Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockers to IPv6 Adoption

labs.ripe.net

Post reply on HN
Print view View original

61–70 of 154 posts

Re: Blockers to IPv6 Adoption

#61

Post by ge0rg »

mehrdadn wrote: post #57

I'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fifty quintillion additional RFCs have been finally deployed and battle-tested world-wide; I'm talking about IPv6 as available to the ordinary user /today/ ) I simply do not trust using IPv6 to provide as much security or privacy as IPv4. More than happy to chan…

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

Re: Blockers to IPv6 Adoption

#62

Post by mehrdadn »

ge0rg wrote: post #61
mehrdadn wrote: post #57

I'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fifty quintillion additional RFCs have been finally deployed and battle-tested world-wide; I'm talking about IPv6 as available to the ordinary user /today/ ) I simply do not trust using IPv6 to provide as much security or privacy as IPv4. More than happy to chan…

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...

Re: Blockers to IPv6 Adoption

#63

Post by detaro »

mehrdadn wrote: post #62
ge0rg wrote: post #61

Earlier quoted context omitted.

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...

Because it has a trivial IPv6 equivalent in the form of a basic stateful firewall?

Re: Blockers to IPv6 Adoption

#64

Post by vetinari »

4ad wrote: post #36
lwhalen wrote: post #17

Comcast is my biggest blocker to IPv6 adoption. I maintain a static v4 block with them, they tell me I have to give that up if I want a v6 block. Until I give up v4, v6 works on my network right up to the Comcast modem, and is promptly dropped on the floor. Regrettably, that is 'no bueno' for a multitude of reasons. :-(

Here in Vienna, the "local Comcast" started deploying IPv6. However, they stopped providing real IPv4 for IPv6 customers, and instead do CGN. Well thanks, but no thanks.

That's the problem with most consumer-grade ISPs that "embrace" IPv6. They will give it to you, but you have to give up your public IPv4 adress and be stuck within private address range.

Of course, given the state of IPv6 in the world, that's not usable for anyone who uses IPv4 today, so instead of using both simultaneously and using IPv6 when possible, you are stuck with IPv4 only, and be counted in the IPv4 stats.

Re: Blockers to IPv6 Adoption

#65

Post by throwaway2048 »

grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

Its not like "ipv4 with longer addresses" would have been any more compatable, we would be stuck in exactly the same situation wrt actually deploying it.

The things that ipv6 brings along that are not present in ipv4 are pretty inconsequential.

Re: Blockers to IPv6 Adoption

#66

Post by mehrdadn »

detaro wrote: post #63
mehrdadn wrote: post #62

Earlier quoted context omitted.

The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...

Because it has a trivial IPv6 equivalent in the form of a basic stateful firewall?

And you're also claiming every single router I'm going to encounter today has already set up IPv6 correctly as needed to mirror the security and privacy characteristics of IPv4 like this?

Re: Blockers to IPv6 Adoption

#67

Post by throwaway2048 »

raesene9 wrote: post #54
kazen44 wrote: post #41

Earlier quoted context omitted.

NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish. Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good…

This, whilst technically correct, isn't necessarily end-users experience of things. Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet. So effectively it does prevent traffic inbound in the same way a firewall does. Yes you can punch holes in NAT, but that's an explicit action (well side-step…

You can achive precisely 100% exactly the same functionality with a firewall without NAT, indeed you need that sorta functionality to implement NAT to begin with.

All you need is a default deny inbound traffic rule, this isnt some kind of arcane thing that is so much harder than NAT for end users.

Re: Blockers to IPv6 Adoption

#68

Post by vetinari »

raesene9 wrote: post #54
kazen44 wrote: post #41

Earlier quoted context omitted.

NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish. Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good…

This, whilst technically correct, isn't necessarily end-users experience of things. Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet. So effectively it does prevent traffic inbound in the same way a firewall does. Yes you can punch holes in NAT, but that's an explicit action (well side-step…

> Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet.

Hole punching the NAT does not mean that the user will configure port forwarding. It means that the outside is able to send packets inside, without any explicit user action. It works, because most NAT implementations do not check the source IP address, so when user sends packets from port A to ip X, and the router receives packets to port A from ip Y, it will dutifully forward them, even if they are not related.

Re: Blockers to IPv6 Adoption

#69

Post by magicalhippo »

MR4D wrote: post #58
grandinj wrote: post #20

What we should take away from the IPv6 debacle is a fine lesson in hubris. I was hanging out in the IPv6 mailing lists at the time the various solutions were being debated. The prevailing attitude was "the Internet is about to die from routing overload without IPv6, so we can stick whatever complexity we want inside it, and they will have no choice but to accept it." Except that new router hardware and new incrementa…

Well said! I was in the camp hoping for two octects at the beginning of the address (so they could be zeroes). Actually, a single i text would have taken us to a trillion IPs and given us enough time to think about the topic a bit more. Large changes rarely succeed. Perl 6, Mozilla (back in the 1990’s) and others come to mind. This is hard stuff, and we were made to swallow the kitchen sink.

I guess one could say, to paraphrase, extraordinary change requires extraordinary motivation.

For me as a home user, IPv6 seems like what you'd get when you ask a group of 6-year olds to design a concept car.

Re: Blockers to IPv6 Adoption

#70

Post by detaro »

mehrdadn wrote: post #66
detaro wrote: post #63

Earlier quoted context omitted.

Because it has a trivial IPv6 equivalent in the form of a basic stateful firewall?

And you're also claiming every single router I'm going to encounter today has already set up IPv6 correctly as needed to mirror the security and privacy characteristics of IPv4 like this?

Pretty much, yes. Other security issues with random routers appear to be way more common.
Post reply on HN