Re: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?

Brian Gregory wrote:
>> Q: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?
>>     What are your experiences?
> 
> No. I know how to enable and use the RFC 8981 IPv6 privacy extensions.

Thank you for that suggestion of comparing the two different methods:
 1. Enable and use the RFC 8981 IPv6 privacy extensions
 2. versus partially disabling Windows Tcpip6\Parameters (0x20)

Your experience, and that of others, should they volunteer to help out, 
is invaluable because there is no escaping that IPv6 is part of Windows.

Hence, we all have to consider how to protect our IPv6 privacy now.

To be perfectly honest, I know almost nothing about IPv6, simply 
because I've never used it, never needed to use it and don't want it.

The only reason I care about IPv6 is to prevent IP leaks from something
I know nothing about, which is why I wiped it out completely today.

But that caused the routing table to be unpredictable, so let's compare
the two methods for what matters to each of us on our Windows boxes.

Q: Specifically, is it better to partially disable IPv6 (0x20), or to 
   leave IPv6 enabled & rely on RFC 8981 privacy extensions instead?
A: ???

Knowing absolutely nothing about RF8981, I needed to look it up first.
 <https://www.rfc-editor.org/rfc/rfc8981>
 RFC 8981 defines IPv6 privacy extensions, which make IPv6 addresses  
 rotate frequently so websites cannot track us by stable IPv6 address.
 It does not hide the IPv6 prefix (which still reveals the ISP & region),
 but it hides the interface identifier, which is the part that could 
 otherwise be tied to the device	

Hence, at first inspection, this seems to be the one-line difference:
1. RFC 8981 rotates IPv6 addresses frequently to prevent tracking.
2. Tcpip6\Parameters (0x20) disables IPv6 on all LAN/Wi-Fi interfaces.

Knowing nothing about each before today, is this a reasonable comparison?
1. RFC 8981 
   a. IPv6 stays enabled
   b. IPv6 addresses rotate
   c. IPv6 still leaks if VPN doesn't tunnel it
   d. Using RFC 8981 IPv6 privacy extensions requires understanding IPv6
   e. Routing becomes more complex
   f. The kill switch must handle IPv6 routes too
2. Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20) 
   a. IPv6 disabled on interfaces
   b. No IPv6 leaks
   c. No IPv6 routing
   d. No IPv6 DNS
   e. Windows routing stays stable
   f. Kill switch works as designed
   g. No need to understand IPv6

In summary, RFC 8981 is powerful, and, for most people, I think that may be
the right solution, but using it still has some privacy implications
(such as the ISP & region are still revealed even as the ID is not).

Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20) is more
brutal, and it negates any use of IPv6, but it keeps my current
LiquidVPN-based "dumb" killswitch working without modifications.

Having never even heard of RFC 8981 until just now, anything I said
above can be wrong (and likely is), but I do thank you for suggesting it.

I think everyone will benefit from knowing more about RFC 8981
implementation on their Windows box to rotate their temporary IPv6 address!
-- 
Usenet allows purposefully helpful people to pool their experiences.