I never realized an IPv6 likely contains the MAC address of the host, how did people not realized how terrible this design is.
Prior to those times tracking protection wasn't critical in protocol design (or most people's minds in general) and so using the MAC was a great way to self select an address without extra steps.
With IPv4 you reveal the IP of your IP Masq/Nat router, which is often inside your home/business. It can be dynamic or static, but generally changes pretty slowly. There might be a single person behind that IP, or 100s.
With IPv6 your /64 is often inside your home/business. It can be dynamics or static, but generally changes pretty slowly. There might be a single person behind that /64, or 100s. Different outgoing connections see different IPv6 addresses, and they change over time (slowly).
Most importantly just like a mac address, the outgoing connections never use the IPv6 address based on mac address.
So how does the privacy extension not protect the privacy of users by hiding the mac address?
I never said it didn't. I stated that people overstate the protection the facility provides, not that it didn't provide protection.
The deficiencies of the privacy extensions have been discussed widely for years. A quick internet search will show the various criticisms and responses better than any reply I can make here will.
I should, however, clarify what I was trying to say -- I was not trying to say the privacy extensions aren't worthwhile. They're great, and people should use them!
What I was trying to say is that people often think of them as a panacea or a 100% solution. They aren't exactly that (what is?), and the nature of the design of the privacy extensions are such that they make other important network management activities more difficult.
My main criticism of PE (and it's not a showstopper sort of criticism) is that the extensions are hacky and it shows. They were thought up after-the-fact to try to mitigate a security mistake made in the original IPv6 protocol.
A decade later this still seems to be at least partly in place, as I'm able to browse the webserver running on an old colleague's desktop.
I think my sysadmin group would have a collective heart attack if they saw that setup! It's quite incredible to me how independent various parts (and pseudo parts like the national labs) are from each other.
You can be certain that most every packet in, out, or through the place gets captured and inspected by Bro (errr, I guess Zeek now. https://www.zeek.org/ )
I should also mention that not every host had a public IP. I worked with the group that managed midrange compute clusters, which were always behind NAT, with bastion login nodes.
Addresses don't have to be assigned that way. There are other ways of assigning addresses including privacy addresses and DHCPv6. The address space is so big that just generating a random address, while not RFC, is "okay" on all but huge networks if you're working in a /64.