News for hackers. Stuff that matters.
Re:GDPR: sorting the fact from the fiction by scurvy on Sunday February 11, 2018 @01:19AM (#16351456)
Do IPv6 addresses count as identifiable? Because they really shouldn't if you understand how SLAAC works with privacy extensions (the default in almost every client stack).
Re:GDPR: sorting the fact from the fiction by detaro on Sunday February 11, 2018 @04:23AM (#16351928)
Right now I always get the same IPv4 address, which uniquely identifies my traffic. After a switch to IPv6, I'll likely always get the same /64 or /56 subnet, that uniquely identifies my traffic. Randomizing some of the address doesn't help if another part of it is already enough to identify.
Re:GDPR: sorting the fact from the fiction by tscs37 on Sunday February 11, 2018 @04:36AM (#16351964)
Most people don't always get the same IPv4, they get a random one from the ISP, though it is still identifying.

IIRC zeroing the last one or two groups of IPv4 and the /56 or /48 of the IPv6 address block should be fine.

Alternatively you can use a short hash function (xxhash32 cut to 16bits for IPv4 or pure xxhash64) to effectively destroy most of the data but still get a good pseudo-identifier.

Re:GDPR: sorting the fact from the fiction by scurvy on Tuesday February 13, 2018 @01:25AM (#16365154)
It identifies your network segment, but not you as an individual. I guess if you lived alone that could only be you, but it would only identify your household in a family situation. One could make the argument either way.
Re:GDPR: sorting the fact from the fiction by geocar on Sunday February 11, 2018 @02:02AM (#16351573)
It ultimately depends on what you’re doing (and can do) with those IPv6 addresses.

If you can identify someone then it probably is. That’s for example if you have a web form with their details filled in— just make sure they know you’re keeping their IPv6 address for the avoidance of doubt.

If you can give it to someone like their ISP, and they can identify someone for you, then it might be: especially if you have a relationship with that ISP where you do that.

If not, then probably not.