Re: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?

Brian Gregory wrote on 7/18/2026 1:13 PM:
> On 18/07/2026 18:42, Maria Sophia wrote:
>> Brian Gregory wrote:
>>>> Q: Have you ever disabled IPv6 for privacy (to prevent IP leaks)?
>>>>      What are your experiences?
>>>
>>> No. I know how to enable and use the RFC 8981 IPv6 privacy extensions.
>>
>> Thank you for that suggestion of comparing the two different methods:
>>   1. Enable and use the RFC 8981 IPv6 privacy extensions
>>   2. versus partially disabling Windows Tcpip6\Parameters (0x20)
>>
>> Your experience, and that of others, should they volunteer to help out,
>> is invaluable because there is no escaping that IPv6 is part of Windows.
>>
>> Hence, we all have to consider how to protect our IPv6 privacy now.
>>
>> To be perfectly honest, I know almost nothing about IPv6, simply
>> because I've never used it, never needed to use it and don't want it.
>>
>> The only reason I care about IPv6 is to prevent IP leaks from something
>> I know nothing about, which is why I wiped it out completely today.
>>
>> But that caused the routing table to be unpredictable, so let's compare
>> the two methods for what matters to each of us on our Windows boxes.
>>
>> Q: Specifically, is it better to partially disable IPv6 (0x20), or to
>>     leave IPv6 enabled & rely on RFC 8981 privacy extensions instead?
>> A: ???
>>
>> Knowing absolutely nothing about RF8981, I needed to look it up first.
>>   <https://www.rfc-editor.org/rfc/rfc8981>
>>   RFC 8981 defines IPv6 privacy extensions, which make IPv6 addresses
>>   rotate frequently so websites cannot track us by stable IPv6 address.
>>   It does not hide the IPv6 prefix (which still reveals the ISP & 
>> region),
>>   but it hides the interface identifier, which is the part that could
>>   otherwise be tied to the device
>>
>> Hence, at first inspection, this seems to be the one-line difference:
>> 1. RFC 8981 rotates IPv6 addresses frequently to prevent tracking.
>> 2. Tcpip6\Parameters (0x20) disables IPv6 on all LAN/Wi-Fi interfaces.
>>
>> Knowing nothing about each before today, is this a reasonable comparison?
>> 1. RFC 8981
>>     a. IPv6 stays enabled
>>     b. IPv6 addresses rotate
>>     c. IPv6 still leaks if VPN doesn't tunnel it
>>     d. Using RFC 8981 IPv6 privacy extensions requires understanding IPv6
>>     e. Routing becomes more complex
>>     f. The kill switch must handle IPv6 routes too
>> 2. Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20)
>>     a. IPv6 disabled on interfaces
>>     b. No IPv6 leaks
>>     c. No IPv6 routing
>>     d. No IPv6 DNS
>>     e. Windows routing stays stable
>>     f. Kill switch works as designed
>>     g. No need to understand IPv6
>>
>> In summary, RFC 8981 is powerful, and, for most people, I think that 
>> may be
>> the right solution, but using it still has some privacy implications
>> (such as the ISP & region are still revealed even as the ID is not).
>>
>> Partially disabling IPv6 with Windows Tcpip6\Parameters (0x20) is more
>> brutal, and it negates any use of IPv6, but it keeps my current
>> LiquidVPN-based "dumb" killswitch working without modifications.
>>
>> Having never even heard of RFC 8981 until just now, anything I said
>> above can be wrong (and likely is), but I do thank you for suggesting it.
>>
>> I think everyone will benefit from knowing more about RFC 8981
>> implementation on their Windows box to rotate their temporary IPv6 
>> address!
> 
> IP leak is vague name for the privacy problems with IPv6.
> 
> The source IP of an outgoing connection ALWAYS leaks. You couldn't get 
> any reply back if you kept your IP address secret.
> 
> However with IPv6 the problem is that each device on your LAN has, at 
> any point in time, it's own IPv6 address. So with IPv6 things you 
> connect to can potentially tell which of your devices connected, where 
> as with IPv4 all connections appear to come from your single IPv4 
> address, so determining which one the connection came from is either not 
> so straightforward, or even impossible if your devices don't give away 
> their identity in any other way (such as in their http headers).
> 
> Basically what RFC8981 does, when a device implements it (it's 
> implemented on each device, not in your router or gateway), is to change 
> the IPv6 address a device uses to make outgoing connections at regular 
> intervals. Typically it changes once every 24 hours. The device also has 
> another IPv6 address that doesn't change, which can be used for incoming 
> connections or local connections, which can be useful in some situations.
> 
> I'm not paranoid about this kind of thing so generally I just make sure 
> it is enabled and leave it as every 24 hours. It is enabled by default 
> in Windows 10 and 11 for instance. But the situation varies with other 
> OSs. For instance I had to enable it on my Raspberry Pi web server if I 
> wanted it on there too.
> 

Thanks Brian.  Please help Maria.  She is VERY paranoid and slightly 
retarded, so look out for her if you can.