One bad apple can spoil your IPv6 privacy (2022)
1–10 of 64 posts
Re: One bad apple can spoil your IPv6 privacy (2022)
#2"Our results show that IoT devices contribute the most to this privacy leakage"
Re: One bad apple can spoil your IPv6 privacy (2022)
#3"Our results show that IoT devices contribute the most to this privacy leakage"
It's like they say: the "S" in IoT stands for security.
Re: One bad apple can spoil your IPv6 privacy (2022)
#4What this says is IOT devices leak their MAC within their IPv6 address.
Quick solution would be DHCPv6 so they don't have a choice in what address they use.
Going further, NAT and hide all these devices behind a single external IP.
Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
Re: One bad apple can spoil your IPv6 privacy (2022)
#5What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.
Re: One bad apple can spoil your IPv6 privacy (2022)
#6Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.
Re: One bad apple can spoil your IPv6 privacy (2022)
#7What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.
You can easily enable IPv6 masquerading on openwrt and linux in general:
https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6
This has been available for a long time.
You can also do static NAT and anything that you were used to on IPv4.
Re: One bad apple can spoil your IPv6 privacy (2022)
#8What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers.
There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.
Re: One bad apple can spoil your IPv6 privacy (2022)
#9So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience?
I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they mention TVs. And uh yeah, TVs during their lifetime discuss with a huge range of providers, so this indeed broadcasts to
The privacy handling of the article writing isn't great imo. Only an ISP should have access to those data, not external researchers. I even fail to see how it can be GPDR compliant. That being said, operators won't spontaneously write those articles, so well, this one is usefl.
Overall this is an interesting article. I think ISPs doing prefix rotations can easily detect devices and warn the user and/or isolate the bad device (through symmetric NAT for instance -- I think this is an okay compromise, it's not a horrible hack), which this article shines light on. Cool.
Re: One bad apple can spoil your IPv6 privacy (2022)
#10"Our results show that IoT devices contribute the most to this privacy leakage"
I didn't read the paper. For anyone who did: How would that work exactly? It looks like the general problem is that an IoT device can use SLAAC and its MAC to generate an address like `prefix1::87:65:43:21`. Then the household's prefix can change and the IoT device can create a new address with the same local portion, like `prefix2::87:65:43:21`. Then an attacker could see that `prefix1` and `prefix2` are very likely to have been used by the same person.
How would an attacker get that information? If the IoT device is janky and malicious it could ping a bunch of malicious websites and wait for me to access them, I suppose. What would that give an attacker? It's not clear to me how that'd be worse than, say, the current IPv4 situation. And if the device is compromised and no firewall is blocking its outbound Internet access, there are other things I'd be more worried about.
If Amazon or Google make the device, then it could just report that back directly to them whenever its Alexa or Google Home bridge reports back. Their logs would show that "bridge 0x1234 connected from `prefix1::` yesterday, and `prefix2::` today, and it's owned by user kstrauser". I don't think anything in this paper could make it less private than that, surely?