Hacker News Reader

Hacker News

Comment by etaioinshrdlu | Hacker News Reader

Parent Full thread

etaioinshrdlu

Related question:

What is the impact of IPv6 on regular users privacy?

View on HN

Less NAT means less household/workplace/etc-level traffic mixing means less plausible deniability for users.

Address randomisation should give you the same level of deniability.

The only part of your address that doesn't change is the same part that is unchanged in the IPv4 case.

Unless you have CGNAT of course, but I don't think anyone would argue that that thing is a good thing to have.

A random address may make it harder to track individual devices over time, but if two sites see the same IPv6 it will be harder to argue that it's two different devices.

In theory you can track individual devices in a household instead of grouping everyone in one house, small business, building, etc. as one IP.

Currently, even with the limitations of IPv4, most trackers can use cookies and browser fingerprints (your browser's headers, fonts, etc.) to individually identify you even behind NAT. But with IPv6, ad engines could potentially identify that you're running two different browsers on the same laptop or device, and associate both of those browsers to _you_ (some type of single targeting profile).

They also have a more precise way to track you without a browser fingerprint.

Note that 95% of people browsing with IPv6 are probably using SLAAC with privacy extensions, so all your devices IPs should be frequently changing (at least every day, but you can lower the timeout). Only the subnet would stay the same, similar to a NAT’ed IP.

As it's evident from NAT they can track even behind a single IPv4. As long they know your prefix the privacy extensions don't really help. Of course one could have a dynamic prefix similar to dynamic IPs residential ISPs use. It's funny, in the past a static IP was considered a valuable feature for a residential internet connection. Nowadays, I'm wondering if dynamic IPs are more viable from a privacy perspective.

This is likely why the GDPR considers IP addresses as personal data.

Oddly enough it's always (in my experience) the tech types that have argued against IP addresses being personal, forgetting that we might one day switch to IPv6

The same as ipv4.

Use of NAT to cope with IPv4 issues has an unintended privacy benefit. IPv6 obviates NAT and the privacy benefits.

But IPv6 also adds IPv6 privacy extensions (used by default by many systems).

Reply on news.ycombinator.com