© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
9199653
demo site
(Get the code!)
I don't buy the "enterprise" argument flowing through this discussion:
* What kind of enterprise network are you running where you don't control the clients and can't disable privacy extensions?
* If you want to make sure nobody uses privacy extensions on your net, just reject all outgoing connections which do not have the global bit set on your perimeter firewall. Then people will call tech support and you can explain to them that/how they have to disable this feature.
* It is true that enabled privacy extensions make logging harder. But if you're letting people into your network who have sufficient permissions to change their network config, they can just configure a static IP address so you've got to log based on MAC addresses (hoping nobody will change them) anyway. Rigging up a linux box which runs a daemon sniffing all traffic and logs the assignment of MAC addresses to IP addresses is not trivial, but easy. (See previous point if you don't want to build such a device or your network structure is too complex.)
OTOH does IPv6 allow tracking people much more and easier than fingerprinting allows. While it is true that you can fingerprint browsers, is the implementation of such a fingerprinting device a lot more complicated than a simple log file. Additionally does (rather exact) fingerprinting only allow browser identification; with the MAC address all other protocols (P2P, ...) are traceable, too.
There's actually currently some discussion about IPv6 and privacy in German media, see eg. <http://
Anyway, my preference is *for* privacy extensions enabled per default since they do improve privacy for the home user who walks into an IPv6-enabled network (and uses Ubuntu and not Windows...) and enterprise networks should have the means to either disable them or log the MAC addresses.