Re: Why /64

[Peter Dordal <[e-mail]>]

On 10/28/2013 04:27 AM, Jeroen Massar wrote:
> See my other messages: IPv6 Privacy addresses are a myth, they do not
> work. You can track people even when you just see IP addresses and
> ignore the upper layers. The upper layers just make it easier.
>
> Greets,
>   Jeroen
>
>
In what sense exactly is this claim meant?I agree that "privacy"
addresses are in many scenarios not all that private,
but I am not sure that makes them useless.

1. Suppose I connect both at work and home; each site has
a different /64 prefix. I do not want anyone to correlate my work
and home traffic. Assume I am either not using http, or I erase
cookies frequently; higher layers are not exposing me in any
"obvious" way.

If I use SLAAC at both sites, using the same EUI-64 identifier
as my low-order bits, then this gives me away.

How else can I avoid this besides using privacy addresses?

2. Suppose I connect to two different remote sites, A and B,
while at work. I don't want someone reviewing the logs at A and B
to know the same host made both these connections.

There are thousands of others at my same workplace using the
same /64 prefix; an outside observer will not be able to infer
that the same person connected to A and B from the prefix alone.

I want to choose different IPv6 addresses at my end
for each of these connections, differing of course only in the
low-order bits. Again I use SLAAC. How do I create
the second IPv6 address except by using privacy addresses?



Peter Dordal
Loyola University Chicago