Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The relevance of IP addresses in the tracking ecosystem [pdf]

hal.inria.fr

Post reply on HN
Print view View original

41–50 of 62 posts

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#41

Post by zrm »

ignoramous wrote: post #38
saurik wrote: post #28

Earlier quoted context omitted.

That seems backwards: with NAT you couldn't identify all of the individual computers on my Internet connection; but now, with IPv6, you either can at worst (as every device has its own IP address that it reuses) or, at best (generating a new address for every single connection), are just getting yourself back to where you were with NAT. I appreciate that for a while IPv6 was actively much worse as it allowed address…

> with NAT you couldn't identify all of the individual computers on my Internet connection... Not if you're using WebRTC which would promptly leak the private IP address: https://news.ycombinator.com/item?id=12528184

There are also several other methods that often work, e.g. the X-Forwarded-For HTTP header if there is a local proxy, or a long list of non-HTTP protocols or tunnel-XYZ-inside-HTTP protocols that have the client IP as part of the protocol.

Temporary IPv6 addresses actually solve this, especially for P2P systems that do benefit from knowing the client IP in case there is a peer on the same LAN, because the address they get is the same one the remote server sees (no additional information) and then it's both a valid local address but hard to correlate with anything when every device can have hundreds of them at once.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#42

Post by Reelin »

saurik wrote: post #33
AgentME wrote: post #27

Earlier quoted context omitted.

In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.

Except now you are potentially leaking information about the individual computers in the lower 64 bits; if you generate those randomly for every single connection then you can mitigate that, but is that how this is actually being implemented or are they just doing periodic cycling? With NAT you were just guaranteed that this would always be safe.

> With NAT you were just guaranteed that this would always be safe.

Another safety benefit of NAT is that if you use a private IP address block (ex 192.168/16) you can be reasonably certain that your devices aren't publicly routable without bothering to actually check the router firewall configuration. This is particularly nice for home networks - I don't usually want my home devices to be reachable from the internet at large.

To understand what I'm getting at here, imagine trying to walk an elderly relative through verifying their firewall configuration over the phone. A simple command to check the IP address was enough with NAT.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#43

Post by Reelin »

jedberg wrote: post #23
AnonC wrote: post #20

Earlier quoted context omitted.

I didn’t get your description of IPv6 offering better privacy protection. With IPv6, your ISP could give you one address for each of your devices for life without any grudges or pain, assuming it doesn’t mind losing out on the static IP add on pricing that some charge in the scarce IPv4 space. That would enable better long term tracking without additional tokens (like cookies) and fingerprinting. We’ll never run out…

Your ISP only assigned you the first 1/2 of the address. You get to pick the second 1/2 yourself. Your client can (and in most cases will) constantly switch up the second 1/2 of the address.

Is that required, or only by convention? Ie could an ISP hypothetically choose to allocate a full IPv6 address to you?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#44

Post by djrogers »

jedberg wrote: post #23
AnonC wrote: post #20

Earlier quoted context omitted.

I didn’t get your description of IPv6 offering better privacy protection. With IPv6, your ISP could give you one address for each of your devices for life without any grudges or pain, assuming it doesn’t mind losing out on the static IP add on pricing that some charge in the scarce IPv4 space. That would enable better long term tracking without additional tokens (like cookies) and fingerprinting. We’ll never run out…

Your ISP only assigned you the first 1/2 of the address. You get to pick the second 1/2 yourself. Your client can (and in most cases will) constantly switch up the second 1/2 of the address.

Which means that trackers will still track you, but only based on the first 1/2 of your IPv6 address. Since that doesn't change (often) it's essentially as fixed as your old /32 IPv4 address was.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#45

Post by aledalgrande »

orbital-decay wrote: post #35
jedberg wrote: post #21

Earlier quoted context omitted.

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

>just like with an IPv4 they allocate you a fixed /32 Many (most?) ISPs that give you unique IPv4 addresses also use dynamic pools. Just reconnect your router and blend into the pool. Or, if you're behind NAT, you're already indistinguishable from others.

My router is connected for months on end, and I think this is the norm, not an exception. Even if I reconnect, most of the time my provider assigns me the same IP. The only solution here is a good VPN.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#46

Post by arthurcolle »

jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

One can very easily change MAC address though, it's not like that is an insurmountable issue, right?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#47

Post by vladvasiliu »

eh78ssxv2f wrote: post #36
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

> so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multiple addresses in parallel, allowing new connections to use a new address while old connections keep using the old one. This is really interesting and I was not aware of this. Are there any links where I can read about this more? I tried searching around, but did not find…

Here's Wikipedia [1] and the RFC [2].

As noted, Mac OS, Windows and Linux already implement this.

[1]https://en.wikipedia.org/wiki/IPv6_address#Temporary_address...

[2]https://tools.ietf.org/html/rfc4941

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#48

Post by [deleted] »

orbital-decay wrote: post #35
jedberg wrote: post #21

Earlier quoted context omitted.

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

>just like with an IPv4 they allocate you a fixed /32 Many (most?) ISPs that give you unique IPv4 addresses also use dynamic pools. Just reconnect your router and blend into the pool. Or, if you're behind NAT, you're already indistinguishable from others.

[deleted]

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#49

Post by mirimir »

saurik wrote: post #31
jedberg wrote: post #21

Earlier quoted context omitted.

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

You are worse off as now you have some introspection into computers on the other side of that firewall; with NAT you could have thousands of computers and they would all get melded together as one, but unless you very carefully generate a new IP address for every single connection you make (which is how you can get back to where you were with NAT), you now have the ability to somewhat differentiate users who before w…

It's a wash, I think. Anyone who cares uses VPNs and/or Tor. You can do either IPv4 or IPv6 with VPNs, but the methodology is different. With IPv4, it's just NAT. With IPv6, VPN servers must assign a public address. And with Tor, sites only see the exit address.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#50

Post by _8j50 »

Faaak wrote: post #18
jedberg wrote: post #16

IPv6 improves this situation (now). At first, ipv6 was actually a lot worse, since the back 1/2 of your address was your MAC address, allowing your device to be tracked around the internet no matter where it went. People quickly realized this flaw, and updated the standard so that basically your client gets to pick the second 1/2 of your address now. And the nice thing is, most major platforms will actually run multi…

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

To add on this,many will allocate a much smaller prefix. If you are being tracked by IP, the whois of your v6 address will contain what prefix is delegated,but even if they don't use whois they can simply track "subnets" (prefixes) as a data point, if a cookie or browser fingerprint is seen on multiple addresses, the address part will help pin point a specific user.

With v4 you have NAT and CGNAT now that obscures your public address a bit, you lose that with v6. For privacy, you need your address to be shared by many other users. This is one reason VPNs are useful, your public IP is shared by many. It's the same problem with browser fingerprinting, the more you try to prevent it, the more trackable data points you create (e.g.: one more extension or one less default setting that makes you a few steps more unique than everyone else).

Post reply on HN