Subject: Privacy problems in IPv6

From: "Richard M. Smith" <[email-masked]>
Date: Fri, 8 Oct 1999 10:04:39 -0400

Hi,

Is the attached article accurate in the technical details of
the IPv6 addressing scheme?  That is, an IPv6 address
contains the Ethernet adapter address of a person's
computer and the adapter address will be sent out to each
and every Web site they visit?

Thanks,
Richard

==========================================
Richard M. Smith     Phone: (617) 962-8351
Internet consultant  FAX:   (617) 731-5572
Email: [email-masked]
http://www.tiac.net/users/smiths
==========================================

=======================================================================

http://www.techweb.com/se/directlink.cgi?INW19991004S0052

October 04, 1999, Issue: 783
Section: Gray Matter
----------------------------------------------------------------------------
----
Where's All The Outrage About The IPv6 Privacy Threat?
Bill Frezza

What happens when companies such as Intel or Microsoft are found to have
embedded unique identifiers in their hardware or software that pose
potential privacy problems for Internet users? As we know from experience
with both the Pentium III Serial Number flap and the Microsoft Win98
Registration Wizard brouhaha, professional privacy advocates sound the
alarm, the press launches a feeding frenzy, Wall Street shudders and the
alleged corporate miscreants are flogged into backing off.

Now, what happens when the Internet Engineering Task Force does the same
thing, specifying an addressing structure in its next-generation Internet
protocol, IPv6, such that every packet can be traced back to each user's
unique network interface card ID? Apparently, nothing.

It's a conundrum that makes one wonder about the motives of the reigning
Internet digerati, who spend much of their time assuring us that they are
protecting our interests as they quietly arrogate power in the new world
order.

IPv6 was initially proposed to solve the "problem" that IPv4 has with
running out of addresses. You would think that the 32-bit address field of
IPv4, supporting more than 4 billion unique addresses, would be sufficient
to last quite some time. Unfortunately, the cabal that controlled the
disposition of these addresses had a habit of handing out large blocks to
their friends, who parlayed these into start-ups with multibillion-

dollar market caps. Hence, the "shortage."

IPv6, on the other hand, has 128 bits of address space, enough to provide a
billion-billion addresses for each square meter of the earth's surface. How
one could ever route that many addresses is an interesting question, but at
least IPv6 will never run out.

As you might expect, the address field is so huge that the IETF didn't know
how to assign it. So, in a move to get buy-in from established industry
standards bodies, the right-most 64 bits were designated to contain EUI-64
format information. This is used by the IEEE to assign Ethernet addresses,
which are normally not transmitted outside a user's LAN.

Included in EUI-64 are two interesting pieces of information: the registered
manufacturer of your NIC card and your 48-bit Ethernet address. Surprise!
Every packet you send out onto the public Internet using IPv6 has your
fingerprints on it. And unlike your IP address under IPv4, which you can
change, this address is embedded in your hardware. Permanently.

The spooks and weirdos in Washington, ever eager to empower the surveillance
state as they fight a rear-guard action against strong encryption, must be
thrilled with such a gift. They appear so thrilled that the Institute for
Information Sciences, heavily funded by the Defense Department, is writing a
reference stack for IPv6 that it is quietly hoping to slip into Windows
2000.

Where are the professional privacy advocates on this issue? Let's start with
the Electronic Frontier Foundation (EFF), champions of freedom in cyberspace
and cofounders of the TRUSTe initiative. TRUSTe's mission is to build "trust
and confidence in the Internet" with a branded, online "trustmark" assuring
users that their privacy will be respected. Go search EFF's site and see if
you can find a single word about IPv6 and its privacy problems. The EFF's
silence is matched by a similar lack of concern from the Center for
Democracy and Technology and the Electronic Privacy Information Center, both
of which are usually the first to man the barricades when Big Brother comes
knocking.

Could it be that this unusual averting of the collective gaze is just an
embarrassing attempt to avoid airing the family's dirty laundry? With all
the interlocking boards, directorates, subcommittees and associations that
keep the digerati in sync, it's hard to know where responsibility for this
snafu begins and ends.

A new advocacy group called the IPv6 Forum, headed by honorary chairman Vint
Cerf, is leading the charge for adoption, and the usual alphabet soup of
geek groups appears to be falling into line. This may be the reason the
press hasn't shown much interest. It's a lot more fun to kick Intel and
Microsoft than to rail at the folk heroes credited with creating the
Internet.

It looks like the geeks screwed up this time, though. I hope they have the
wisdom to fix things before it's too late.

Bill Frezza is a general partner at Adams Capital Management. He can be
reached at [email-masked] or www.acm.com.

Copyright ® 1999 CMP Media Inc.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ignatios Souvatzis <[email-masked]>
Date: Fri, 8 Oct 1999 16:49:16 +0200

> and every Web site they visit?

The address will be sent to each and every web site they visit,
so that the answer can be sent back to them.

This happens unless they go through their companies', their school's, their
ISP's proxy server. (And they should do that even for reasons not connected
to privacy.) In that case, the proxy servers' address will be used instead.

But let's assume they don't use a proxy server.

1) An IPv6 address consists of an address for the cable and an interface
address. There are several methods to generate interface IDs.

Stateless address autoconfiguration on Ethernet links uses an EUI-64 
derived from the Ethernet address of the interface. Yes, this one is
basically unique, and could be used to track the activity of this
interface.

You can, however, use automatic configuration using DHCP instead, or
manual configuration, leading to addresses that don't associate globally
uniquely identifiable addresses with interfaces.

Or even use the technical solution described in 5)

2) A computer can have more than one interface. Interfaces can be put into
different computers, a different interface can be put into your computer, so
the Ethernet address of the interface that you are currently using does not
identify the computer you are using.

3) A computer can have more than one user, (in fact, all computers I have
access to have more than one user), so identifying the computer does not 
identify a user.

4) Of the computers used by single persons, most are used by people at home
who connect through some dialup IP ISP, who in turn reuses addresses whenever
somebody goes offline. Those computers most of the time do NOT have any
Ethernet address, and even if they had, it would not be used for their dialup
interface. I do not think this practice will change with IPv6.

5) Or you can use the method described in
http://www.ietf.org/internet-drafts/draft-ietf-ipngwg-addrconf-privacy-00.txt,
which actively changes your address from time to time.

As for the cited article: the author was clearly not aware of 5), and hadn't
considered 1)..4) enough. I agree there is a privacy problem with Internet.
It is already there, with IPv4 (and independent of it), created by the
Cookie mechanism, which makes you identifiable even with changing addresses.
IPv6 won't make the situation better or worse in this respect.
The cookie mechanism was invented to make persons trackable even when they
use proxy servers (see above). I suggest you switch cookies off.

Regards,
	Ignatios Souvatzis

-- 
 * Progress (n.): The process through which Usenet has evolved from
   smart people in front of dumb terminals to dumb people in front of
   smart terminals.  -- [email-masked] (obscurity)
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pete Loshin <[email-masked]>
Date: Fri, 08 Oct 1999 10:51:42 -0400

>and every Web site they visit?

There are large and small technical errors in this column (not article).
Check RFC 2373, for example. Also, this paragraph, questioning how IPv6
could route so many addresses, points out the ignorance of this particular
columnist (he obviously did not read RFC 2374):

"IPv6, on the other hand, has 128 bits of address space.... How 
one could ever route that many addresses is an interesting question, but at 
least IPv6 will never run out."

If you want to state your case and refute or rebut this kind of thing, the
editors of the website should be very happy to have it; they may even pay
you to write it up and submit it. In any case, anyone who wishes to stem
the tide of FUD should get in touch with the editors who publish FUD.

-pl

+-------------------------------------------------------------+
| Pete Loshin                    http://Internet-Standard.com |
|                                                             |
| _IPv6 Clearly Explained_ Morgan Kaufmann January 1999       |
| _TCP/IP Clearly Explained_ 3rd ed Morgan Kaufmann June 1999 |
|                                                             |
+-------------------------------------------------------------+

---

From: Thomas Narten <[email-masked]>
Date: Fri, 08 Oct 1999 11:18:10 -0400

Richard,

The article has a number of technical inaccuracies.

> unique network interface card ID? Apparently, nothing.

IPv6 addresses contain MAC addresses only if they were created via
stateless autoconfiguration. If one were to use DHCP instead, this
wouldn't necessarily be the case. (I say necessarily because it would
then be the policy of the server that determines what address you
would get.)

> dollar market caps. Hence, the "shortage."

The above is grossly innaccurate. I know few people that argue
(convincingly) that we are not in danger of running out of globally
unique IPv4 addresses. It is a question of when, not if.  This has
nothing to do with "cabals". It has to do with the exponential growth
of the Internet, and the current/future trend of making every device
(cell phones, consumer electronics, etc.) capable of connecting to the
Internet.

While it is true that some organizations have received seemingly huge
and "wasteful" assignments, this was (for the most part) done long ago
(e.g., in the 1980s) before anyone had an inkling that address space
needed to be coserved. Also, only 1/4 of the total IPv4 address space
is in use today, so the large blocks that have been handed out in the
past cannot be considered the main problem today.

The "shortage" today is more interesting, given that only 1/4 of the
total address space is actually in use. In practice, however, address
registries are being much more stringent about giving out
addresses. Some folks (like those that can't get as many as they'd
like) say too stringent. But the registries are motivated by the
concern that IPv4 addresses are in fact a limited resource today that
must be carefully managed. This is a complex issue with many differing
opinions as to whether the current policies are in fact "right".

> As you might expect, the address field is so huge that the IETF
> didn't know how to assign it. So, in a move to get buy-in from
> established industry standards bodies, the right-most 64 bits were
> designated to contain EUI-64 format information. This is used by the
> IEEE to assign Ethernet addresses, which are normally not
> transmitted outside a user's LAN.

The 64-bits contain the EUI-64 address for several reasons. For one
thing, 128 bits *is* a lot, and splitting an address into 64 bits for
routing & 64 for host identification does not appear to limit growth
in any realistic sense. 64 bits for routing seems more than adequate
and certainly won't limit future growth.  Having the 64-bit EUI for
the Interface Identifier keeps stateless address autoconfiguration
simple and robust. Also, the 64-bit EUI was chosen to allow future
flexibility with new architectures that might allow IP addresses to be
cleanly separated into a locator and identifier portion. Again, the
EUI-64 is (generally) globally unique, which appears to be a desirable
property from the perspective of separating addrsses into
locator/identifier portions.

I don't understand the reference to "buy in from established industry
standards bodies". We use EUI-64 identifiers because they already
happen to exist and have the desired properties (globally unique and
available on pretty much all hardware). The IETF in never contacted
the IEEE about using them. We just use them. 

> Included in EUI-64 are two interesting pieces of information: the
> registered manufacturer of your NIC card and your 48-bit Ethernet
> address. Surprise!  Every packet you send out onto the public
> Internet using IPv6 has your fingerprints on it. And unlike your IP
> address under IPv4, which you can change, this address is embedded
> in your hardware. Permanently.

Strictly speaking, not true. From the perspective of stateless address
autoconfiguration, one can use an identifier other than the one in the
hardware. This does require manual configuration by the end user. But
it is specifically called out for in the design because it is needed
to handle the case where duplicate addresses occur in hardware.

> The spooks and weirdos in Washington, ever eager to empower the
> surveillance state as they fight a rear-guard action against strong
> encryption, must be thrilled with such a gift. They appear so
> thrilled that the Institute for Information Sciences, heavily funded
> by the Defense Department, is writing a reference stack for IPv6
> that it is quietly hoping to slip into Windows 2000.

Well, if every research project that gets some dollars from govt. is
in reality a nefarious plot run by the "spooks and weirdos" with a
hidden agenda, I guess this might be true. (To be clear: I don't
happen to subscribe to this particular school.)

> It looks like the geeks screwed up this time, though. I hope they
> have the wisdom to fix things before it's too late.

The issue of EUI-64s in IPv6 addresses has been a known problem for a
long time. But the community is certainly not in agreement about how
serious a problem it really is in practice. It is important to
distinguish here "reality" from "perception".  You might take a look
at draft-ietf-ipngwg-addrconf-privacy-00.txt.  It attempts to discuss
some of the issues and attempts to put them in perspective. The
document also proposes a solution for those that believe the issue is
significant. (The document also is a work-in-progress with another
version coming, so it is certainly not the final word on the topic.)
The document takes the view that this would be an optional approach
precisely because it it is unclear that it is the best approach for
all environments.

Thomas

---

From: Jeff Williams <[email-masked]>
Date: Fri, 08 Oct 1999 10:10:24 +0100

Richard and all,

  I warned of this months ago. It was basicaly ignored.

Regards,

--
Jeffrey A. Williams
Spokesman INEGroup (Over 95k members strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-447-1894
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208