4 ms·

> IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. That's not really true. By its nature, stateful/dynamic NAT, which is wh

by nly 11y ago

> IPv6 doesn't take away your stateful firewall, and NAT isn't providing ANY security. That's not really true. By its nature, stateful/dynamic NAT, which is what the majority of the consumer world is using, means internal services aren't exposed to the Internet. Short of layer 7 stateful packet inspection, or some other IDSy type thing, a consumer-focused 'firewall' isn't going to do any better... they have to be generic and fuss-free. Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact.

voltagex_ 11y ago
What I haven't seen in a home router is proper egress filtering. The use of NAT you're talking about just seems like a really blunt version of that. I think a router with a smartphone based controller could work well - push notifications when your TV wants to connect to the net for the first time or a friend has dropped by and wants to log on to your guest wifi
voltagex_ 11y ago
Except that on a consumer grade router, UPNP is probably turned on with no authentication. Anything that wants to get out, will.
- nly 11y ago
  What's the alternative? Consumers want something they plug in, turn on, and forget about.
  - mindslight 11y ago
    The alternative is an easy-to-use router summary page that list every network device and controls what it can contact (eg local-only, manufacturer, wide Internet). Consumers want things that "just work" because they haven't been shown that they can have control. It's really a matter of selling the value proposition of such administration, and making these devices' communications patterns legible to the average consumer.
    - ryandrake 11y ago
      > "... router summary page ..." You've lost probably 95% of the mass-market: users who visit their router's setup page either zero times or one time throughout the devices' stay in their home. Users do not want a list of devices or controls or toggles, or text fields to fill in IP addresses. They want to buy their plastic internet box, plug it in, and go download cat videos. You can try to communicate value proposition until you're blue in the face. People want to plug it in and get on with their lives. Trying to convince users of the value of "administering a computer" is fighting a losing battle.
      - voltagex_ 11y ago
        That's why I think a smartphone app with well calibrated alerts would help. People learn pretty quickly how to administer a router when Xbox Live doesn't work properly.
        mindslight 11y ago
        Exactly. It's not so much that people can't figure out tech, it's that they only do so if necessary to accomplish their immediate task, regardless of possible repercussions down the line.
      - mindslight 11y ago
        If a user is really that uninvested in their digital life, then why bother thinking about them? After all, nothing can be done. I heartily disagree with this defeatist figure of "95%" though, and feel it reflects tech feelings of inferiority more than the actual ability and desires of people using technology. Most people will apply their brain to overcome straightforward problems and most people seem to be concerned about security. Of course this concern comes from mass-media scaremongering, which also misleads them into thinking that centralized entities will protect them. But it still means there's a demand, and the concern-actualization gap should be able to be bridged with sufficiently-accessible administration. If plugging in a device makes it just work, then a user is likely to forget the step of modifying the ACL. But if going to the router page is a required part of setting up any new device (because they have previously chosen this mode when setting up the router), then it will just become part of their workflow, the same as entering SSID/passphrase.
simoncion 11y ago
> Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact. NAT has had the same _security_ impact that a default REJECT ingress firewall policy would have. (Coincidentally, this is the default firewall policy for non-Enterprise Windows Firewall configurations.) If you combine default REJECT with a port opening protocol like uPnP, you have a really nice, reasonably secure, self-maintaining border firewall. (Hyperventilation about security issues with particular implementations of uPnP notwithstanding.)
- nly 11y ago
  I'm not saying we need NAT, just that without prior need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. It's a lot easier just to block ingress to the whole house than it is to ensure a dozen devices are secure against unwanted incoming connections... this problem will present itself with the IoT sooner or later.
  - simoncion 11y ago
    > ...just that without the need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. I disagree. Defaults are a powerful thing. If one's router ships with a default REJECT ingress firewall, a non-technical user is not likely to change it.

by nly 11y ago

voltagex_ 11y ago

What I haven't seen in a home router is proper egress filtering. The use of NAT you're talking about just seems like a really blunt version of that. I think a router with a smartphone based controller could work well - push notifications when your TV wants to connect to the net for the first time or a friend has dropped by and wants to log on to your guest wifi

voltagex_ 11y ago

Except that on a consumer grade router, UPNP is probably turned on with no authentication. Anything that wants to get out, will.

nly 11y ago
What's the alternative? Consumers want something they plug in, turn on, and forget about.
- mindslight 11y ago
  The alternative is an easy-to-use router summary page that list every network device and controls what it can contact (eg local-only, manufacturer, wide Internet). Consumers want things that "just work" because they haven't been shown that they can have control. It's really a matter of selling the value proposition of such administration, and making these devices' communications patterns legible to the average consumer.
  - ryandrake 11y ago
    > "... router summary page ..." You've lost probably 95% of the mass-market: users who visit their router's setup page either zero times or one time throughout the devices' stay in their home. Users do not want a list of devices or controls or toggles, or text fields to fill in IP addresses. They want to buy their plastic internet box, plug it in, and go download cat videos. You can try to communicate value proposition until you're blue in the face. People want to plug it in and get on with their lives. Trying to convince users of the value of "administering a computer" is fighting a losing battle.
    - voltagex_ 11y ago
      That's why I think a smartphone app with well calibrated alerts would help. People learn pretty quickly how to administer a router when Xbox Live doesn't work properly.
      - mindslight 11y ago
        Exactly. It's not so much that people can't figure out tech, it's that they only do so if necessary to accomplish their immediate task, regardless of possible repercussions down the line.
    - mindslight 11y ago
      If a user is really that uninvested in their digital life, then why bother thinking about them? After all, nothing can be done. I heartily disagree with this defeatist figure of "95%" though, and feel it reflects tech feelings of inferiority more than the actual ability and desires of people using technology. Most people will apply their brain to overcome straightforward problems and most people seem to be concerned about security. Of course this concern comes from mass-media scaremongering, which also misleads them into thinking that centralized entities will protect them. But it still means there's a demand, and the concern-actualization gap should be able to be bridged with sufficiently-accessible administration. If plugging in a device makes it just work, then a user is likely to forget the step of modifying the ACL. But if going to the router page is a required part of setting up any new device (because they have previously chosen this mode when setting up the router), then it will just become part of their workflow, the same as entering SSID/passphrase.

simoncion 11y ago

> Just go back to the early 00s or mid-90s to see the ramifications that exposing ports from Windows machines to the Internet had, then tell me NAT hasn't had a positive security impact. NAT has had the same _security_ impact that a default REJECT ingress firewall policy would have. (Coincidentally, this is the default firewall policy for non-Enterprise Windows Firewall configurations.) If you combine default REJECT with a port opening protocol like uPnP, you have a really nice, reasonably secure, self-maintaining border firewall. (Hyperventilation about security issues with particular implementations of uPnP notwithstanding.)

nly 11y ago
I'm not saying we need NAT, just that without prior need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. It's a lot easier just to block ingress to the whole house than it is to ensure a dozen devices are secure against unwanted incoming connections... this problem will present itself with the IoT sooner or later.
- simoncion 11y ago
  > ...just that without the need for NAT, perpetuated by ISPs only giving us one IP, I doubt anybody would have any ingress filtering at the border. I disagree. Defaults are a powerful thing. If one's router ships with a default REJECT ingress firewall, a non-technical user is not likely to change it.