Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA CSI IPv6 Security Guidance (2023) [pdf]

media.defense.gov

Post reply on HN
Print view View original

51–57 of 57 posts

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#51

Post by jiggawatts »

yonz wrote: post #45
Symbiote wrote: post #43

Earlier quoted context omitted.

> Might have learned something today Yet you continue to speculate about it and spread baseless FUD. Consumer ISPs supporting IPv6 provide routers blocking inbound access by default. The interface to open IPv6 ports is usually labelled "IPv6 Pinholes" or similar, and you'll find hundreds of web pages on ISP websites describing the functionality -- just as they have pages on IPv4 port forwarding. The extraordinary cla…

> extraordinary claim that ISPs are supplying routers with such a dangerous default configuration requires evidence Its a legitimate expectation and potentially the norm to expect that I can ssh to my desktop with IPv6 w/o configuring my router. The pitfall comes as a side effect of NAT inadvertently making port access rare. I am looking for data, inbound blocked ipv6 seems unlikely but I only have anecdotal evidence…

That's not even an anecdote. You are literally just assuming something is true, then arguing vocally with people giving you evidence to the contrary.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#52

Post by kccqzy »

yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

Having a globally unique address does not imply having no firewalls.

This paragraph from RFC7934 really sums it up much better than I can:

> Indeed, it could be argued that the main reason for deploying IPv6, instead of continuing to scale the Internet using only IPv4 and large-scale NAT44, is because doing so can provide all the hosts on the planet with end-to-end connectivity that is constrained not by accidental technical limitations, but only by intentional security policies.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#53

Post by throw0101c »

aaronax wrote: post #47
simoncion wrote: post #34

From the recommendations document: > The assigned IPv6 address incorporates media access control (MAC) address information from the network interface and may allow for host identification via interface ID, network interface card, or host vendor. How long has it been since NSA has looked at generally-available OSs with IPv6 support? IPv6 "Privacy Addresses" are a thing that's on-by-default everywhere (and a damn thorn…

Debian 11 VMs that I was setting up last week were getting non-privacy SLAAC addresses. So I am skeptical of how common it is to default to privacy addresses.

Strange:

> A solution to this are IPv6 privacy extensions (which Debian enables by default if IPv6 connectivity is detected during initial installation), which will assign an additional randomly generated address to the interface, periodically change them and prefer them for outgoing connections. Incoming connections can still use the address generated by SLAAC.

* https://debian-handbook.info/browse/stable/sect.ipv6.html

* https://manpages.debian.org/bullseye/ifupdown/interfaces.5.e...

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#54

Post by jeroenhd »

wmf wrote: post #37
jeroenhd wrote: post #33

Earlier quoted context omitted.

> A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure. I doubt it. Your load balancers will be the only addresses that will be addressable anyway. Your IPv4 load balancers will also be "leaking" IP addresses.

You're thinking of the server side, not clients.

Clients that aren't misconfigured will use random IPv6 addresses that rotate. The usual default is once per day but that's a mere preference, you can make your computer take a new IP every minute if you want.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#55

Post by wmf »

jeroenhd wrote: post #54
wmf wrote: post #37

Earlier quoted context omitted.

You're thinking of the server side, not clients.

Clients that aren't misconfigured will use random IPv6 addresses that rotate. The usual default is once per day but that's a mere preference, you can make your computer take a new IP every minute if you want.

You can still see subnets though which was the original point.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#56

Post by jeroenhd »

wmf wrote: post #55
jeroenhd wrote: post #54

Earlier quoted context omitted.

Clients that aren't misconfigured will use random IPv6 addresses that rotate. The usual default is once per day but that's a mere preference, you can make your computer take a new IP every minute if you want.

You can still see subnets though which was the original point.

With many ISPs handing out /64s and others handing out /48s and /56s to households, it's difficult to tell a subnet from another IP.

Even still, this information is pretty useless. So what if you know my current subnet is 3a80? That won't help you get past the firewall.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#57

Post by simoncion »

throw0101c wrote: post #53
aaronax wrote: post #47

Earlier quoted context omitted.

Debian 11 VMs that I was setting up last week were getting non-privacy SLAAC addresses. So I am skeptical of how common it is to default to privacy addresses.

Strange: > A solution to this are IPv6 privacy extensions (which Debian enables by default if IPv6 connectivity is detected during initial installation), which will assign an additional randomly generated address to the interface, periodically change them and prefer them for outgoing connections. Incoming connections can still use the address generated by SLAAC. * https://debian-handbook.info/browse/stable/sect.ipv6.…

Yeah. I've run several major Linux distros, Windows 10 and 7, and several major versions of OSX. All had "privacy addresses" on by default, which is annoying as shit.
Post reply on HN