The real solution here is to completely disconnect an IP address from a person or physical location. Broad adoption of IPv6 will be a big step towards that.
Email is a great example. We've patched things on top of it to try and fix the fundamental flaws but they're still there. An easy one is that you don't have to prove you own an email address to send an email that looks like it's from that sender. We added DKIM, DMARC, etc. But the flaw still fundamentally exists.
As an aside, although I haven't seen any explicit language discussing this, I'd say that an IPv6 (even a random one thanks to privacy extensions) is exactly equal to an IPv4 address. My house has a static IPv6 prefix, so if you see an IP from that subnet, it's someone in my house, exactly as if our shared IPv4 address showed up in the logs. In my opinion, the host portion of the address is basically equivalent to a random port number for identification purposes.
But, I'd rather deal with the cgnat annoyances than ever have a financial relationship with Mediacom again.
Most home internet still has unique public IPv4 in the US. There is technically nothing stopping a mobile operator from granting its endpoints fresh IPv6 addresses frequently.
There is a huge number of people that believe in things like a "Real Names Policy", and that Anonymous Access to the internet was a mistake, These people hold positions of power in organizations that make the standards.
Nearly every IPv6 capable device supports the privacy extensions, and most systems turn them on by default. I know Windows, Mac and, Linux do. Android got some shit a few years back because they removed the privacy extensions from Android, but I believe they are also now available on that ad-platform as well.
[1] https://datatracker.ietf.org/doc/html/rfc4941
[2] https://en.wikipedia.org/wiki/IPv6#Stateless_address_autocon...
The main purpose of an IP address is to deliver packets to some location in the world via the shortest path. You could imagine adding a Tor-like indirection layer to IP, but this would necessarily make the network slower because we can't increase the speed of light.
Perhaps an ISP could regularly reshuffle its IP addresses within a geographical region, but it only takes a few bad actors to send the whole region to CAPTCHA hell.
Says who? an IP is absolutely PII from its inception. It's an identifier. "IP X is requesting xxxsite.com? That's assigned to Larry in accounting. Better call HR."
>internet will forever be under the control of a few large corps running data centers.
It alway was, is, and forever will be. Someone has to host things, this only works at scale.
>The real solution here is to completely disconnect an IP address from a person or physical location
This is called a VPN. or as I like to call it, an IP tumbler. When the major super powers no longer need it for espionage the current loopholes will be closed. The net became popular, it is by nature easy to abuse, therefore people will regulate it until it is "safe", of course it will only look that way.
No, it's locally identifiable information. IP X is assigned to Larry's computer. That might be Larry making that request, but it should be considered a leap in logic to reach that conclusion without more information.
Not a solid argument, but it is the only thing I can think of though for their argument.
This is incorrect. IPv6 network routing prefixes are not an "abstract" concept. They are effectively the same PII as an IPv4 address. You can identify a user by their routing prefix, much like you can identify a user by their IPv4 address. All of their devices will have IPv6 addresses from their unique prefix much like all of their devices will have the same unique IPv4 address if they're using NAT.
With IPv4, ISPs that want to rotate IP addresses have to forcibly disconnect their users (e.g. every 24h). This is a common practice, though probably mostly intended to allow charging business customers more if they need a stable IP. But the privacy side effect is also nice.
But other than that minor point (which many ISPs are not taking advantage of), IPv4 addresses and IPv6 network prefixes are essentially the same privacy-wise: uniquely identifying an ISP customer, i.e. a family, not an individual.
Fact is, it is legally classified as PII, at least in the GDPR sphere.
> If we treat it as such then no P2P service can ever work, and the internet will forever be under the control of a few large corps running data centers.
We are already at that point. Host anything on the Internet without Cloudflare, Akamai or other CDNs and you will get targeted by skiddies running exploits on everything they find on Shodan, and if you're a noteworthy social media person (i.e. a streamer), there are enough completely braindead trolls that will stop at nothing to get you off the internet: if you are lucky you'll just get DDoS'd, if you attract the more toxic arseholes, you will end up having your door kicked in by a SWAT team.
> The real solution here is to completely disconnect an IP address from a person or physical location. Broad adoption of IPv6 will be a big step towards that.
That doesn't fix anything, it just makes hacking a specific machine a bit harder. Bad actors will just spam your entire /64 (because that's your provider's default allocation) instead. The solution is to kick bad actors off of the Internet - and all sorts of bad actors at that: people running compromised devices that are used by the actual bad actors, people running services that end up being used by bad actors such as SS7 access brokers or VoIP providers lacking auditing, bad actors themselves, and nation states like Russia, China, North Korea, Iran that actively conduct or tolerate hacking campaigns or India and Turkey that don't do shit against scam callcenters.