Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Going IPv6 Only [pdf]

pc.nanog.org

Post reply on HN
Print view View original

31–40 of 112 posts

Re: Going IPv6 Only [pdf]

#31

Post by Eech0Shu »

singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

For the 64bit suffix there are ipv6 privacy extensions. For the prefix some ISPs hand out a whole /56 to the user so their CPE can rotate through multiple /64s over time. And of course just like they can shuffle IPv4s they can also shuffle IPv6s.

Re: Going IPv6 Only [pdf]

#32

Post by Eech0Shu »

Sadly the "happy eyeballs" algorithm obscures IPv6 problems. For example some subnets of amazon cloudfront are v4-reachable from my ISP while being v6-unreachable. But others are v6-reachable. When a DNS name points to a mix of v4 and v6 addresses nobody notices the failure because browsers are quick to fall back to v4 and thus the issue never gets reported.

The other problem is that such issues are difficult to report in the first place as private customer because customer support is geared towards dealing with user errors or last mile problems.

Re: Going IPv6 Only [pdf]

#33

Post by JdeBP »

okket wrote: post #27
singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

IP client addresses can and do change, be it that they move from landline to mobile or cafe wifi etc. I doubt many use the IP address to track clients for an extended period of time (one hour? one day?). There are better tools for tracking, like cookies, session IDs, anything that client software voluntarily sends with some request of any kind. Nowadays even with least trackable protocol possible, DNS, as of DNS-over…

It's the part in the lower 64 bits that does not change as one moves around changing prefixes that worries people. And of course ways to pseudo-randomize that already exist, as mentioned already in this very discussion.

Re: Going IPv6 Only [pdf]

#34

Post by azernik »

singularity2001 wrote: post #18
lmns wrote: post #16

Earlier quoted context omitted.

You should have a look at the IPv6 privacy extensions. IPv6 doesn't work as you think it does. Your devices use temporary IPs even with a static IPv6 prefix.

Can't trackers just map the prefix to your id, or do many users share a prefix? will look it up...

A single user has at least a /64 (which in IPv6 must correspond to a subnet). This is the equivalent of a NATted IPv4 address for privacy purposes.

Often, in order to allow customers to use multiple subnets, ISPs will allocate a /56 (256 subnets) to customers.

For privacy purposes these have the same behavior as IPv4 addresses, in that they in theory can be rotated between users but in practice have lifetimes on the order of months.

Re: Going IPv6 Only [pdf]

#35

Post by okket »

phicoh wrote: post #11

It is weird to call this 'IPv6 Only'. Connectivity to the IPv4 internet is still provided. It is just that to talk IPv4 you have to go through a couple of complex translation steps.

It is IPv6 only with a fallback connection to the legacy IPv4 protocol with little to no chance of a reverse connection. Sadly, too much content is still stuck in this rapidly ageing world. Bandaid after bandaid won't help in the long term.

Do we really want a one way connection world? If not, adapt IPv6. By default IPv6 CPE gear blocks incoming connections, which is good. Firewall rules can be changed, if needed. You can't change forced CG-NAT.

Re: Going IPv6 Only [pdf]

#36

Post by pilif »

singularity2001 wrote: post #12

Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)? With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime? While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

> Is it reasonable to hate and avoid IPv6 for fears of further privacy erosion (easier tracking than with IPv4)?

no. If an ISP assigns you a dynamic prefix and the various machines in your network use any one of the various privacy features like temporary addresses then the only additional information you leak is some information about how many devices are in your LAN, but as the devices make up additional addresses, it's very fuzzy.

> With IPv4 my ISP has to shuffle IPs with every reconnect. With IPv6 you could get one IP for lifetime?

Your ISP can hand out a new prefix whenever you connect, or even while you are connected. Most of them do this by default.

>While ISP that hand out a static IPv4 can exist, it's much more unlikely, whereas with IPv6 it will become the norm.

it doesn't look like it - at least here in Switzerland, all providers that do provide v6 addresses hand out dynamic prefixes by default and most don't even offer the option of getting a static prefix.

Re: Going IPv6 Only [pdf]

#37

Post by [deleted] »

JdeBP wrote: post #33
okket wrote: post #27

Earlier quoted context omitted.

IP client addresses can and do change, be it that they move from landline to mobile or cafe wifi etc. I doubt many use the IP address to track clients for an extended period of time (one hour? one day?). There are better tools for tracking, like cookies, session IDs, anything that client software voluntarily sends with some request of any kind. Nowadays even with least trackable protocol possible, DNS, as of DNS-over…

It's the part in the lower 64 bits that does not change as one moves around changing prefixes that worries people. And of course ways to pseudo-randomize that already exist, as mentioned already in this very discussion.

[deleted]

Re: Going IPv6 Only [pdf]

#38

Post by pilif »

JdeBP wrote: post #33
okket wrote: post #27

Earlier quoted context omitted.

IP client addresses can and do change, be it that they move from landline to mobile or cafe wifi etc. I doubt many use the IP address to track clients for an extended period of time (one hour? one day?). There are better tools for tracking, like cookies, session IDs, anything that client software voluntarily sends with some request of any kind. Nowadays even with least trackable protocol possible, DNS, as of DNS-over…

It's the part in the lower 64 bits that does not change as one moves around changing prefixes that worries people. And of course ways to pseudo-randomize that already exist, as mentioned already in this very discussion.

for the last 10 years or so, every single OS out there randomises the lower bits by default and even rotates it every few connections.

The thing that remains static is the prefix you got from your ISP but that works in exactly the same way as your v4 address you get when you connect.

Re: Going IPv6 Only [pdf]

#39

Post by azernik »

dstick wrote: post #29

I've been following the IPv6 rollout with interest for the last few years from outside the networking / RIR / LIR / ISP community and I have a question if anyone could provide some insights: ARIN is already out of IPv4, RIPE just finished their last /8 and are now going through the remaining available pile - what happens when they're all gone? Won't the world sort of be forced to migrate?

This increases the motivation, but there are methods of delaying the hard requirement to migrate. A smaller patch is to reclaim unused blocks; a bigger one is carrier-grade NAT. e.g. in some countries such as Russia your ISP will allocate you a 10.0.0.0/8 address rather than a publicly-routable one, and will have a NAT between its customers in your city and the publicly-addressable internet.

And yes, this is an ugly solution and comes with a lot of problems and costs.

Re: Going IPv6 Only [pdf]

#40

Post by akvadrako »

dstick wrote: post #29

I've been following the IPv6 rollout with interest for the last few years from outside the networking / RIR / LIR / ISP community and I have a question if anyone could provide some insights: ARIN is already out of IPv4, RIPE just finished their last /8 and are now going through the remaining available pile - what happens when they're all gone? Won't the world sort of be forced to migrate?

You can buy IPv4 addresses on a second-hand market. A few years ago they were about $8 each, with a minimum of 256. Plus you need to pay an RIR member to hold them for you, which incurs about $50/year in RIR fees for Europe. So it's not a big deal yet.
Post reply on HN