Hacker News Reader

Comment by simoncion | Hacker News Reader

> I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines.

Heh. Better not tell them about https://panopticlick.eff.org/ .

Seriously, tracking via your v6 address is a minor concern. Browsers already provide more than enough information to an advertiser to do a really good job of tracking a person as he changes his attach point to the Internet.

Let me ask you a question. (Please address this question, and not some hypothetical situation that isn't covered by this question.) If the combination of my User Agent string, screen resolution, and installed browser plugins uniquely identifies my PC, why should I be concerned that I also have a stable, globally unique IP address?

View on HN

I agree. This is not great. Though I believe that if this start being used, browser vendors will crack down on this (it is shocking that they give away so much information). But I read that this technique still leaves thousands (if not hundred of thousands) of collisions (particularly on more standardised mobile platforms) so I don't expect that to ever be widely used.

But the fact that there is a leak somewhere else in the house isn't an excuse to create another leak.

Also, browsers evolve and react relatively quickly. Not the IP protocol. When you see how hard it is to switch from IPv4 to IPv6, I don't think I will live to see IPv8! So making a disastrous decision from a privacy point of view in IPv6 will have long and lasting consequences. It's not because Chrome v30something is broken that we should leave a flaw in the IP design.

On "still leaves thousands (if not hundred of thousands) of collisions", here's some research:

"In 2010, Eckersley demonstrated that benign characteris- tics of a browser's environment, like the screen dimensions and list of installed fonts, could be combined to create a unique device-specic ngerprint [7]. Of the half million users who participated in Eckersley's experiment, 94.2% of those using Flash or Java had a unique device ngerprint, and could thus be identied and tracked without the need for stateful client-side technologies, such as browser or Flash cookies."

Source: http://www.cosic.esat.kuleuven.be/publications/article-2334....

Yeah but keep in mind that as soon as you install or update anything on your machine your signature changes. And I would be surprised if there was less than hundreds of thousands collisions on Android or iOS browsers.

In any way this is a flaw in the current versions of the browsers, but by no mean a structural flaw that justifies giving up randomized IPv6.

Who's talking about removing IPv6 "privacy" addresses from the standard?

I am addressing your assertion ("I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines.") with facts that demonstrate that today, even behind an IPv4 double-layered CGN, your web browser makes your machine just as trackable as if you had a single, globally-unique IP address.

(In fact, if you've a mobile device of any sort, your web browser makes you more trackable than IPv6 [as deployed] does, as your address changes as you change attach points, but your device and browser fingerprint does not.)

ay is addressing your misunderstanding of the effectiveness of browser and device fingerprinting.

Neither of us are talking about removing "privacy" addresses.

The question is not about removing privacy addresses from the protocol but whether users will be able to use them. If network administrators, or more worryingly ISP force onto users things like RFC7217 then I think this is a problem. All I am saying is that I am a bit worried of reading lots of comments advocating effectively static IPs.

I wonder if the genie is not already out of the bottle anyway. I think pretty much every recent version of windows that support IPv6 has randomized IPs turned on by default so this will require a lot of efforts to reverse this.

I am not expert enough to form an opinion on the problem described in the article but it looks to me more like a problem with the implementation of multicast than with randomized IPs, and therefore disabling randomized IPs (the solution the author opted for ultimately) is in my opinion not something I would like to see generalized.

And again browser fingerprinting is a short term problem. How many versions of each of the major browsers have we seen in 20 years, versus how many versions of the IP protocol have we seen over the same period?

> The question is not about removing privacy addresses from the protocol...

This is correct. The issue at hand is talking about just how short-sighted and mis-informed this statement is:

"I personally see IPv6 adoption going to a full stall if users are told that advertisers found a way to tattoo cookies on their machines."

The only person who's talking about IPv6 "privacy" addresses is you. I don't understand why you keep bringing them up in a conversation about the effectiveness of browser fingerprinting.

I skimmed RFC 7217. It's not incompatible with "privacy" addresses. The RFC in question even mentions the orthogonality:

"The method specified in this document is orthogonal to the use of temporary addresses [RFC4941], since it is meant to improve the security and privacy properties of the stable addresses that are employed along with the aforementioned temporary addresses."

I don't see what your problem is.

If you're not interested in talking about the effectiveness or lack thereof of browser fingerprinting techniques, then I've no interest in continuing this conversation with you.

An aside:

whether to allow the randomized addresses or not is a choice available today with no protocol changes whatsoever.

A network admin can turn off the "A" bit on the prefix in the router advertisements and turn on "M", and the compliant hosts will use DHCPv6 to get the address, which one will allocate statically per-user. This is exactly the same as "no privacy addresses".

ay's comment is great. You dodging my question? Not great.

I have to ask, have you even visited panopticlick? Go visit, using the browser that you typically use to browse the web. Slow your roll, and take time to actually understand what the site is telling you.

Also: "I believe that if this start being used, browser vendors will crack down on this".

You... are clearly not aware of what's happening in the Internet advertising space.

Visit https://panopticlick.eff.org/ (I mean it. Do this. Don't just blow hot air.) and ask yourself which of those things that the browser has been happily giving away for ages could easily be removed without breaking much of the useful functionality of the web.

Well, I thought my comments did answer your question.

- the fact that this signature works today (and I am not convinced it is actually so unique and stable to be really useful, again you don't have flash or java on iOS nor can you really customize the browser, so you will have lots of collisions) doesn't mean it will forever, for instance flash, java and silverlight are on their way out of the browser. And the more plugins and fonts you have, the more unique your signature is, the more likely it will change as a result of updating something (typically at least once a month) and therefore the less likely it will be useful to tracking you (your identity changes regularly).

- the fact that there is a flaw already doesn't mean we should introduce another one.

- IP protocol is evolving much more slowly than browsers and therefore a flaw in the IP protocol is a lot more problematic than a flaw in a current version of the browser.

If you're not convinced that browser fingerprinting is a useful tool in an advertiser's tracking toolkit, then you need to read what the EFF, lcamtuf, and other security researchers have to say. Or, you could just go work for a grey or black-hat internet advertiser.

Also, do check out my reply in the other thread with you: https://news.ycombinator.com/item?id=8282694

Reply on news.ycombinator.com