Re: Address privacy

[Fernando Gont <[e-mail]>]

On 28/1/20 00:10, Tom Herbert wrote:
> On Mon, Jan 27, 2020 at 5:36 PM Fernando Gont <[e-mail]> wrote:
>>
>> On 26/1/20 18:37, Nick Hilliard wrote:
>>> Tom Herbert wrote on 26/01/2020 20:16:
>>>> It's intuitive
>>>> that a higher frequency of address rotation yields more privacy
>>>
>>> intuitive, but probably inaccurate because of the a priori assumption
>>> that privacy is strongly associated with the endpoint identifier.
>>
>> In many cases, it is: you log in to fb with a given address, and reuse
>> that address to do other stuf
>>
> Yes, that's the "always on" network application that would allow
> address tracking and identification at even high frequency of address
> change. An exploit based on that is described in section 4.4 of
> draft-herbert-ipv6-prefix-address-privacy-00. I believe the only way
> to defeat this exploit would be single use (per flow), uncorrelated
> address.

Agreed. That said, temporary addresses, for obvious reasons mitigates 
activity correlation over time -- certainly not to the same extent that 
the paranoid "one address per flow" would.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492