Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The relevance of IP addresses in the tracking ecosystem [pdf]

hal.inria.fr

Post reply on HN
Print view View original

31–40 of 62 posts

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#31

Post by saurik »

jedberg wrote: post #21
Faaak wrote: post #18

Earlier quoted context omitted.

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they would all get melded together as one, but unless you very carefully generate a new IP address for every single connection you make (which is how you can get back to where you were with NAT), you now have the ability to somewhat differentiate users who before would have been mixed. So it is at best the same but probably worse, at which point why not use the thing that is always at least as good if not much better?...

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#32

Post by kube-system »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

Unless you have many thousands of devices on your network, I can't see it actually having any practical advantage. I have maybe a dozen devices on my network, that is going to require only a tiny amount of entropy to uniquely identify the devices, in conjunction with the first half of the address. You wouldn't even need an entire UA string in many cases. Resist fingerprinting != prevent fingerprinting.

The resist fingerprinting measures in browsers are intended to help you blend in with millions of other devices. You'll still likely stand out like a sore thumb if the sample size is your household.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#33

Post by saurik »

AgentME wrote: post #27
swinglock wrote: post #26

Earlier quoted context omitted.

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective. But then in reality one IPv4 /32 is often many users due to NAT. Doesn't that make privacy better with v4?

In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.

Except now you are potentially leaking information about the individual computers in the lower 64 bits; if you generate those randomly for every single connection then you can mitigate that, but is that how this is actually being implemented or are they just doing periodic cycling? With NAT you were just guaranteed that this would always be safe.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#34

Post by annoyingnoob »

sixothree wrote: post #29
annoyingnoob wrote: post #13

Earlier quoted context omitted.

> The real power here is in using IP addresses in combination with other fingerprinting techniques. I didn't think that was anything new. It also sounds like a possible path for exploit, kind of like not requiring a password when you call voicemail from your own phone (one could spoof your number as the caller id and access your voicemail without a password).

This sounds like circular FUD to me.

How so?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#35

Post by orbital-decay »

jedberg wrote: post #21
Faaak wrote: post #18

Earlier quoted context omitted.

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

>just like with an IPv4 they allocate you a fixed /32

Many (most?) ISPs that give you unique IPv4 addresses also use dynamic pools. Just reconnect your router and blend into the pool. Or, if you're behind NAT, you're already indistinguishable from others.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#36

Post by eh78ssxv2f »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

> so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multiple addresses in parallel, allowing new connections to use a new address while old connections keep using the old one.

This is really interesting and I was not aware of this. Are there any links where I can read about this more? I tried searching around, but did not find anything.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#37

Post by Avamander »

saurik wrote: post #31
jedberg wrote: post #21

Earlier quoted context omitted.

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they would all get melded together as one, but unless you very carefully generate a new IP address for every single connection you make (which is how you can get back to where you were with NAT), you now have the ability to somewhat differentiate users who before w…

Sounds like we need shorter IPv6 leases and more rotation between the prefixes, but that somehow goes a bit against what IPv6 should provide us - freedom to hold on to an address.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#38

Post by ignoramous »

saurik wrote: post #28
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

That seems backwards: with NAT you couldn't identify all of the individual computers on my Internet connection; but now, with IPv6, you either can at worst (as every device has its own IP address that it reuses) or, at best (generating a new address for every single connection), are just getting yourself back to where you were with NAT. I appreciate that for a while IPv6 was actively much worse as it allowed address…

> with NAT you couldn't identify all of the individual computers on my Internet connection...

Not if you're using WebRTC which would promptly leak the private IP address: https://news.ycombinator.com/item?id=12528184

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#39

Post by zrm »

Avamander wrote: post #37
saurik wrote: post #31

Earlier quoted context omitted.

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they would all get melded together as one, but unless you very carefully generate a new IP address for every single connection you make (which is how you can get back to where you were with NAT), you now have the ability to somewhat differentiate users who before w…

Sounds like we need shorter IPv6 leases and more rotation between the prefixes, but that somehow goes a bit against what IPv6 should provide us - freedom to hold on to an address.

Some systems already have a solution for this, since devices can have multiple IPv6 addresses at once. They have one permanent IPv6 address which is not used for outgoing connections but can be used for incoming connections, and then temporary IPv6 addresses used for outgoing connections which can be rotated arbitrarily often. The first address is permanent but can only be used if you already know it.

An improvement on this would for services to request the machine to hold a specific address, permitted if the address is valid on the current network and not already in use. Then services could each have their own address (generated on first use and then requested when they start) which is effectively permanent but not the same as the addresses used by other services on the same machine.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#40

Post by Zenst »

scared2 wrote: post #14
Zenst wrote: post #9

Most users will at the very least use two IP addresses - home broadband and mobile SIM broadband. Then you have wifi hotspots, friends wifi. The average user uses many IP's and not limited to the range of one ISP. SO whilst you can fingerprint devices and usage patterns, the IP address will by itself be useless to identify such users, it may well augment a little but is no solution. But then IPv4 shares many IP addre…

However in this paper the authors tried to show is it's stability over time. So overall their "findings" indicate ip addresses should not be overlooked in privacy protection.s they stated as follows: "... Over time, a same device communicates with our server using a set of distinct IP addresses, but we find that devices reuse some of their previous IP addresses for long periods of time. We call this IP address retent…

As somebody who tracks and logs their IP's given via ISP etc, I can attest, not that distinct over time.
Post reply on HN