Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The relevance of IP addresses in the tracking ecosystem [pdf]

hal.inria.fr

Post reply on HN
Print view View original

21–30 of 62 posts

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#21

Post by jedberg »

Faaak wrote: post #18
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

Sure, just like with an IPv4 they allocate you a fixed /32.

But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#22

Post by jedberg »

samoa42 wrote: post #17
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

> you get slightly better privacy with ipv6 its a larger identifying token serving less users, so no.

You're thinking mathematically, not practically.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#23

Post by jedberg »

AnonC wrote: post #20
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

I didn’t get your description of IPv6 offering better privacy protection. With IPv6, your ISP could give you one address for each of your devices for life without any grudges or pain, assuming it doesn’t mind losing out on the static IP add on pricing that some charge in the scarce IPv4 space. That would enable better long term tracking without additional tokens (like cookies) and fingerprinting. We’ll never run out…

Your ISP only assigned you the first 1/2 of the address. You get to pick the second 1/2 yourself. Your client can (and in most cases will) constantly switch up the second 1/2 of the address.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#24

Post by samoa42 »

Faaak wrote: post #18
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

> Most ISPs will allocate you a fixed /64

not really. the case where someone in a household power-cycles the router and it gets a new ipv6-addy and then one has to power-cycle all networked devices too because they have no way of knowing that the old prefix is dead, is very common.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#26

Post by swinglock »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective.

But then in reality one IPv4 /32 is often many users due to NAT. Doesn't that make privacy better with v4?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#27

Post by AgentME »

swinglock wrote: post #26
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective. But then in reality one IPv4 /32 is often many users due to NAT. Doesn't that make privacy better with v4?

In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#28

Post by saurik »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

That seems backwards: with NAT you couldn't identify all of the individual computers on my Internet connection; but now, with IPv6, you either can at worst (as every device has its own IP address that it reuses) or, at best (generating a new address for every single connection), are just getting yourself back to where you were with NAT. I appreciate that for a while IPv6 was actively much worse as it allowed address correlation across multiple networks (due to the MAC address being the same in the lower 64 bits), but fixing that doesn't make it better than NAT: if you mostly care about privacy, it still seems to make the most sense to use NAT if at all possible.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#29

Post by sixothree »

annoyingnoob wrote: post #13
kube-system wrote: post #11

Earlier quoted context omitted.

An IP address wouldn't be good enough to perform identification, but it would likely be good enough to perform reidentification. Most people on a network are not clearing their browser caches at the same exact time. The real power here is in using IP addresses in combination with other fingerprinting techniques.

> The real power here is in using IP addresses in combination with other fingerprinting techniques. I didn't think that was anything new. It also sounds like a possible path for exploit, kind of like not requiring a password when you call voicemail from your own phone (one could spoof your number as the caller id and access your voicemail without a password).

This sounds like circular FUD to me.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#30

Post by api »

IP is just one more data point. There are already so many ways a browser can be fingerprinted, it doesn't make things that much worse.

While you can limit your exposure a bit, I long ago reached the conclusion that strong privacy is impossible in the current client/server web model. There is too much surface area.

Post reply on HN