Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The relevance of IP addresses in the tracking ecosystem [pdf]

hal.inria.fr

Post reply on HN
Print view View original

11–20 of 62 posts

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#11

Post by kube-system »

annoyingnoob wrote: post #5
parhamn wrote: post #4

Earlier quoted context omitted.

The whole multiple-users-on-one-ipv4 thing always feels like it distracts from what a tracker's goal really is. It is definitely beyond sufficient identification and more than needed for a tracker to start targeting you with ads and what not. In some ways the fact that IP only tracking is lossy but still good enough is something to be afraid of. It is easy to 'taint' an IP and your households behind-the-scenes profil…

Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking , which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow you…

An IP address wouldn't be good enough to perform identification, but it would likely be good enough to perform reidentification. Most people on a network are not clearing their browser caches at the same exact time. The real power here is in using IP addresses in combination with other fingerprinting techniques.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#12

Post by annoyingnoob »

virgilp wrote: post #8
annoyingnoob wrote: post #5

Earlier quoted context omitted.

Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking , which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow you…

> using IP is not good enough Define "not good enough"(for who is it not good enough? for advertisers?). I used to work on a project linking cookies together in anonymous profiles (for advertising), initially the plan was to separate household/individual profiles using different heuristics, but I think eventually it turned out that nobody cares that much - the advertisers just wanted a rough cross-device profile, not…

The title and focus here is on user tracking, which is the goal I'm commenting about.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#13

Post by annoyingnoob »

kube-system wrote: post #11
annoyingnoob wrote: post #5

Earlier quoted context omitted.

Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking , which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow you…

An IP address wouldn't be good enough to perform identification, but it would likely be good enough to perform reidentification. Most people on a network are not clearing their browser caches at the same exact time. The real power here is in using IP addresses in combination with other fingerprinting techniques.

> The real power here is in using IP addresses in combination with other fingerprinting techniques.

I didn't think that was anything new.

It also sounds like a possible path for exploit, kind of like not requiring a password when you call voicemail from your own phone (one could spoof your number as the caller id and access your voicemail without a password).

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#14

Post by scared2 »

Zenst wrote: post #9

Most users will at the very least use two IP addresses - home broadband and mobile SIM broadband. Then you have wifi hotspots, friends wifi. The average user uses many IP's and not limited to the range of one ISP. SO whilst you can fingerprint devices and usage patterns, the IP address will by itself be useless to identify such users, it may well augment a little but is no solution. But then IPv4 shares many IP addre…

However in this paper the authors tried to show is it's stability over time. So overall their "findings" indicate ip addresses should not be overlooked in privacy protection.s they stated as follows:

"... Over time, a same device communicates with our server using a set of distinct IP addresses, but we find that devices reuse some of their previous IP addresses for long periods of time. We call this IP address retention."

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#15

Post by parhamn »

annoyingnoob wrote: post #5
parhamn wrote: post #4

Earlier quoted context omitted.

The whole multiple-users-on-one-ipv4 thing always feels like it distracts from what a tracker's goal really is. It is definitely beyond sufficient identification and more than needed for a tracker to start targeting you with ads and what not. In some ways the fact that IP only tracking is lossy but still good enough is something to be afraid of. It is easy to 'taint' an IP and your households behind-the-scenes profil…

Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. The title and focus here is on user tracking , which is the goal I'm commenting about. Its quite common to have multiple users behind the same IP, those users and their actions may or may not be related (I have no idea what my co-workers might be doing for example but we share a static IP). I honestly didn't follow you…

> I honestly didn't follow your Google search/wifi example.

Sorry, wasn't clear there. I generally don't think the 'match' thresholds need to be that high for effective (in terms of dollars earned vs spent) targeted ads.

In the google example: if a friend comes over a searches for designer watches odds are the whole IP/home is a decent enough target for designer watches.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#16

Post by jedberg »

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went.

People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multiple addresses in parallel, allowing new connections to use a new address while old connections keep using the old one.

So while ipv4 adds some protection by having multiple clients behind the firewall, ipv6 actually makes it better by looking like even more clients behind the firewall.

Combined with a browser that blocks fingerprinting you get slightly better privacy with ipv6.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#17

Post by samoa42 »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

> you get slightly better privacy with ipv6

its a larger identifying token serving less users, so no.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#18

Post by Faaak »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#19

Post by AndyMcConachie »

I worked on a document a few years back on anonymizing IP addresses. If you find yourself in a situation where you need to balance anonymization of IP addresses with research needs, this paper may be useful.

https://www.icann.org/en/system/files/files/rssac-040-07aug1...

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#20

Post by AnonC »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

I didn’t get your description of IPv6 offering better privacy protection.

With IPv6, your ISP could give you one address for each of your devices for life without any grudges or pain, assuming it doesn’t mind losing out on the static IP add on pricing that some charge in the scarce IPv4 space. That would enable better long term tracking without additional tokens (like cookies) and fingerprinting. We’ll never run out of IPv6 addresses.

Post reply on HN