Hacker News Reader

Comment by ay | Hacker News Reader

On "still leaves thousands (if not hundred of thousands) of collisions", here's some research:

"In 2010, Eckersley demonstrated that benign characteris- tics of a browser's environment, like the screen dimensions and list of installed fonts, could be combined to create a unique device-specic ngerprint [7]. Of the half million users who participated in Eckersley's experiment, 94.2% of those using Flash or Java had a unique device ngerprint, and could thus be identied and tracked without the need for stateful client-side technologies, such as browser or Flash cookies."

Source: http://www.cosic.esat.kuleuven.be/publications/article-2334....

View on HN

Yeah but keep in mind that as soon as you install or update anything on your machine your signature changes. And I would be surprised if there was less than hundreds of thousands collisions on Android or iOS browsers.

In any way this is a flaw in the current versions of the browsers, but by no mean a structural flaw that justifies giving up randomized IPv6.

Who's talking about removing IPv6 "privacy" addresses from the standard?

I am addressing your assertion ("I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines.") with facts that demonstrate that today, even behind an IPv4 double-layered CGN, your web browser makes your machine just as trackable as if you had a single, globally-unique IP address.

(In fact, if you've a mobile device of any sort, your web browser makes you more trackable than IPv6 [as deployed] does, as your address changes as you change attach points, but your device and browser fingerprint does not.)

ay is addressing your misunderstanding of the effectiveness of browser and device fingerprinting.

Neither of us are talking about removing "privacy" addresses.

The question is not about removing privacy addresses from the protocol but whether users will be able to use them. If network administrators, or more worryingly ISP force onto users things like RFC7217 then I think this is a problem. All I am saying is that I am a bit worried of reading lots of comments advocating effectively static IPs.

I wonder if the genie is not already out of the bottle anyway. I think pretty much every recent version of windows that support IPv6 has randomized IPs turned on by default so this will require a lot of efforts to reverse this.

I am not expert enough to form an opinion on the problem described in the article but it looks to me more like a problem with the implementation of multicast than with randomized IPs, and therefore disabling randomized IPs (the solution the author opted for ultimately) is in my opinion not something I would like to see generalized.

And again browser fingerprinting is a short term problem. How many versions of each of the major browsers have we seen in 20 years, versus how many versions of the IP protocol have we seen over the same period?

> The question is not about removing privacy addresses from the protocol...

This is correct. The issue at hand is talking about just how short-sighted and mis-informed this statement is:

"I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines."

The only person who's talking about IPv6 "privacy" addresses is you. I don't understand why you keep bringing them up in a conversation about the effectiveness of browser fingerprinting.

I skimmed RFC 7217. It's not incompatible with "privacy" addresses. The RFC in question even mentions the orthogonality:

"The method specified in this document is orthogonal to the use of temporary addresses [RFC4941], since it is meant to improve the security and privacy properties of the stable addresses that are employed along with the aforementioned temporary addresses."

I don't see what your problem is.

If you're not interested in talking about the effectiveness or lack thereof of browser fingerprinting techniques, then I've no interest in continuing this conversation with you.

An aside:

whether to allow the randomized addresses or not is a choice available today with no protocol changes whatsoever.

A network admin can turn off the "A" bit on the prefix in the router advertisements and turn on "M", and the compliant hosts will use DHCPv6 to get the address, which one will allocate statically per-user. This is exactly the same as "no privacy addresses".

Reply on news.ycombinator.com