Hacker News Reader

Comment by blueblisters | Hacker News Reader

OT: does IPv6 make it easier/harder for websites to track you?

IPv6 has a few extensions, that have been implemented in just about every OS, to make things more private. [0][1][2]

To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016.

[0] https://datatracker.ietf.org/doc/html/rfc4941

[1] https://datatracker.ietf.org/doc/html/rfc7217

[2] https://datatracker.ietf.org/doc/html/rfc7721

>To put it simply, badly implemented IPv6 makes it easier, but all the ways to make it on-par with IPv4 have been widely deployed since 2016.

Not really. According to the wikipedia article[1], you still have an unique address per device. It rotates daily, but you still can uniquely identify a device on a daily basis. This wouldn't be possible with ivp4 with NAT.

[1] https://en.wikipedia.org/wiki/IPv6#Stateless_address_autocon...

If you read RFC7721 which I linked above, you'll find that "SLAAC temporary addresses" is the bare minimum (from 2012), but not the recommended process (over a decade later). And is therefore not what most platforms use today.

> DHCPv6 temporary addresses have the same properties as SLAAC temporary addresses (see Section 4.6). On the other hand, the properties of DHCPv6 non-temporary addresses typically depend on the specific DHCPv6 server software being employed. Recent releases of most popular DHCPv6 server software typically lease random addresses with a similar lease time as that of IPv4. Thus, these addresses can be considered to be "stable, semantically opaque". [DHCPv6-IID] specifies an algorithm that can be employed by DHCPv6 servers to generate "stable, semantically opaque" addresses. [0]

The very last line of that Wikipedia paragraph points you to RFC8064 [1], which is a standard, and completely obsoletes the early "SLAAC temporary addresses", and makes the rest of the paragraph nothing but historical information. (The mention of Windows XP should stand out as a red flag, there.)

> By default, nodes SHOULD NOT employ IPv6 address generation schemes that embed a stable link-layer address in the IID.

[0] https://datatracker.ietf.org/doc/html/rfc7721#section-4.7

[1] https://datatracker.ietf.org/doc/html/rfc8064

Is there a tl;dr description as to how the current address generation/randomization process works?

It is mostly laid out in this [0] document.

    RID = F(Prefix | Client_DUID | IAID | Counter | secret_key)

Where:

+ secret_key is at least 128 bits, be cryptographically generated, and as difficult to access as the system allows. It cannot be re-used for any other purpose.

+ F is at least SHA-1, but should probably be SHA-256 or above. It can be any cryptographically secure hash function that returns 64 or more bits. (And MD5 is explicitly banned).

+ Client_DUID is the Client Identifier sent to the DHCP.

+ IAID is the 32bit integer from the IA_NA option sent to the DHCP.

And then, once you have that randomised ID:

    if(IPV6_ADDR < IPV6_ADDR_LOW || IPV6_ADDR > IPV6_ADDR_HI){
               IPV6_ADDR = IPV6_ADDR_LOW + IPV6_ADDR % \
                           (IPV6_ADDR_HI - IPV6_ADDR_LOW + 1);
          }

Where:

+ IPV6_ADDR starts out as RID.

+ IPV6_ADDR_HI is the upper bound of leaseable addresses.

+ IPV6_ADDR_LOW is the lower bound of leaseable addresses.

If this produces an address that is invalid or already leased, increment Counter and try again.

The result is that addresses in the same prefix are completely dissimilar, and opaque. When the system rolls the address, there is no way to predict what the next address will be, or what the previous address was.

Windows, Android, macOS, and Linux tend to roll to a new IPv6 address either on system restart, or on an hourly basis, depending on settings.

Thus, on par with current IPv4 addresses for tracking.

[0] https://datatracker.ietf.org/doc/html/draft-ietf-dhc-stable-...

Assuming your ISP gives you a /64 (and not /128), easier. With ipv4, all the traffic coming out of your house is from one ip, so the ip provides household level granularity. With ipv6 each device has a distinct address, which means the ip provides device-level granularity.

That’s not true, all serious devices (except maybe IoT crapware) implement privacy extensions, so your computers and devices make requests from different, randomised address (within your allocated subnet obviously).

They don't make literally every single request from a different address off a fully shared prefix (as if you just randomize the final bits but also maintain some unique prefix bits, you still lost), so it is still worse than IPv4 with NAT, much worse than CGNAT, and AFAIK in most cases isn't much (if at all) better than assigning everyone a unique sticky address.

NAT is no longer a thing, all devices just have a globally unique IP. So your IP allow is a pretty strong indicator, it seems like that alone would make tracking easier.

There’s nothing in IPv6 to prevent tracking or offer more anonymity.

NAT can be used in conjunction with IPv6 for security purposes. It is still a thing

It was never a thing. NAT isn't security.

How do you think NAT gives you security?

Without active measures to allow it, you can't reach ports on a machine behind NAT.

If I accidentally run an SSH server where user 'root' and an empty password gives you root access, you still won't be able to get in.

Accidentally configuring port forwarding is a lot harder than accidentally disabling an on-host firewall.

You can just as easily run a firewall as a NAT, in fact most home routers support both. And, just like NAT, by default they don't allow any connections from the outside.

This is not actually true. NAT rewrites the apparent source address of outbound connections, which has no impact on inbound connections -- any inbound connection that worked before you started NATing your outbound connections will continue to work after you start doing so.

You need a firewall for security, and NAT doesn't do anything in that regard other than make it harder to understand what's going on.

As I recall, this was seen as a concern in the early days so "privacy extensions" were added to the implementation standard for IPv6. Macintosh, Windows, iOS, and Android all rotate their auto-configured IPv6 addresses at a regular interval. It used to be a day but I think I've seen it as short as an hour: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad...

That's not quite true. IPv6 has privacy extensions which generate randomized suffixes. A website would still be able to track you with the common prefix. Tracking the prefix is more or less the same as tracking an IPv4 address. If you're worried about tracking than you're better off using a VPN than a NAT gateway (both of which is also possible with IPv6).

Reply on news.ycombinator.com