Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One bad apple can spoil your IPv6 privacy (2022)

arxiv.org

Post reply on HN
Print view View original

11–20 of 64 posts

Re: One bad apple can spoil your IPv6 privacy (2022)

#11

Post by kstrauser »

paul_funyun wrote: post #6

Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.

And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM.

IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe drive doesn't have to shove bits through an ST412 interface.

Re: One bad apple can spoil your IPv6 privacy (2022)

#12

Post by cassianoleal »

phh wrote: post #9

So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they…

> this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really?

Please no. That would mean constantly having to check PD and updating DNS, wireguard endpoints, etc. accordingly.

Re: One bad apple can spoil your IPv6 privacy (2022)

#13

Post by dmitrygr »

adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> Going even further, NAT

Yup, and having lost any and all reasons to use IPv6, go back to what has already been working just fine: IPv4

Re: One bad apple can spoil your IPv6 privacy (2022)

#14

Post by bb88 »

kstrauser wrote: post #8
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks.

RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)

Re: One bad apple can spoil your IPv6 privacy (2022)

#15

Post by bb88 »

dmitrygr wrote: post #13
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> Going even further, NAT Yup, and having lost any and all reasons to use IPv6, go back to what has already been working just fine: IPv4

CG-NAT really isn't great.

Re: One bad apple can spoil your IPv6 privacy (2022)

#16

Post by rescbr »

phh wrote: post #9

So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they…

My ISP assign changes the IPv4 /32 and IPv6 prefix every PPPoE authentication. This is so annoying and breaks routing every couple days or so that I ended up running NPT (NAT for IPv6) and using a ULA block for my LAN.

I've seen reports saying you can request a specific prefix as hints to Prefix Delegation and it keeps it mostly static but it is not guaranteed.

Re: One bad apple can spoil your IPv6 privacy (2022)

#17

Post by kstrauser »

bb88 wrote: post #14
kstrauser wrote: post #8

Earlier quoted context omitted.

Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

NAT is broken by design. And CG-NAT can't do any kind of port forwarding on the routers. And adding more NAT is just breaking more networks. RFC 4941 is currently old enough to be taking it's SAT's and preparing itself for college... :)

I’m thrilled to have good end-to-end connectivity to the degree I’m willing to configure my firewall for it.

When I hear people in other threads talking about the “security advantages” of NAT, I imagine someone filling their car’s engine with walnuts and talking about how it protects them from speeding tickets.

Re: One bad apple can spoil your IPv6 privacy (2022)

#18

Post by craftkiller »

szszrk wrote: post #5
adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.

Nothing is preventing you from doing NAT in IPv6. There is the Unique Local Address[0] range which is analogous to the RFC-1918 addresses from IPv4. That being said, there are very few reasons to do this in IPv6 (the only that comes to my mind is running virtual machines on a laptop connected via wifi).

[0] https://en.wikipedia.org/wiki/Unique_local_address

Re: One bad apple can spoil your IPv6 privacy (2022)

#19

Post by JohnFen »

adriancr wrote: post #4

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

> NAT and hide all these devices behind a single external IP.

If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic.

For those who are excited about IPv6, I hear you and your use cases are legit. I just don't share them and want the most restrictive network setup that I can tolerate.

Re: One bad apple can spoil your IPv6 privacy (2022)

#20

Post by ibcj »

kstrauser wrote: post #11
paul_funyun wrote: post #6

Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.

And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe dri…

While I had an "ST412 reference" on my bingo card yesterday morning, sadly I do not have it today. Opportunity lost.
Post reply on HN