- Piecemeal Deployment
- Security Issues
- The IPv6 Panopticon
- Am I Online Yet?
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
The IPv6 Panopticon
One of the more rational complaints about IPv6 is that it makes tracking easier. This was especially true of the earlier autoconfiguration drafts. IPv6 provides stateless autoconfiguration, which means that a host can assign itself a valid IPv6 address based on a router advertisement, without needing either the host or a third party to track any persistent state.
The first specification for doing this was very simple. It inserted a 16-bit value into the middle of the network interface's MAC address, then used this as the host ID part of the address, following the 64-bit network ID that it received from the router.
The problem with this is obvious: MAC addresses are supposed to be globally unique, so someone can track you between networks trivially. A company like Google or Facebook, which injects tracking code into millions of web pages, can extract your MAC address and get a unique identifier from your computer, whether you're at home, at work, in a coffee shop, or somewhere else. You broadcast your MAC address over the local network segment, so it makes it trivial to map IP addresses to physical devices, even when all network traffic is encrypted.
Fortunately, this is no longer the current recommendation. Most operating systems will either use a hash of the MAC address and the network prefix or just use a random number. The probability of collision is low with a random number, and if you do pick an IP address that's already in use, then you can just pick a new one.
Even with random IP addresses, however, there is the question of anonymity. When you are behind a NAT, it's hard to tell you apart from another user on the same network. That's the theory, anyway: Variations in browser configuration make it very easy to identify individuals if they go to your web server.
IPv6 has another mechanism that makes it easy to address this concern: Each network interface is required to support multiple IP addresses. This means that it's possible for the paranoid to generate a new IPv6 address for every outgoing connection, while retaining one static one for incoming connections. Most operating systems will now use a random value and change it periodically.