Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The relevance of IP addresses in the tracking ecosystem [pdf]

hal.inria.fr

Post reply on HN
Print view View original

51–60 of 62 posts

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#51

Post by yetihehe »

aledalgrande wrote: post #45
orbital-decay wrote: post #35

Earlier quoted context omitted.

>just like with an IPv4 they allocate you a fixed /32 Many (most?) ISPs that give you unique IPv4 addresses also use dynamic pools. Just reconnect your router and blend into the pool. Or, if you're behind NAT, you're already indistinguishable from others.

My router is connected for months on end, and I think this is the norm, not an exception. Even if I reconnect, most of the time my provider assigns me the same IP. The only solution here is a good VPN.

When I first installed my connection, provider forcefully disconnected my router every 23 (yes, 23) hours to prevent me from having static ip (and hosting servers on fast home connection). Now it seems my public ipv4 actually changes every several minutes, probably some kind of ipv6to4 gate. But ipv6 of one computer is unchanged since several years.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#52

Post by virgilp »

annoyingnoob wrote: post #12
virgilp wrote: post #8

Earlier quoted context omitted.

> using IP is not good enough Define "not good enough"(for who is it not good enough? for advertisers?). I used to work on a project linking cookies together in anonymous profiles (for advertising), initially the plan was to separate household/individual profiles using different heuristics, but I think eventually it turned out that nobody cares that much - the advertisers just wanted a rough cross-device profile, not…

The title and focus here is on user tracking , which is the goal I'm commenting about.

I have no idea what you mean by user tracking, can you explain?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#53

Post by swinglock »

AgentME wrote: post #27
swinglock wrote: post #26

Earlier quoted context omitted.

With IPv6 one user is a /64 whereas with IPv4 one user is a /32. That's about equal from a privacy perspective. But then in reality one IPv4 /32 is often many users due to NAT. Doesn't that make privacy better with v4?

In my experience, in the same cases that IPv4 would have multiple users behind one /32, IPv6 would have multiple users behind one /64.

In mobile networks I've only ever seen one UE get one /64, meaning most IPv6 users in the world does not share their /64 with anyone else, if I'm not very mistaken. I think this is standardized in 3GPP but I won't dig for it.

Other sites should get a /56, including home users. That's in RFC 6177. This is a best practice RFC of "shoulds" rather than "musts" so technically it's still IPv6 if your ISP only give you a /64 for your site... but it's wrong.

Your LAN devices (if you only have one LAN in your site, typical for a home) could still all be in the same /64. But the difference between one home and one person is small in the context of tracking for purposes of advertisement and besides, the trackers get extra bits per device which were hidden when the same devices were behind one IPv4 NAT. Poorly hidden, as all devices probably had different user-agents or resolutions and a hundred other things to fingerprint anyway but still, slightly less accessible.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#54

Post by jlgaddis »

Reelin wrote: post #43
jedberg wrote: post #23

Earlier quoted context omitted.

Your ISP only assigned you the first 1/2 of the address. You get to pick the second 1/2 yourself. Your client can (and in most cases will) constantly switch up the second 1/2 of the address.

Is that required, or only by convention? Ie could an ISP hypothetically choose to allocate a full IPv6 address to you?

Sure, they could assign you a /128 for your connection to them. In fact, I imagine there are some ISPs out there that do just that.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#55

Post by annoyingnoob »

virgilp wrote: post #52
annoyingnoob wrote: post #12

Earlier quoted context omitted.

The title and focus here is on user tracking , which is the goal I'm commenting about.

I have no idea what you mean by user tracking , can you explain?

A user is usually defined as a human being. I'm a human being and I did not come with a network connection. The world, generally, does not assign IP addresses to human beings - thus an IP address cannot track me as a human, a human computer user.

The paper/study here used a combination of IP address and a UUID to track 'users' which are presumably but not necessarily individual humans. It was the use of this UUID that allowed the authors to draw conclusions about how often a given user is seen at the same IP address. The IP address by itself did not provide enough tracking to draw the conclusions in the paper.

Is IP address identification 'good enough' for advertising, maybe. But IP is no where near definitive for identifying individual humans.

The paper does not say how often they found multiple 'users' using the same IP address. The paper focuses on individual reuse of IPs. How often did they find different users using the same IP in their study?

In internet advertising no one expects every ad to trigger a sale. Since there is some amount of acceptable waste in the system this paper has decided that IP is 'good enough' for targeting - because its okay if we are throwing away 20% or more of the ads (we didn't expect any traction from them anyway seems to be the thinking).

And the authors admit that a larger or different dataset might show different results.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#56

Post by virgilp »

annoyingnoob wrote: post #55
virgilp wrote: post #52

Earlier quoted context omitted.

I have no idea what you mean by user tracking , can you explain?

A user is usually defined as a human being. I'm a human being and I did not come with a network connection. The world, generally, does not assign IP addresses to human beings - thus an IP address cannot track me as a human, a human computer user. The paper/study here used a combination of IP address and a UUID to track 'users' which are presumably but not necessarily individual humans. It was the use of this UUID tha…

I was replying to your claim:

> Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough.

Advertisers do not care about what you as a human do in the same way that e.g. some government agencies might. Both the paper and you talked about "user tracking" in the context of advertising. My claim is that "IP address identification is actually 'good enough' for advertising" (for some kinds of advertising, at least, but the discussion here is complex and I really don't want to get into it - on short, the problem is not so much with the 'tracking'/building the profile, but with being confident enough that you're not targeting the wrong person/household member during the delivery of the more sensitive ads; and with not spooking/startling the user with "how the hell do they know this about me" - sometimes the user needs to be e.g. logged in so that he understands why he received an ad).

In particular, there are large swaths of companies that don't care whether it's you, your wife or your child - Disney e.g. will happily serve you ads based on activity performed by your children or wife, and will make no effort to figure out if it was you or them because it doesn't matter.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#57

Post by annoyingnoob »

virgilp wrote: post #56
annoyingnoob wrote: post #55

Earlier quoted context omitted.

A user is usually defined as a human being. I'm a human being and I did not come with a network connection. The world, generally, does not assign IP addresses to human beings - thus an IP address cannot track me as a human, a human computer user. The paper/study here used a combination of IP address and a UUID to track 'users' which are presumably but not necessarily individual humans. It was the use of this UUID tha…

I was replying to your claim: > Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. Advertisers do not care about what you as a human do in the same way that e.g. some government agencies might. Both the paper and you talked about "user tracking" in the context of advertising. My claim is that "IP address identification is actually 'good enough' for advertising" (for so…

Its only good enough when you expect some non-trivial number of the ads to be wasted. If you care about that waste then IP is not good enough.

For some brands, like Disney in you example, spraying ads everywhere is good enough. For other brands that is not good enough, feminine hygiene products would be an example (both age and gender specific where IP alone would be a poor indicator).

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#58

Post by virgilp »

annoyingnoob wrote: post #57
virgilp wrote: post #56

Earlier quoted context omitted.

I was replying to your claim: > Advertising that is relevant to my wife probably isn't relevant to me, using IP is not good enough. Advertisers do not care about what you as a human do in the same way that e.g. some government agencies might. Both the paper and you talked about "user tracking" in the context of advertising. My claim is that "IP address identification is actually 'good enough' for advertising" (for so…

Its only good enough when you expect some non-trivial number of the ads to be wasted. If you care about that waste then IP is not good enough. For some brands, like Disney in you example, spraying ads everywhere is good enough. For other brands that is not good enough, feminine hygiene products would be an example (both age and gender specific where IP alone would be a poor indicator).

How do you even define "non-wasted ads"? One ad = one buy? One ad = one interested person?

Targeted ads, even imperfectly-targeted ones, are "less wasted" than other kinds of ads. They are not perfect, by far (thankfully, if I may add so!), but "not good enough?" Come on, what exactly is good enough, then?

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#59

Post by annoyingnoob »

virgilp wrote: post #58
annoyingnoob wrote: post #57

Earlier quoted context omitted.

Its only good enough when you expect some non-trivial number of the ads to be wasted. If you care about that waste then IP is not good enough. For some brands, like Disney in you example, spraying ads everywhere is good enough. For other brands that is not good enough, feminine hygiene products would be an example (both age and gender specific where IP alone would be a poor indicator).

How do you even define "non-wasted ads"? One ad = one buy? One ad = one interested person? Targeted ads, even imperfectly-targeted ones, are "less wasted" than other kinds of ads. They are not perfect, by far (thankfully, if I may add so!), but "not good enough?" Come on, what exactly is good enough, then?

>Targeted ads, even imperfectly-targeted ones, are "less wasted" than other kinds of ads.

How do you know that your 'targeting' is working? If you target females how do you measure how many females saw the ad? Targeted ads should go to the targeted audience or they likely went to waste - at least the advertiser didn't get what they paid for. The quality of your targeted audiences matters to your advertising customers.

Re: The relevance of IP addresses in the tracking ecosystem [pdf]

#60

Post by allarm »

jedberg wrote: post #21
Faaak wrote: post #18

Earlier quoted context omitted.

Absolutely not. Most ISPs will allocate you a fixed /64. You may well have privacy IPs in this /64, the prefix will always be the same.. A though day for privacy activists

Sure, just like with an IPv4 they allocate you a fixed /32. But you get slightly more privacy by having the client able to randomize the other 1/2 of the address and use multiple addresses, which would confuse trackers. Or the trackers just look at the first /64 and ignore the rest and you're no worse off than you were with your ipV4 /32.

What do you mean by fixed /32? A PPP link?
Post reply on HN