Still disabled on all my networks and will be forever. Incoming HN downvotes because I'm not using the coolest latest technology.

ipv4 accidentally provides "casual anonymity" and "one ip does not identify device", which is incredibly important in this age of overbearing surveillance by government and private companies. ipv6, even with the "privacy extensions", is one subpoena away form directly identifying your individual device. ("ISP X: who did you assign this block of ips to on Y date?")

ipv4 has a boatload of issues (the worst of it is probably the unused and 'dangerous' flags), and ipv6 offers a boatload of cool features (The most beautiful is probably the flow state tracking).

However ipv6 was designed in a naive vacuum where no one possibly imagined the internet being abused to destroy an individual's inherit right to anonymity.

Oddly enough, the people most hellbent on spying on you: Facebook, Google, etc are the ones screaming for ipv6 the loudest.

▲

kstrauser 6 hours ago | parent | next [-]

It’s ok to understand something and disagree with it. It’s another to proudly wear ignorance on one’s sleeve. That’s never a good look.

There’s no way in which IPv6 is less private than IPv4. An ISP issues your house an IPv4 address and an IPv6 /48 network. Both of those can be subpoenaed equally. The privacy extensions work as advertised.

And in reality land, the big companies are the ones pushing for the upgrade because they’re the ones hardest hit by IPv4’s inherent limitations and increasing costs. Same rando in Tampa isn’t leading the charge because it doesn’t affect them much either way.

▲

anon_trader 5 hours ago | parent | next [-]

> There’s no way in which IPv6 is less private than IPv4

With IPv4 behind CGNAT you share an address with hundreds of other users. This won't protect you against a targeted subpoena, but tracking companies typically don't have this kind of power, so they have to resort to other fingerprinting options.

On the other hand, an IPv6 address is effectively a unique, and somewhat persistent, tracking ID, 48/56/64-bit long (ISP dependent), concatenated with some random garbage. And of course every advertiser, every tracking company and their dog know which part is random garbage; you are not going to fool anyone by rotating it with privacy extensions.

▲

kstrauser 4 hours ago | parent [-]

CGNAT is nowhere near the common case yet. And frankly, I’m horrified that anyone’s describing it as a good thing. CGNAT is the devil, even if it accidentally has one not-terrible feature, and especially when ISPs realize that they can sell those NAT logs to companies who still want to track end users.

For tracking purposes, an IPv6 address is 48 bits long. That’s what identifies a customer premise router, exactly like a IPv4 /32 identifies one. The remaining 80 random bits might as well be treated like longer source port numbers: they identify one particular connection but aren’t persistent and can’t map back to a particular device behind that router afterward.

▲

orangeboats an hour ago | parent [-]

>CGNAT is nowhere near the common case yet. And frankly, I’m horrified that anyone’s describing it as a good thing.

For some reason, "CGNAT == privacy" is a very common sentiment on Hacker News. Yeah, Hacker News. It's bewildering, and after my last comment [0] talking about it, I have kinda already given up trying to convince people that CGNAT is devilish and not at all a privacy protector.

[0]: https://news.ycombinator.com/item?id=40180058

	▲	kstrauser 31 minutes ago \| parent [-]
		It’s right up there with “NAT == security”, which is also disappointing for here. It’s not so much the sentiment, as how confidently it’s asserted.

▲

iso1631 6 hours ago | parent | prev [-]

Google aren't subpoenaed

Perhaps this is the difference, some people are concerned with being anonymous from companies like google, amazon, etc. Some don't mind that, as long as they are anonymous from a government.

Your mention of subpoena suggests you don't care about google tracking you.

▲

woooooo 5 hours ago | parent | next [-]

Google gets subpoenad all the fucking time. They have whole departments set up to handle the case load.

Some public evidence: https://www.alphabetworkersunion.org/press/google-lays-off-c...

	▲	iso1631 5 hours ago \| parent [-]
		Sorry I meant to say google aren't subpoenaing The people I want to protect my privacy from are google, facebook, amazon, they can't subpoena my IP, they can track me just fine though.

▲

kstrauser 5 hours ago | parent | prev [-]

I was directly replying to someone saying they could subpoena the temporal owner of an IPv6 address, as though that were somehow different than IPv4.

The tracking is a moot point. You can be tracked using the same technologies whether you connect though v4 or v6, and neither stack has the advantage there.

▲

d4mi3n 6 hours ago | parent | prev | next [-]

Unless my understanding of how IPv6 is flawed, I don’t think your assertion is true in practice. One of the big benefits to IPv6 is that addresses are plentiful and fairly disposable. Getting a /48 block and configuring a router to assign from the block is pretty straightforward.

I’m aka unsure if IPv4 really gets you the privacy advantages you think it does. Your IP address is a data point, but the contents of your TCP/HTTP traffic, your browser JS runtime, and your ISP are typically the more reliable ways to identify you individually.

▲

dpark 4 hours ago | parent | prev | next [-]

> Incoming HN downvotes because I'm not using the coolest latest technology.

The downvotes are because you’re needlessly combative, preemptively complaining about downvotes.

▲

iso1631 6 hours ago | parent | prev | next [-]

You can nat all your ipv6 traffic behind a single IP if you want. Or a new IP for every connection.

Realistically though there's enough fingerprinting in browsers to track you regardless of your public IP and whether it's shared between every device in the house or if you dole out a routable ipv4 to every device.

CG-NAT gives more privacy benefits as you have more devices behind the same IP, but the other means of tracking still tend to work.

For me I just don't see the appeal of supporting both ipv4 and ipv6. It means a larger attack surface. Every year or two I move onto my ipv6 vlan and last a few hours before something doesn't work. I still don't see any benefit to me, the user.

▲

drnick1 5 hours ago | parent | next [-]

> Realistically though there's enough fingerprinting in browsers to track you regardless of your public IP and whether it's shared between every device in the house or if you dole out a routable ipv4 to every device.

Yes, browser fingerprinting is a big issue, but it can be mitigated. The first thing everyone should do is to use a network-wide DNS blacklist against all known trackers (e.g. https://github.com/hagezi/dns-blocklists) and run uBlock Origin in the browser.

You can go further and restrict third party scripts in uBlock, or even all scripts. This will break at lot of websites, but it is a surefire way to prevent fingerprinting.

Then of course there is Tor.

▲

iamnothere 5 hours ago | parent | prev | next [-]

IPv6 itself seems to provide a larger attack surface based on IPv6-specific CVEs. I don’t know if it’s the added complexity or that it’s treated as a second class citizen by devs, but I still see a solid number of these coming across the CVE feed.

This one was particularly scary: https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.ht...

	▲	orangeboats an hour ago \| parent [-]
		When something happens over IPv4 people treat it like "the Internet has malicious actors, water is wet", but when it happens over IPv6 it must be IPv6's fault. Sigh...

▲

simoncion 5 hours ago | parent | prev [-]

> Realistically though there's enough fingerprinting in browsers to track you regardless...

Yep. For the OP, IPv6 "Privacy" addresses do what he's looking for. You can change how long they're valid for on Linux, so you can churn through them very frequently if you wish.

> Every year or two I move onto my ipv6 vlan and last a few hours before something doesn't work.

Odd. I've been using IPv6 for like fifteen, twenty years now with no trouble at all. If you've been using a "single stack" IPv6-only network, well, there's your problem.

> For me I just don't see the appeal of supporting both ipv4 and ipv6. It means a larger attack surface.

The attack surface with IPv6 is exactly as large as if each of your LAN hosts had a globally-routable IPv4 address. Thinking otherwise is as smart as thinking that the attack surface on a host increases linearly with the number of autoconfigured IPv6 addresses assigned to that host from the same subnet.

If you don't want the IPv6 hosts on your LAN to be reachable by unsolicited traffic, set the default policy for your router's ip6tables FORWARD chain to DROP, and ACCEPT forwarded packets for ESTABLISHED or RELATED connections. If you're not using ip6tables, do whatever is the equivalent in the firewall software you're using. If you know that you have rules in your FORWARD chain that this change would break, then you already knew that you could simply drop unsolicited traffic in the FORWARD chain.

Unrelated to that, I see no reason to get rid of IPv4.

I expect that the future will be that nearly all "residental" [0] and non-datacenter business connections provide globally-routable IPv6 service and provide IPv4 via CGNAT, as IPv6 will be used for servers deployed at these sorts of sites. [1] I expect that the future will be that all datacenters and "clouds" will provide globally-routable IPv6 to servers and VMs, and globally-routable IPv4 to the same by way of load balancers.

So, home servers [1] will use IPv6, datacenter and "cloud" servers will use IPv4 and IPv6, and "legacy" devices that work fine but will never have their IP software updated will use IPv4.

I see IPv6 as a "reduce the pressure on the IPv4 address pool" mechanism, rather than a "replace IPv4" system. Again, I see no reason to get rid of "short" IP addresses. Default to using "long" ones, and keep the "short" ones around just in case.

[0] I'm including people's personal mobile computers in this definition of "residential".

[1] "Servers" here include things like "listen" video game servers or short-lived servers for file transfers and stuff like that.

▲

poszlem 5 hours ago | parent | prev [-]

> Incoming HN downvotes because I'm not using the coolest latest technology.

"IPv6 just turned 30" - literally the first part of the post title.

The rest of the post is equally baffling, you are just clinging to a legacy bottleneck (NAT) that was never designed to be a security feature

▲

ok123456 3 hours ago | parent | next [-]

> never designed to be a security feature

It's virtually always used with some firewall rules, so it sort of is? It's just dogma to insist that there are no security benefits to having a single choke point for traffic.

	▲	bigstrat2003 2 hours ago \| parent [-]
		The firewall is what is providing security, not NAT. And you can equally easily have a firewall in front of an IPv6 network.

▲

alt227 2 hours ago | parent | prev [-]

NAT superceded ipv6 quite plainly, and it is obvious what technology won out.

▲

umanwizard 2 hours ago | parent [-]

Er… not at all. NAT and ipv6 are both very widely used, with IPv6 adoption steadily growing over time.

▲

alt227 2 hours ago | parent [-]

Only due to the mobile device space. It will not take off outside of Wireless telco networks.

Take a look at the IPv6 Google graph that everyone loves so much:

https://www.google.com/intl/en/ipv6/statistics.html

You can clearly see an initial steep spike to the curve where mobile adoption was new and fierce, and then the curve starts slowly becoming less steep over the last 10 years. It will peter out and remain steady when mobile device adoption reaches critical mass.

	▲	dpark an hour ago \| parent \| next [-]
		How do you look at a chart showing Google access is 50% IPv6 and then proclaim that clearly NAT “won out”? In what world is 50% market share a loss?
	▲	umanwizard an hour ago \| parent \| prev [-]
		No, as I pointed out in another reply to you, home internet is commonly dual-stack (at least in the US and many other countries), and machines with dual-stack connectivity can and do use IPv6 to connect to sites that support it. You can verify this yourself using Wireshark or similar tools.