Disabling temporary addresses by default?

[Lorenzo Colitti <[e-mail]>]

Changing subject because many participants are likely to just ignore yet
another "SLAAC vs DHCPv6" thread. :-)

On Tue, Jan 28, 2020 at 11:27 PM <[e-mail]> wrote:

> In the context of 4941bis last call, it might be prudent of us to revisit
> this change:
>
> https://tools.ietf.org/html/draft-ietf-6man-rfc4941bis-05#section-8
> 6.  Temporary addresses are *not* disabled by default.
>

Saying that temporary addresses should be disabled by default (assuming
hosts actually do that) seems like a terrible privacy problem. It means
that by default, a host that doesn't change prefix will use the same IPv6
address to communicate with *everyone* on the internet until the end of
time. That provides lots of opportunities for cross-site tracking, and the
user can do very little to protect themselves because they don't have
control over IP addressing like they do over higher-layer identifiers
(e.g., users can clear cookies, or use different browser profiles or
different browsers/apps for different sites).

I don't think 4191bis should advance if it says that privacy addresses are
disabled by default. It would be a strong statement by the IETF that we
don't care about privacy of IP addresses and would be a terrible signal to
send.

Instead of disabling, why not change the default of the number of addresses
maintained? For example, instead of maintaining 1 permanent + 1 valid + 7
deprecated, why not just default to maintaining 1 permanent + 1 valid + 1
deprecated. That means that applications would have to re-establish their
connections once a day instead of once every 7 days. But if they use
privacy addresses, they already need to re-establish connections after 7
days. And they can always use not to use privacy addresses via the
appropriate socket option.