing port for IPv6 is also still randomized, so if you look at it over 2 days, on IPv4 you get two IPs doing a series of connections while with IPv6 you have potentially thousands for each device doing connections, with no way to correlate them.
stop50 4y ago
Ipv6 addresses can be static, halfrandom and random. in an older version the mac is used to create ipv6 addresses, but a few years ago privacy extensions were created that create random addresses for each ipv6 networkdevice in an computer that is regulary changed.
- duskwuff 4y ago
  > a few years ago privacy extensions were created More than a few. RFC 3041 was published in January 2001. https://datatracker.ietf.org/doc/html/rfc3041 https://datatracker.ietf.org/doc/html/rfc3041
  - stop50 4y ago
    And there are still devices that don't implement it.

Sunspark 4y ago

I don't agree either, and in fact, NAT is awful it breaks core functionality of the internet. I am old enough to remember the days when everyone had a unique IP address and things like FTP and all the rest would "just work". Now you have to have all sorts of elaborate mechanisms like STUN, etc. to find a third server to coordinate handshaking so video chat can work, sometimes necessary to be relayed through the third server instead of directly between the two clients.

krylon 4y ago
> things like FTP and all the rest would "just work". I remember reading about one or more web browsers dropping FTP support entirely not very long ago. Sic transit gloria mundi. EDIT: Just in case it is not clear, I wholeheartedly agree with you!