Hacker News Reader

Comment by simoncion | Hacker News Reader

Who's talking about removing IPv6 "privacy" addresses from the standard?

I am addressing your assertion ("I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines.") with facts that demonstrate that today, even behind an IPv4 double-layered CGN, your web browser makes your machine just as trackable as if you had a single, globally-unique IP address.

(In fact, if you've a mobile device of any sort, your web browser makes you more trackable than IPv6 [as deployed] does, as your address changes as you change attach points, but your device and browser fingerprint does not.)

ay is addressing your misunderstanding of the effectiveness of browser and device fingerprinting.

Neither of us are talking about removing "privacy" addresses.

View on HN

The question is not about removing privacy addresses from the protocol but whether users will be able to use them. If network administrators, or more worryingly ISP force onto users things like RFC7217 then I think this is a problem. All I am saying is that I am a bit worried of reading lots of comments advocating effectively static IPs.

I wonder if the genie is not already out of the bottle anyway. I think pretty much every recent version of windows that support IPv6 has randomized IPs turned on by default so this will require a lot of efforts to reverse this.

I am not expert enough to form an opinion on the problem described in the article but it looks to me more like a problem with the implementation of multicast than with randomized IPs, and therefore disabling randomized IPs (the solution the author opted for ultimately) is in my opinion not something I would like to see generalized.

And again browser fingerprinting is a short term problem. How many versions of each of the major browsers have we seen in 20 years, versus how many versions of the IP protocol have we seen over the same period?

> The question is not about removing privacy addresses from the protocol...

This is correct. The issue at hand is talking about just how short-sighted and mis-informed this statement is:

"I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines."

The only person who's talking about IPv6 "privacy" addresses is you. I don't understand why you keep bringing them up in a conversation about the effectiveness of browser fingerprinting.

I skimmed RFC 7217. It's not incompatible with "privacy" addresses. The RFC in question even mentions the orthogonality:

"The method specified in this document is orthogonal to the use of temporary addresses [RFC4941], since it is meant to improve the security and privacy properties of the stable addresses that are employed along with the aforementioned temporary addresses."

I don't see what your problem is.

If you're not interested in talking about the effectiveness or lack thereof of browser fingerprinting techniques, then I've no interest in continuing this conversation with you.

Reply on news.ycombinator.com