Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.comp.software.firefox > #17894

Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix

Cross-posted to 5 groups.

Show all headers | View raw

Nuno Silva wrote:
>>> The problem, as I see it, wrt privacy, is while IPv4 (with NAT) gave every
>>> home a unique IP address, IPv6 gives every device a unique IP address.
>>>
>>> As you astutely and helpfully noted, we can ameliorate 'some' of that IPV6
>>> privacy flaw by employing RFC 8981 privacy extensions, but they only rotate
>>> the latter half of the IPv6 address & even so, only after a period of time.
>>
>> And, of course, for most people, with only one LAN, using only a
>> single /64 the first half of the IPv6 address gives away no more than
>> your IPv4 address gives away -- that it's something of yours.
>> Although I always run dual stack when I can and tend to urge others to 
>> do so too, I do accept that running IPv4 only is a valid option if you 
>> have certain priorities, that differ from mine.
> 
> Yeah, if you're in a context where IPv4 is NATed at your premises
> because the ISP hands you one address, and you also get IPv6 prefix
> delegation, then... it's the same thing, your IPv4 address identifies
> the connection, as does the prefix present in the RAs.
> 
> The part that is "rotated" or otherwise randomized in such
> privacy-centered SLAAC configurations is the one that'd allow tracking
> the *device*, not the connection.
> 
> That's not meant to stop tracking your e.g. residential connection, it's
> meant to stop tracking the device based on the device-specific portion
> of the address, which without this may e.g. contain the MAC address.
> 
> <https://en.wikipedia.org/wiki/IPv6_address#Interface_identifier>
> 
> But for e.g. MAFIAA this only matters if you're not using your own
> connection, because otherwise you've already been identified by the
> delegated prefix, they'd pester you the same.
> 
> Do note: the prefix used in SLAAC isn't (or shouldn't be...) something a
> residential ISP uses for several costumers, it's meant to be one prefix
> for each contract/ISP connection/modem.
> 
>> Although I always run dual stack when I can and tend to urge others to
>> do so too, I do accept that running IPv4 only is a valid option if you
>> have certain priorities, that differ from mine.

Thank you all for this very useful information about IPv6 privacy issues.

Since Usenet is for learning from people like Nuno Silva & Brian Gregory,
who know far more about this IPv6-privacy stuff than I will ever know...

Looking up the terms they're using is helpful to understand the network.

When Brian says "dual stack", he's meaning both the IPv4 & IPv6 stacks.
They're two parallel protocol stacks, where his devices can use either
protocol depending on what the remote service supports. If a site has IPv6,
his device may prefer it; if not, it falls back to IPv4, which provides
Brian benefit from IPv6's performance and routing improvements without
losing any IPv4 compatibility.	

When Nuno says SLAAC, he's using the acronym for Stateless Address
Autoconfiguration, which is the IPv6 mechanism that lets a device
automatically generate its own IPv6 address without needing a DHCP server.

The ISP gives us the network prefix (the first 64 bits) IPv6 address and
each device builds the second half (the Interface Identifier) IID address
on its own. It used to be derived from the MAC address, but not in modern
systems anymore, the point being if the IID half is stable, websites can
track specific devices across sessions. RFC 8981 destabilizes that, but
only after a set time period (generally defaulting to 24 hours).

An example is if you go to Starbucks in the morning and afternoon, and
visit the same web site in two different sessions, they know it's you in
both sessions.

Note that the web site knows it's starbucks too, which is why the first
half of IPV6 is no worse in terms of privacy than IPv4 is; but it's that
festugenah second half of the IPv5 prefix that we have to keep in mind.

His MAFIAA terminology is a play on the mafia-like behavior of copyright
trolls, combining RIAA (Recording Industry Association of America) with
MPAA (Motion Picture Association of America), where I would stress that
many people pay up but nobody who ever fought them in the USA ever lost.

With respect to VPN, I just found out that OpenVPN 2.5+ added a directive
specifically meant to prevent the very IPv6 leaks we've been discussing!
 block-ipv6 ; block IPv6 traffic by adding firewall rules to prevent leaks
Apparently it magically installs firewall rules on our devices that somehow
know to drop all IPv6 traffic unless it is going through the VPN tunnel.

It forces all IPv6 traffic to go through the VPN, or be blocked entirely.	.

If running older OpenVPN on linux, we can add firewall rules manually:
 ip6tables -P OUTPUT DROP
 ip6tables -P INPUT DROP

In short, I thank Nuno & Brian for bringing this up at a level far above my
pay grade since I just learned the simplest solution of all to the problem.

Apparently block-ivp6 blocks IPv6 only when the tunnel doesn't support it.
Which is perfect because understanding networking is what this is about.

BTW, while looking this up, I learned these potentially useful directives:
 block-outside-dns ; force DNS queries to stay inside the VPN interface 
This says, if a program tries to resolve DNS through wlan0, eth0, or
anything other than the TAP adapter, then block it (to prevent leaks).

Then, inside the VPN tunnel, we can explicitly set the DNS servers.
 dhcp-option DNS 1.1.1.1 ; set primary DNS to Cloudflare inside the tunnel
 dhcp-option DNS 9.9.9.9 ; set secondary DNS to Quad9 for secure fallback

I just tested them; now I see a full, healthy DNS stack inside the tunnel.
 NETSH: ... set dns 19 static 1.1.1.1
 NETSH: ... add dns 19 9.9.9.9
 NETSH: ... add dns 19 8.8.8.8

I knew absolutely nothing about IPv6 before this thread, so I thank
everyone for quickly correcting my newbie mistakes without pulling punches!

I still have work to do because apparently curl leaks outside of the VPN.
-- 
I learn best from helpful people who know a hellova lot more than I do.


































	.	 

Back to alt.comp.software.firefox | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-20 02:45 -0400
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-20 14:03 +0200
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 02:43 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:18 +0200
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 07:36 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 19:28 +0200
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 14:32 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Hank Rogers <Hank@nospam.invalid> - 2026-07-21 18:31 -0500
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 15:40 -0400
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 18:53 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-28 00:36 +0100
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix David Higton <dave@davehigton.me.uk> - 2026-07-20 20:47 +0100
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-20 21:59 +0200
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 02:04 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Adam H. Kerman" <ahk@chinet.com> - 2026-07-21 06:37 +0000
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 03:23 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-21 07:59 +0100
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 04:41 -0400
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:03 +0200
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 05:47 -0400
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 12:27 +0200
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 14:10 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 10:53 +0200
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 05:19 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix "Carlos E. R." <robin_listas@es.invalid> - 2026-07-21 11:30 +0200
                Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 06:10 -0400
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 19:13 -0400
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-22 09:47 +0100
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:30 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-22 21:35 +0100
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:46 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-23 04:33 +0100
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-23 08:12 +0100
              Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-23 16:23 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Oregonian Haruspex <no_email@invalid.invalid> - 2026-07-25 04:58 +0000
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-26 14:25 -0700
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 01:38 -0400
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-21 07:51 +0100
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-21 03:45 -0400
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Nuno Silva <nunojsilva@invalid.invalid> - 2026-07-22 09:37 +0100
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-24 11:36 -0700
  Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-22 21:32 +0100
    Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 16:54 -0400
      Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix agris <agris@invalid.tld> - 2026-07-22 17:05 -0700
        Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-22 23:06 -0400
          Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Brian Gregory <void-invalid-dead-dontuse@email.invalid> - 2026-07-23 04:50 +0100
            Re: PSA: IPv6 browser privacy leaks are caused by the host yet there's a simple fix Maria Sophia <mariasophia@comprehension.com> - 2026-07-23 16:51 -0400

csiph-web