3 ms·

> If a web server wanted to track you, they would just use your IP. I'd think a HN user would know that using an IP to track isn't effective. For most home de

> If a web server wanted to track you, they would just use your IP. I'd think a HN user would know that using an IP to track isn't effective. For most home desktop users, at best, it tracks an individual household, not a person. For corporate users and highly privacy-conscious home users, it's probably completely worthless as VPNs will make everyone come from a single IP. For mobile users, it's completely worthless. You'd be tracking users of a specific WiFi network. If your phone is connecting via IPv4, then who knows who you're tracking, as phones on a mobile network will share an IP address.

ketralnis 4y ago
And if you think VPN users are too obscure a use case to account for, a specific case I've dealt with is (1) all of AOL coming from one IP in Virginia (yes this was a while ago) and (2) almost every university appearing as a single IP (on a website frequented by university students)
- jgalt212 4y ago
  As recently as 2006, an entire country was behind a VPN using a single public IP address. If lore can be believed... https://superuser.com/questions/1013630/why-does-qatar-use-a-single-ip-address-when-800-000-ip-addresses-are-allocated-t https://superuser.com/questions/1013630/why-does-qatar-use-a...
- mike_d 4y ago
  At a previous job we tracked unique visitors to prevent ad fraud. You'd find not only individual IPs with thousands of users behind them, but also larger populations of users numbering in the tens of thousands behind a small block of 8-16 IPs. The craziest was a large multinational corporation that (I guess for security?) changed their egress IP daily. The first three octets remained the same and the fourth was equal to the day of the month UTC. Really screws things up when you use a 14 day rolling window of previous traffic for comparisons.
- kccqzy 4y ago
  Universities do that now? When I was in college, if one connects to the visitor network they'd give you a RFC1918 address with NAT and a restrictive firewall, but if one connects to the regular network and authenticates as a student, they give you a publicly routable IP address.
  - jesprenj 4y ago
    Depends on a lot of factory. The primary school I was a student at had public IPs at every computer, our national academic and research network operators are encouraging local network operators to avoid private IPs. But the high school at which I'm currently a student, has private IP addresses on every computer and a single external IPv4 for the entire facility. It's not so one sided.
    - lazide 4y ago
      Many will also push http/https proxies regardless of IP addressing schemes, so even if one user bypasses it, anyone using defaults will come from whatever the external proxy IP is.
      - ketralnis 4y ago
        I went to a community college that did transparent HTTP proxying with not just deep packet inspection but caching and "security"-oriented javascript injection. Headers would get reordered, and its parser wasn't perfect so multi-line headers would get broken sometimes. They'd inject JS into pages to scan for... something? Other injected JS? I have no idea. But it was impossible to directly connect to another server without going through their proxy even though from the TCP layer it looked like you were. Lots of difficult to debug issues.
        lazide 4y ago
        Wow, that’s impressively evil. Right up there with the old ‘rewrite DNS traffic’ trick from ISPs. Any idea what make/model the proxy was?
- bigiain 4y ago
  Last time I worked on a project that cared/tracked this (~4 years back), all the prepaid cellular data users from one of the big 4 telcos here ended up on CGNAT and appeared to come form a small pool of 4 IP addresses.
  - mgbmtl 4y ago
    Just use IPv6, and all mobile users will have unique addresses (although they might rotate, and IP tracking is generally not very reliable, as other mentioned).
bawolff 4y ago
I mean, i expect most people who use a vpn to also use incognito mode as well, which i assume would prevent this type of tracking.

ketralnis 4y ago

And if you think VPN users are too obscure a use case to account for, a specific case I've dealt with is (1) all of AOL coming from one IP in Virginia (yes this was a while ago) and (2) almost every university appearing as a single IP (on a website frequented by university students)

jgalt212 4y ago
As recently as 2006, an entire country was behind a VPN using a single public IP address. If lore can be believed... https://superuser.com/questions/1013630/why-does-qatar-use-a-single-ip-address-when-800-000-ip-addresses-are-allocated-t https://superuser.com/questions/1013630/why-does-qatar-use-a...
mike_d 4y ago
At a previous job we tracked unique visitors to prevent ad fraud. You'd find not only individual IPs with thousands of users behind them, but also larger populations of users numbering in the tens of thousands behind a small block of 8-16 IPs. The craziest was a large multinational corporation that (I guess for security?) changed their egress IP daily. The first three octets remained the same and the fourth was equal to the day of the month UTC. Really screws things up when you use a 14 day rolling window of previous traffic for comparisons.
kccqzy 4y ago
Universities do that now? When I was in college, if one connects to the visitor network they'd give you a RFC1918 address with NAT and a restrictive firewall, but if one connects to the regular network and authenticates as a student, they give you a publicly routable IP address.
- jesprenj 4y ago
  Depends on a lot of factory. The primary school I was a student at had public IPs at every computer, our national academic and research network operators are encouraging local network operators to avoid private IPs. But the high school at which I'm currently a student, has private IP addresses on every computer and a single external IPv4 for the entire facility. It's not so one sided.
  - lazide 4y ago
    Many will also push http/https proxies regardless of IP addressing schemes, so even if one user bypasses it, anyone using defaults will come from whatever the external proxy IP is.
    - ketralnis 4y ago
      I went to a community college that did transparent HTTP proxying with not just deep packet inspection but caching and "security"-oriented javascript injection. Headers would get reordered, and its parser wasn't perfect so multi-line headers would get broken sometimes. They'd inject JS into pages to scan for... something? Other injected JS? I have no idea. But it was impossible to directly connect to another server without going through their proxy even though from the TCP layer it looked like you were. Lots of difficult to debug issues.
      - lazide 4y ago
        Wow, that’s impressively evil. Right up there with the old ‘rewrite DNS traffic’ trick from ISPs. Any idea what make/model the proxy was?
bigiain 4y ago
Last time I worked on a project that cared/tracked this (~4 years back), all the prepaid cellular data users from one of the big 4 telcos here ended up on CGNAT and appeared to come form a small pool of 4 IP addresses.
- mgbmtl 4y ago
  Just use IPv6, and all mobile users will have unique addresses (although they might rotate, and IP tracking is generally not very reliable, as other mentioned).

bawolff 4y ago

I mean, i expect most people who use a vpn to also use incognito mode as well, which i assume would prevent this type of tracking.