Re: [v6ops] Are we competitive?

On Fri, Aug 19, 2022 at 3:58 PM Fernando Gont <fernando@gont.com.ar> wrote:
>
> Hi, Fred,
>
> On 19/8/22 16:09, Fred Baker wrote:
> >
> >
> >> On Aug 15, 2022, at 9:07 AM, Soni They/Them L.
> >> <fakedme+ipv6@gmail.com> wrote:
> >>
> >> We do not like it when IPv6 enables cross-website tracking in spite
> >> of browser-based protections, including the ability to separately
> >> identify household/community participants, which would be entirely
> >> avoidable if the IPv6 stack had full built-in support for ephemeral
> >> addresses and browsers used them per-tab or so.
> >
> >
> > I'm going to ask the obvious question. What is the difference between
> > an "ephemeral" address and a "temporary" address? I think you're
> > asking for a temporary address that is used for a specific purpose (a
> > tab, a tcp session, whatever) and then forgotten.
>
> Answer is in Section 4.4 of
> draft-gont-v6ops-ipv6-addressing-considerations-02:
> https://www.ietf.org/archive/id/draft-gont-v6ops-ipv6-addressing-considerations-02.html#name-address-stability-considera
> ;-)
>
> TL;DR; They are addresses that are used by a single application (e.g., a
> web broswer) or even a single site or application inside the browser.
> Otherwise, temporary addresses would still allow correlation while the
> same address is in use (while the address is preferred).
>
> Strictly speaking, temporary addresses *are* ephemeral (i.e., they are
> certainly not constant or stable). But there are cases where you'd
> probably want an application to be able to request a
> single/exclusive-use address.

Fernando,

Assigning a unique pseudo randomized IP address as the local end point
of each TCP connection would provide the strongest privacy guarantees
in terms of preventing cross correlations between different flows from
the same source. In this model, the addresses are more aptly described
as ephemeral and not temporary. The address would be used for the
lifetime of only a single flow which could be an arbitrarily long
period of time. Only when the connection is terminated is the address
released back into the pool. This does mean that at a given point of
time a host may have thousands of such addresses in use, but I believe
that's mostly a problem of managing bulk address assignments and
network forwarding via identifier to locator mappings.

Tom

>
> Thanks,
> --
> Fernando Gont
> e-mail: fernando@gont.com.ar
> PGP Fingerprint: 7F7F 686D 8AC9 3319 EEAD C1C8 D1D5 4B94 E301 6F01
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops