Re: Address privacy

[Nick Hilliard <[e-mail]>]

Tom Herbert wrote on 28/01/2020 03:10:
> Yes, that's the "always on" network application that would allow
> address tracking and identification at even high frequency of address
> change. An exploit based on that is described in section 4.4 of
> draft-herbert-ipv6-prefix-address-privacy-00. I believe the only way
> to defeat this exploit would be single use (per flow), uncorrelated
> address.

persistent identification for apps (browser / mobile / etc) is handled 
using a variety of mechanisms, primarily client fingerprinting.  The 
best known example of client fingerprinting would be application 
cookies.  IP addressing information is only one input source and 
probably one of the less important ones because of the poor correlation 
between ip addresses and end users (e.g. large 1:n nats), and ip address 
changes (office to train wifi, to in-car cellular to home broadband, to 
coffee shop, etc).

Overall privacy addresses fall into the category of things that seemed 
like a good idea at the time but in retrospect their usefulness fell 
away as people worked out other, more accurate ways to track end users 
and end user devices.

Nick