Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One bad apple can spoil your IPv6 privacy (2022)

arxiv.org

Post reply on HN
Print view View original

31–40 of 64 posts

Re: One bad apple can spoil your IPv6 privacy (2022)

#31

Post by JohnFen »

Arnavion wrote: post #29
JohnFen wrote: post #26

Earlier quoted context omitted.

What misunderstanding? I am familiar with what you wrote, and am not disagreeing. There is nuance here that seems to get lost whenever this topic comes up.

The misunderstanding that "I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic." is something that happens with v4 and not with v6, or that it has anything at all to do with NAT.

I wasn't suffering under that misunderstanding. I was just saying what my personal preference is for managing such a setup.

Re: One bad apple can spoil your IPv6 privacy (2022)

#32

Post by JohnFen »

kstrauser wrote: post #28
JohnFen wrote: post #24

Earlier quoted context omitted.

> NAT is not a security feature and never has been. True, and I don't think of it as such -- after all, NAT or not, it's my firewall doing the protecting. What NAT would buy me here is convenience, not security. I could have the same level of security without NAT, but managing it properly is easier and less error-prone with it.

Having managed both, it is absolutely, 100%, not easier to manage NAT than a firewall. For example, here's a valid OpenBSD pf configuration: pass out on $ext_if from any to any That's it. That's the entire stateful firewall config: Don't allow anything inbound at all, except directly in response to an outbound connection. If your firewall has a GUI, it'll be as easy to configure that as it is the NAT. If your firewal…

Well, it's not quite that simple given my LAN's topology -- but you're right that it isn't incredibly complicated. I just prefer to manage it a different way. The end result is the same, so I'm not sure what the issue is here.

Re: One bad apple can spoil your IPv6 privacy (2022)

#33

Post by JohnFen »

kstrauser wrote: post #30
JohnFen wrote: post #27

Earlier quoted context omitted.

I never said a thing about not using a firewall. My firewall is what protects my LAN, after all.

Then you’re not getting any extra protection from a NAT.

True! I wasn't claiming that I was. What I am claiming is that doing it this way is more convenient for me.

Since IPv6 doesn't give any benefits that matter to me, the only reason I'd do it is to maintain the ability to talk to my ISP. So my goal would be to make the transition as quick and easy for me as possible.

Re: One bad apple can spoil your IPv6 privacy (2022)

#35

Post by crest »

paul_funyun wrote: post #6

Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.

I suspect you haven't read the errata sheets for any modern EFI or even worse BMC? There is so much buggy crap in there that users are likely to run into that patching your firmware is a good idea just for stability and performance before you even consider integrity and privacy.

Re: One bad apple can spoil your IPv6 privacy (2022)

#37

Post by jeroenhd »

kstrauser wrote: post #25
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large. While it's hypothetically possible to have NAT without a firewall, I've never personally touched or seen such a thing. I can confidently state that if you have NAT, you also have a firewall. Use it.

Because of NAT ALGs, most consumer NAT devices actually allow plaintext protocols to bypass the internet-facing firewalls inside routers.

Unless you program your own ALGs, you basically get to pick between "SIP, FTP, and a bunch of other protocols don't work without port forwards" or "your public firewall is off for almost anyone who can make your computer load an ad".

NAT breaks internet protocols and as a result we got firewall-evading workarounds.

Re: One bad apple can spoil your IPv6 privacy (2022)

#38

Post by kiririn »

noinsight wrote: post #21
JohnFen wrote: post #19

Earlier quoted context omitted.

> NAT and hide all these devices behind a single external IP. If/when I'm forced to shift my LAN to IPv6, this is the approach I'll take. I don't want any random machines behind my router to be able to open ports to the internet at large. I want a single point of presence that handles that and forwards to whichever machine I want to handle that traffic. For those who are excited about IPv6, I hear you and your use ca…

> I don't want any random machines behind my router to be able to open ports to the internet at large. The solution to this is a firewall, not NAT. As has always been. NAT is not a security feature and never has been. The fact that it blocks uninitiated inbound connectivity is an implementation detail, not its purpose.

Firewalls don’t fail safe, NAT does.

With a disabled/broken/misconfigured firewall, there is a good chance that everything works sans security. With a disabled/broken/misconfigured NAT, you may as well have unplugged the ethernet cable

Re: One bad apple can spoil your IPv6 privacy (2022)

#39

Post by jeroenhd »

phh wrote: post #9

So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they…

ISPs charging extra for a static IP seem to rotate IPv6 prefixes. It's just a scam to squeeze a little bit of extra money out of their customers.
Post reply on HN