4 ms·

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer

You can't correlate the number of addresses with the number of devices because IPv6 temporary addresses exist. If you enable temporary addresses, your computer will periodically randomly generate a new address and switch to it. https://www.rfc-editor.org/rfc/rfc8981.html https://www.rfc-editor.org/rfc/rfc8981.html

jrm4 6mo ago
[flagged]
- craftkiller 6mo ago
  Temporary addresses are enabled by default in OSX, windows, android, and iOS. That's what, like 95% of the consumer non-server market? As for Linux, that's going to be up to each distro to decide what their defaults are. It looks like they are _not_ the default on FreeBSD, which makes sense because that OS is primarily targeting servers (even though I use it on my laptop).
  - zekica 6mo ago
    Temporary addresses are used by any Linux distro using NetworkManager (all desktop ones). For server distros, it can differ.
  - Levitating 6mo ago
    In Gnome it's just a toggle in the network settings
- electronsoup 6mo ago
  and most OS do enable it by default
- password4321 6mo ago
  > ALL THE HEAVY LIFTING THERE > MUCH MORE IMPORTANT I haven't done the exhaustive research but props in advance for being the only person shouting in caps on HN. Definitely one way to proclaim one's not AI-ness without forced spelling errors.
  - jrm4 6mo ago
    Didn't even think about that. Interesting.
saltcured 6mo ago
I feel like this is a silly narrowing of the problem for normal, retail users. My priority isn't masking "the number of addresses" or devices. My desire is to not have a persistent identifier to correlate all my traffic. The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID. I'm not an IPv4 apologist though. Clearly the NAT/DHCP assignments from the ISP are essentially the same risk, with just one shallow layer of pseudo-obscurity. I'd rather have IPv6 and remind myself that my traffic is tagged with my customer ID, one way or another. Unfortunately, I see no real hope that this will ever be mitigated. Incentives are not aligned for any ISP to actually help mask customer traffic. It seems that onion routing (i.e. Tor) is the best anyone has come up with, and I suspect that in today's world, this has become a net liability for a mundane, privacy-conscious user.
- ronsor 6mo ago
  > The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID. So the same as the public IPv4 on a traditional home NAT setup?
  - graemep 6mo ago
    Most home users do not have a static public IPv4 address - they have a single address that changes over time.
    - db48x 6mo ago
      But most ISPs aren’t giving out static IPv6 prefixes either. Instead they are collecting logs of what addresses they’ve handed out to which customer and holding on to them for years and years in case a court requests them. Tracking visitors doesn’t need to use ip addresses simply because it’s trivial to do so with cookies or browser fingerprinting. There’s exactly zero privacy either way.
      - graemep 6mo ago
        > Instead they are collecting logs of what addresses they’ve handed out to which customer and holding on to them for years and years in case a court requests them. They are only supposed to hang on to them for a limited time according to the law where I live (six months AFAIK). Courts are also unwilling to accept IPv4 addresses as proof of identity. > Tracking visitors doesn’t need to use ip addresses simply because it’s trivial to do so with cookies or browser fingerprinting Cookies can be deleted. Browser fingerprinting can be made unreliable. Its not zero privacy either way. Privacy is not a binary. Giving out more information reduces your privacy.
deleted 6mo ago
[deleted]

jrm4 6mo ago

[flagged]

craftkiller 6mo ago
Temporary addresses are enabled by default in OSX, windows, android, and iOS. That's what, like 95% of the consumer non-server market? As for Linux, that's going to be up to each distro to decide what their defaults are. It looks like they are _not_ the default on FreeBSD, which makes sense because that OS is primarily targeting servers (even though I use it on my laptop).
- zekica 6mo ago
  Temporary addresses are used by any Linux distro using NetworkManager (all desktop ones). For server distros, it can differ.
- Levitating 6mo ago
  In Gnome it's just a toggle in the network settings
electronsoup 6mo ago
and most OS do enable it by default
password4321 6mo ago
> ALL THE HEAVY LIFTING THERE > MUCH MORE IMPORTANT I haven't done the exhaustive research but props in advance for being the only person shouting in caps on HN. Definitely one way to proclaim one's not AI-ness without forced spelling errors.
- jrm4 6mo ago
  Didn't even think about that. Interesting.

saltcured 6mo ago

I feel like this is a silly narrowing of the problem for normal, retail users. My priority isn't masking "the number of addresses" or devices. My desire is to not have a persistent identifier to correlate all my traffic. The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID. I'm not an IPv4 apologist though. Clearly the NAT/DHCP assignments from the ISP are essentially the same risk, with just one shallow layer of pseudo-obscurity. I'd rather have IPv6 and remind myself that my traffic is tagged with my customer ID, one way or another. Unfortunately, I see no real hope that this will ever be mitigated. Incentives are not aligned for any ISP to actually help mask customer traffic. It seems that onion routing (i.e. Tor) is the best anyone has come up with, and I suspect that in today's world, this has become a net liability for a mundane, privacy-conscious user.

ronsor 6mo ago
> The whole idea of temporary addresses fails at this because the network prefix becomes the correlation ID. So the same as the public IPv4 on a traditional home NAT setup?
- graemep 6mo ago
  Most home users do not have a static public IPv4 address - they have a single address that changes over time.
  - db48x 6mo ago
    But most ISPs aren’t giving out static IPv6 prefixes either. Instead they are collecting logs of what addresses they’ve handed out to which customer and holding on to them for years and years in case a court requests them. Tracking visitors doesn’t need to use ip addresses simply because it’s trivial to do so with cookies or browser fingerprinting. There’s exactly zero privacy either way.
    - graemep 6mo ago
      > Instead they are collecting logs of what addresses they’ve handed out to which customer and holding on to them for years and years in case a court requests them. They are only supposed to hang on to them for a limited time according to the law where I live (six months AFAIK). Courts are also unwilling to accept IPv4 addresses as proof of identity. > Tracking visitors doesn’t need to use ip addresses simply because it’s trivial to do so with cookies or browser fingerprinting Cookies can be deleted. Browser fingerprinting can be made unreliable. Its not zero privacy either way. Privacy is not a binary. Giving out more information reduces your privacy.

deleted 6mo ago

[deleted]