Re: Address privacy

[Michael Richardson <[e-mail]>]

Tom Herbert <[e-mail]> wrote:
    > I don't understand why 24 hours is considered the preferred lifetime.

I think that this is a good and definite RFC4941bis comment that we should go
into.

I think that using temporary addresses in series, for short periods of time,
is useless: WHEN IT COMES TO PREVENTING TRACKING WHEN NOT MOBILE.

To be clear, we have made significant progress for devices which are mobile
or nomadic.  We should celebrate this and move on, but recognize that a
'temporary" address that lasts as long as the device is at a specific
location is good.
A stable private address may be good enough, if it is okay for the device to
resume the same address whenever it returns to that location. 

For the reasons Ted gave (upper-64 at home network), but also because the
risk is providing trivial tracking to a MITM observer who sees connection A
to facebook, to pr0n site Q, human rights organization Y, VPN service N and
then connection B to service X. As Tom and Mark have pointed out, if the MITM
can coordinate userinfo with service X, then they can determine the set of
things that the user has done.

*IF* we are trying to deal with tracking when a device is not moving, then we
 might need a different strategy.
 

-- 
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-