More Space, Less Privacy? Measuring the Effectiveness of IP-based Website Fingerprinting in IPv6
Authors: Sumeer Ahmad (Stony Brook University), Michalis Polychronakis (Stony Brook University), Theophilus A. Benson (Carnegie Mellon University), Nguyen Phong Hoang (University of British Columbia)
Volume: 2026
Issue: 4
Pages: 36–52
DOI: https://doi.org/10.56553/popets-2026-0109
Artifact: Available, Functional, Reproduced
Abstract: Despite the widespread adoption of domain name encryption protocols (e.g., DoH, DoT, and ECH), website fingerprinting attacks remain a significant threat to online privacy due to the visibility of IP connections that can be observed by network-level adversaries. This problem has been investigated in IPv4 thoroughly but remains largely unexplored in IPv6, where it is even more pronounced. From a design perspective, IPv6 offers a vastly larger address space, eliminating the need for virtual hosting and domain co-location -- practices prevalent in IPv4. These practices obscure several domains behind a single IPv4 address. The adoption of IPv6 can theoretically lead to more accurate fingerprinting based on IPv6 connections because each domain is now more likely to be resolved to a unique globally routable IPv6 address unlike IPv4. In this study, we systematically investigate the feasibility, accuracy, and privacy implications of IP-based website fingerprinting in IPv6 environments. Utilizing empirical data collected via active DNS measurements, Web crawling, and entropy-based analyses across half a million dual-stack websites, we conduct the largest evaluation of website fingerprinting in IPv6. We find that dual-stack websites that still have some IPv4-only dependencies are easier to fingerprint, achieving close to 94% accuracy on both IPv4 and IPv6. However, fingerprinting pure dual-stack websites is significantly harder: accuracy drops to 56% over IPv4 and 45% over IPv6. These results reveal distinct trends in hosting infrastructures and indicate that IPv6 itself does not inherently diminish privacy, contrary to existing concerns in the community. Rather, fingerprinting risk is shaped by how hosting providers deploy IPv6 and their choices regarding domain co-location.
Keywords: IPv6, website fingerprinting, web privacy, domain name encryption, traffic analysis
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
