4 ms·

> nobody can infer anything about your network They can infer that one IPV6 address matches to exactly one device. (reverse is not true, one device may have mu

> nobody can infer anything about your network They can infer that one IPV6 address matches to exactly one device. (reverse is not true, one device may have multiple addresses per privacy extensions) Once device is identified all its past traffic is discernible. Changing addresses means identification needs to be done again but once done it can be associated with past addresses and again, all its history is visible. Identification might just mean querying a data broker with HTTP headers. NAT does not have this issue.

jcalvinowens 4y ago
> They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.
- adriancr 4y ago
  > The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). This is what I structured my inital argument on. Do you see any fallacy in logic?
  - justeleblanc 4y ago
    You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?
    - adriancr 4y ago
      you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name) Once identity is known for address X you know its traffic for the day, including past traffic for the day. once address changes you do the whole identification again. All these logs where address is identified goes to bucket X. On addresses where you couldnt identify that day you put them in unknown bucket. Once you have a profile of the network, you can do exclusion (Only 4 people in household, 3 active with known addresses, not X, one unknown address, you can assume its X)
      - jiggawatts 4y ago
        Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are based on your porn viewing habits, then just set up IPv6 NAT.
        adriancr 4y ago
        > Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. That's a broad assumption, and I can assure you they will due to lower costs (no need to pay data broker if you already know target, no need for extra traffic, load, etc). Also due to better targetting you get better prices per ads served. > just not a valid reason to abandon the benefits of IPv6 What are the benefits to allow each device its own address if I'm going to firewall them anyway? > Please stop with this line of argument. Why?, my concern is valid, all you've said so far is nobody cares. I disagree. > If you’re really desperate to ensure that the ads shown to your daughter are based on your porn viewing habits, then just set up IPv6 NAT That says a lot about yourself if you resort to this sort of snarky comments, I have no wish to continue this conversation. Note: I said in another comment I have set up IPv6 NAT and it works great.
  - throw0101c 4y ago
    > Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs? On macOS it's 24h, but it doesn't have to be: $ sysctl -a | grep temppltime net.inet6.ip6.temppltime: 86400
    - adriancr 4y ago
      I mean, it's the same point, single address to single node, just more often, so need to identify more often. Minutes or less I guess would defeat tracking, but then what's the point?, it's almost equivalent to NAT it still breaks reverse connectivity? and does it actually work? It also feels like a workaround for an oversight.
      - throw0101c 4y ago
        > I mean, it's the same point, single address to single node, just more often, so need to identify more often. But how would they know it is to the same node? I have my DSL router-modem reboot every night, and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec. Similarly with the reboot I get a new /64 prefix delegation (actually /56), so I would hazard to guess if IPv6 starts getting tracked, I'd get the same crazy results.
    - mqus 4y ago
      ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection. I don't see IPv6 doing the same thing(it has no clue about connections)
      - throw0101c 4y ago
        > ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection. No one cares about tracking by port. Folks are tracking by IP(v4) address. I know this first hand because I have my DSL router-modem auto-reboot every night (built-in Asus functionality), and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec. And given that I have IPv6, most OSes generally use that as a first preference for connectivity, and so my IPv6 address/prefix is "in" Quebec. And this is even with cookies enabled, which should make tracking by browsing easier (esp. since I get decently-accurate recommendations based on viewing history), but yet I still get French ads because my IPv4/IPv6 address is "in" Quebec. So I have no idea what people are talking about when they say IPv6 will make tracking easier than IPv4. With RFC 4941 it's a solved problem IMHO and no worse under dual-stack than it is under single-stack.

jcalvinowens 4y ago

> They can infer that an address matches to a single device No they can't: the whole point of RFC4941/8981 is to prevent that. The source address for external connections is effectively randomized. All that can be inferred is that it came from your network, but even with NAT you know that anyway.

adriancr 4y ago
> The source address for external connections is effectively randomized It's still unique to one device right?, even if random my argument still holds. Or do you mean to say multiple devices can use the same address? note: I've read the RFCs and they just mean - initial address is random but unique to a device. Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). This is what I structured my inital argument on. Do you see any fallacy in logic?
- justeleblanc 4y ago
  You literally wrote "Once device is identified all its past traffic is discernible." How is that compatible with devices changing their address every day?
  - adriancr 4y ago
    you identify device each day, identity is X, daughter of Y on iPad. Once identified via data broker all its traffic is identifiable including torrents for example and porn websites, etc (say X goes to facebook with new address it now has real name) Once identity is known for address X you know its traffic for the day, including past traffic for the day. once address changes you do the whole identification again. All these logs where address is identified goes to bucket X. On addresses where you couldnt identify that day you put them in unknown bucket. Once you have a profile of the network, you can do exclusion (Only 4 people in household, 3 active with known addresses, not X, one unknown address, you can assume its X)
    - jiggawatts 4y ago
      Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. The “I don’t care if they track my household but it’s critical that Daddy’s activity not get disambiguated from my dealing daughter” is just not a valid reason to abandon the benefits of IPv6. Please stop with this line of argument. If you’re really desperate to ensure that the ads shown to your daughter are based on your porn viewing habits, then just set up IPv6 NAT.
      - adriancr 4y ago
        > Nobody bothers to do this kind of tracking because web browsers leak 100x more information by default anyway. That's a broad assumption, and I can assure you they will due to lower costs (no need to pay data broker if you already know target, no need for extra traffic, load, etc). Also due to better targetting you get better prices per ads served. > just not a valid reason to abandon the benefits of IPv6 What are the benefits to allow each device its own address if I'm going to firewall them anyway? > Please stop with this line of argument. Why?, my concern is valid, all you've said so far is nobody cares. I disagree. > If you’re really desperate to ensure that the ads shown to your daughter are based on your porn viewing habits, then just set up IPv6 NAT That says a lot about yourself if you resort to this sort of snarky comments, I have no wish to continue this conversation. Note: I said in another comment I have set up IPv6 NAT and it works great.
- throw0101c 4y ago
  > Each day the address will likely change but new address is still unique to the device (otherwise how would routing work). If you set up your device to spin up a new IPv6 address every hour (or even every minute), how will they track you using IPs? On macOS it's 24h, but it doesn't have to be: $ sysctl -a | grep temppltime net.inet6.ip6.temppltime: 86400
  - adriancr 4y ago
    I mean, it's the same point, single address to single node, just more often, so need to identify more often. Minutes or less I guess would defeat tracking, but then what's the point?, it's almost equivalent to NAT it still breaks reverse connectivity? and does it actually work? It also feels like a workaround for an oversight.
    - throw0101c 4y ago
      > I mean, it's the same point, single address to single node, just more often, so need to identify more often. But how would they know it is to the same node? I have my DSL router-modem reboot every night, and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec. Similarly with the reboot I get a new /64 prefix delegation (actually /56), so I would hazard to guess if IPv6 starts getting tracked, I'd get the same crazy results.
  - mqus 4y ago
    ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection. I don't see IPv6 doing the same thing(it has no clue about connections)
    - throw0101c 4y ago
      > ipv4 with NAT gets you a new "adress"(meaning port) on every single new connection. No one cares about tracking by port. Folks are tracking by IP(v4) address. I know this first hand because I have my DSL router-modem auto-reboot every night (built-in Asus functionality), and I get all sorts of crazy results for ads: I'm in southern Ontario, as is my ISP, but they service folks in Quebec, and so sometimes I get Youtube ads in French since (per my IP) I'm "in" Quebec. And given that I have IPv6, most OSes generally use that as a first preference for connectivity, and so my IPv6 address/prefix is "in" Quebec. And this is even with cookies enabled, which should make tracking by browsing easier (esp. since I get decently-accurate recommendations based on viewing history), but yet I still get French ads because my IPv4/IPv6 address is "in" Quebec. So I have no idea what people are talking about when they say IPv6 will make tracking easier than IPv4. With RFC 4941 it's a solved problem IMHO and no worse under dual-stack than it is under single-stack.