Hacker News Reader

Comment by exabrial | Hacker News Reader

Watching Google ram through whatever specifications they want unimpeded is pretty unnerving. Brave Browser is disabling QUIC because they suspect Google is tracking users at the protocol level. Facebook/Google are also throwing tremendous weight behind ipv6, which allows for casual tracking of individual devices behind firewalls.

EDIT: see comment below about QUIC. tl;dr my info was out if date

View on HN

Couldn’t the IPv6 problem be fixed by shuffling of IPs often (for example, every time you switch cell towers)? We need IPv6 (since we’re out of addresses), and NAT sucks. The possibility of being tracked isn’t a good enough reason to stop a rollout, IMO.

An argument could be made for QUIC, though.

I think that's exactly what would need to happen: new ip for every request

Many devices already do this. Most modern IPv6 stacks create temporary 'privacy' addresses regularly.

I think the problem they mean is a lack of NAT for IPv6 preventing anonymization behind a network device like your home router. This article addresses it a little.

https://www.internetsociety.org/blog/2015/01/ipv6-security-m...

> Brave Browser is disabling QUIC because they suspect Google is tracking users at the protocol level.

Note at the top of Brave's "QUIC in the wild" post[1] in 2017:

"Update: This post has been edited to correct errors of fact about developer tools and APIs with respect to QUIC. Also, the original post implied that Google might be using QUIC in an anti-competitive manner. We regret the errors, and we apologize for the implication."

Do you have a link to a more recent post from Brave about this?

1: https://brave.com/quic-in-the-wild/

I hadn't seen the update. This makes me happy. I'll edit the op

But the two things you mentioned are so... innocent compared to their actual tracking infrastructure. For QUIC if you want a connection to seamlessly move when the device's address changes then you're going to either need to tell the server what your new address is (which wouldn't really work in practice) or have a non-ip identifier.

But this really doesn't matter all that much to Google since regardless of how your browser session resumes you're probably still logged and/or are loaded with tracking cookies.

And IPv6 is... well IPv6. Nothing is really stopping you from NATing at your firewall if you want -- in fact, I highly recommend it for your private networks so you can use your ISP public-allocation as a pool of public addresses while having the whole IPv6 private address space to yourself.

Reply on news.ycombinator.com