Today it's best practice to put them in the @implementation
or in a (non-public) class extension.
Ivars are never of interest to clients of a class, so they should not be visible in the public API (the header).
There's not much difference in putting them in the @implementation or in a class-extension. For consistence I always put them in the @implementation.