3 ms·

I'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fi

I'm surprised security and privacy weren't mentioned. In the current state of affairs (no, I'm not talking about some ideal utopia with IPv6 perfection where fifty quintillion additional RFCs have been finally deployed and battle-tested world-wide; I'm talking about IPv6 as available to the ordinary user /today/) I simply do not trust using IPv6 to provide as much security or privacy as IPv4. More than happy to change my mind when (...if?) the technology moves forward 10 years from now, but I just can't see it working right now. Sorry.

ge0rg 8y ago
It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?
- mehrdadn 8y ago
  The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...
  - detaro 8y ago
    Because it has a trivial IPv6 equivalent in the form of a basic stateful firewall?
    - mehrdadn 8y ago
      And you're also claiming every single router I'm going to encounter today has already set up IPv6 correctly as needed to mirror the security and privacy characteristics of IPv4 like this?
      - detaro 8y ago
        Pretty much, yes. Other security issues with random routers appear to be way more common.
        mehrdadn 8y ago
        EDIT: My mistake, see comment below.
        detaro 8y ago
        Interesting. Name and shame a few brands/models? That stuff needs to be widely warned about.
        mehrdadn 8y ago
        You know, I really have to apologize, because it seems I missed a critical detail that changed the entire story. Thanks to both of you for making me go double-check. What happened was I vividly recalled seeing "stateless" as the default option for the router I had in mind over a year ago. Which was indeed correct. However, in response to the other comment I went back and checked again, and just noticed that "stateless" was in fact under the NAT page, not the firewall. The IPv6 firewall page is rather hidden so it's something I forget about completely, as I don't use IPv6. Looking there, the firewall page indeed does say it blocks unrelated input traffic by default. This wasn't the entire story though, because I could also remember that ip6tables -L was empty when I checked it. I now see, though, that this must have been because when I had done this check, IPv6 was turned off, and that made the router purge all the rules. I had always assumed it was never setting them up in the first place. Frankly as of right now I can't really verify what actually happens because I don't immediately get an IPv6 address when I enable it. I trust it does what you say. That said, I'm still not sure how I could rely on this fact being true everywhere. With IPv4 it's pretty much a given that you will hit a NAT due to the lack of enough IPv4 addresses, but with IPv6 they could easily assign you an IP address, so what guarantee is there that the router has things set up this way? It still seems like a risk vs. no-risk, with the same resulting decision.
  - zAy0LfpBZLC8mAC 8y ago
    > Which reduces the attack surface immensely. No, it doesn't. The "attack surface" is a IP stack that looks in some hash tables whether there is anyone listening on the port, and then rejects the connection. Vs. a huge browser with a javascript interpreter and JIT and what have you that is accessible regardless of NAT or firewalls or whatever else you do on the network level. The fear of inbound connections is completely irrational.
neojima 8y ago
As others have said, most major operating systems implemented RFC4941 (IPv6 Privacy Extensions) years ago. Unless you're using unmaintained OSes (in which case you shouldn't be complaining about security), what privacy implications are you calling out?

ge0rg 8y ago

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

mehrdadn 8y ago
The one you excluded (why?) is a pretty darn big one. It means for example that a random hacker would have a hell of a hard time spontaneously reaching my phone via the cellular data connection... or the WiFi connection for that matter, since that's NAT'ed too. Which reduces the attack surface immensely. I don't see why even this by itself would be insufficient reason...
- detaro 8y ago
  Because it has a trivial IPv6 equivalent in the form of a basic stateful firewall?
  - mehrdadn 8y ago
    And you're also claiming every single router I'm going to encounter today has already set up IPv6 correctly as needed to mirror the security and privacy characteristics of IPv4 like this?
    - detaro 8y ago
      Pretty much, yes. Other security issues with random routers appear to be way more common.
      - mehrdadn 8y ago
        EDIT: My mistake, see comment below.
        detaro 8y ago
        Interesting. Name and shame a few brands/models? That stuff needs to be widely warned about.
        mehrdadn 8y ago
        You know, I really have to apologize, because it seems I missed a critical detail that changed the entire story. Thanks to both of you for making me go double-check. What happened was I vividly recalled seeing "stateless" as the default option for the router I had in mind over a year ago. Which was indeed correct. However, in response to the other comment I went back and checked again, and just noticed that "stateless" was in fact under the NAT page, not the firewall. The IPv6 firewall page is rather hidden so it's something I forget about completely, as I don't use IPv6. Looking there, the firewall page indeed does say it blocks unrelated input traffic by default. This wasn't the entire story though, because I could also remember that ip6tables -L was empty when I checked it. I now see, though, that this must have been because when I had done this check, IPv6 was turned off, and that made the router purge all the rules. I had always assumed it was never setting them up in the first place. Frankly as of right now I can't really verify what actually happens because I don't immediately get an IPv6 address when I enable it. I trust it does what you say. That said, I'm still not sure how I could rely on this fact being true everywhere. With IPv4 it's pretty much a given that you will hit a NAT due to the lack of enough IPv4 addresses, but with IPv6 they could easily assign you an IP address, so what guarantee is there that the router has things set up this way? It still seems like a risk vs. no-risk, with the same resulting decision.
- zAy0LfpBZLC8mAC 8y ago
  > Which reduces the attack surface immensely. No, it doesn't. The "attack surface" is a IP stack that looks in some hash tables whether there is anyone listening on the port, and then rejects the connection. Vs. a huge browser with a javascript interpreter and JIT and what have you that is accessible regardless of NAT or firewalls or whatever else you do on the network level. The fear of inbound connections is completely irrational.

neojima 8y ago

As others have said, most major operating systems implemented RFC4941 (IPv6 Privacy Extensions) years ago. Unless you're using unmaintained OSes (in which case you shouldn't be complaining about security), what privacy implications are you calling out?