Hacker News Reader

Comment by a1o | Hacker News Reader

Minor question, does using IPv6 makes it easier to track people than when using IPv4?

In general, no. All operating systems default to using random host bits in SLAAC addresses, each bootup (or change of network interface) will instantiate a new address.

More than that though, IP addresses in both v4 and v6 varieties are unreliable sources for tracking and basically no actor you'd want to guard against depends on them anyway. With mobile phones being common, your public addresses are changing all the time anyway. On IPv4, CGNAT is becoming increasingly more common so that you might share a public IPv4 address with thousands of other people at the same time.

> On IPv4, CGNAT is becoming increasingly more common so that you might share a public IPv4 address with thousands of other people at the same time.

Which is an advantage from an anti-tracking perspective — an advantage you won’t get with IPv6, no?

A counterpoint is that by cycling through IPv6 addresses no one can ever tell who is who by addresses alone. Okay, they could probably tell from the IPv6 prefix because the entire company/household shares it, but people used to ("use to" if you live in a Western country, probably) share the same public IPv4 address too so I find that point rather moot.

Another very strong counterpoint to this is that, you can't really build a truly-P2P network nor self-host a service on Internet, when everyone is behind CGNAT. At some point, as IPv4 resources get scarcer, only corporates will have the ability to host services on the Internet, and I don't think it is in their interests to host Tor nodes, for example...

You get a new IPv6 address very quickly (mostly every day or every week). That makes tracking difficult too. While the prefix is mostly stable, that is akin to the public CGNAT address.

It's not really, since an IPv6 /64 prefix has one customer behind it while a CGNAT has N customers.

I mean people are just going to log into their gmail account in their chrome browser and it doesn’t matter if you change IP’s every single minute, that identity isn’t changing as often and the relevant information Google wants will be tracked.

> Which is an advantage from an anti-tracking perspective

Depends. It makes it harder for someone outside your ISP to track you, but it makes it easier for your ISP to track you, and harder for them to justify not keeping logs of where you've connected to (since that data is necessary for their CGNAT system to work).

SLACC dynamic address are basically the same as IPv4 NAT from this perspective. Everyone who cares has tables of the prefix size assigned to customers in various providers' IP space.

> All operating systems default to using random host bits in SLAAC addresses, each bootup (or change of network interface) will instantiate a new address.

Great, so I can't connect my laptop to my desktop across reboots without setting up some internal dns?

No, IPv6 devices are typically assigned both a permanent IPv6 address and a temporary one. When using the internet, it uses the temporary address for privacy reasons.

"Typically". Would you care to list all the acronyms one needs to learn about to get to 'typically' if you need to hand configure your network?

If you want to hand configure your network, set up DHCP and disable SLACC. I wouldn't recommend it, because it just makes life harder, but you can do it.

Even better though, hostname resolution works just fine on link local addresses (fe80::/16), you needn't care about public addresses to communicate on a LAN. Or hell, you're on a LAN, keep configuring IPv4 they way you always have.

On Windows, you will see a "temporary IPv6 address" and "IPv6 address" on your network configuration screen. On Linux, you will see an IPv6 address without a temporary tag, and an IPv6 address with one, when you run the command `ip address`:

    inet6 2406:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:62c9/64 scope global temporary dynamic 
    inet6 2406:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:a31c/64 scope global dynamic mngtmpaddr noprefixroute

Temporary IPv6 address changes every now and then, but your stable IPv6 address will never change unless your ISP changes your prefix, you change your network, or your network card entirely.

When you are browsing the internet, the OS will use the temporary address for outgoing connections (unless the application forces stable addressing). But when you are hosting a service, you give your users (in this case, your laptop) the stable address.

Yes and no.

With limited IPv4, many places have dynamic IPv4 in a way or another, or have IPv4 behind some sort of NAT, so the actual IP of the accessing device may be hidden, or are private addresses. Anyway, that doesn't mean that i.e. your ISP couldn't be asked what person was using certain dynamic IP at some time.

With IPv6 it depends on implementation. Your device may have a public IPv6 address, persistent or not, and you don't need to be behind some sort of NAT (unless it is something to access ipv4 addresses), so if a lot of those conditions apply you might be tracked.

But there is a lot of conditionals in both sides, and the elephant in the room is that you are tracked for more things than just your IP address.

For some people, but most people are very easily trackable using IPv4 + user agent. There are even better JS fingerprints that don’t use your IP.

It can in the near term, as each endpoint has a unique public identifier instead of being mixed with multiple endpoints behind a NAT gateway, but less so over the long term, as privacy addresses are typically rotated at least daily.

Of course, all of this needs to be included in a broader discussion around myriad vectors of tracking and fingerprinting to arrive at a meaningful conclusion.

You can be tracked with either, but IPv6 is not functionally worse than IPv4 in that regard. You could argue that IPv6 is less anonymous than CGNAT, but CGNATs usually have to keep detailed logs, so that balances out.

All the tricks for anonymizing IPv4 (VPN, NAT, Tor, etc.) are equally feasible on IPv6.

Depends if you randomize the host-part or not. IPv6 has a feature called privacy extensions.

https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch06s05.html

yes, because even the network part has double the entropy than an v4 address and there probably is no nat involved.

practically irrelevant thou, because your browser is a much better source of fingerprinting data

Of course it is, that's why conversion to IPv6 is an item in the 14th Five Year Plan (2021-2025) of the People's Republic of China

IPv6 privacy addressing reduces tracking.

... within the same prefix.

Reply on news.ycombinator.com