IPv6 is being more and more adopted, in part to facilitate the millions of smart devices that have already been installed at home. Unfortunately, we find that the privacy of a substantial fraction of end-users is still at risk, despite the efforts by ISPs and electronic vendors to improve end-user security, e.g., by adopting prefix rotation and IPv6 privacy extensions. By analyzing passive data from a large ISP, we find that around 19% of end-users' privacy can be at risk. When we investigate the root causes, we notice that a single device at home that encodes its MAC address into the IPv6 address can be utilized as a tracking identifier for the entire end-user prefix---even if other devices use IPv6 privacy extensions. Our results show that IoT devices contribute the most to this privacy leakage and, to a lesser extent, personal computers and mobile devices. To our surprise, some of the most popular IoT manufacturers have not yet adopted privacy extensions that could otherwise mitigate this privacy risk. Finally, we show that third-party providers, e.g., hypergiants, can track up to 17% of subscriber lines in our study.

IPv6 被越来越多地采用，部分原因是为了方便已经安装在家里的数百万智能设备。不幸的是，尽管 ISP 和电子供应商努力提高最终用户的安全性，例如通过采用前缀轮换和 IPv6 隐私扩展，我们发现大部分最终用户的隐私仍然处于危险之中。通过分析来自大型 ISP 的被动数据，我们发现大约 19% 的最终用户的隐私可能面临风险。当我们调查根本原因时，我们注意到家中将其 MAC 地址编码为 IPv6 地址的单个设备可以用作整个最终用户前缀的跟踪标识符——即使其他设备使用 IPv6 隐私扩展。我们的结果表明，物联网设备对这种隐私泄露的贡献最大，并且在较小程度上，个人电脑和移动设备。令我们惊讶的是，一些最受欢迎的物联网制造商尚未采用可以减轻这种隐私风险的隐私扩展。最后，我们展示了第三方提供商，例如超巨人，在我们的研究中可以跟踪高达 17% 的用户线路。