4 ms·

Can this be solved by using IPv6 and addressing everything publicly?

asadlionpk 8y ago
Won't be fun if there is a vulnerability.
Skunkleton 8y ago
Probably not: 1. NAT provides a basic level of security for your network. The same could be achieved with a firewall, but it isnt the norm. 2. Even without nat, there would still have to be _some_ computer that does the processing on the raw data from the IoT device. There is no reason that couldnt be your PC or Phone, but the precedent has been set that these tasks are performed on a managed device in the "cloud". 3. The companies involved will make less money. A better solution would be to have an IoT gateway device publicly accessible that proxies access to the individual IoT devices. This would create a better security story. If this device were standards based, then each IoT vendor could integrate with it, and router vendors could add the capability to their devices. Of course there is no financial incentive for things to work this way. I guess I only bring up NAT because it is yet another example of the "server" lie. There is no such thing as a computer that is a "server". Programs act as servers. Computers might be "server-class", but all that means is that they are high quality. Driving a wedge between "servers" and normal PCs just pushes more control out of individual's hands.
- Spivak 8y ago
  1. It would be the norm with an IPv6 gateway. It's not like it takes anything special to replace NAT with a firewall: allow outbound, allow established/related inbound, and replace port forwarding in the UX with allow rules for (host, port). 2. No argument, does seem odd that it wouldn't be the app though. Figure a door bell wouldn't be all that intensive. 3. Yeah, recurring revenue is pretty much the gold standard. A device that stands between your device and the public internet, provides security and access control, and is standards based... so a perimeter firewall? But with an API to allow internal devices to punch their own holes. Ehh don't get me wrong I like the spirit, but that would immediately get used by malware.
MrMorden 8y ago
If you can convince your monopoly ISP to implement IPv6, among other hurdles.

Won't be fun if there is a vulnerability.

Probably not: 1. NAT provides a basic level of security for your network. The same could be achieved with a firewall, but it isnt the norm. 2. Even without nat, there would still have to be _some_ computer that does the processing on the raw data from the IoT device. There is no reason that couldnt be your PC or Phone, but the precedent has been set that these tasks are performed on a managed device in the "cloud". 3. The companies involved will make less money. A better solution would be to have an IoT gateway device publicly accessible that proxies access to the individual IoT devices. This would create a better security story. If this device were standards based, then each IoT vendor could integrate with it, and router vendors could add the capability to their devices. Of course there is no financial incentive for things to work this way. I guess I only bring up NAT because it is yet another example of the "server" lie. There is no such thing as a computer that is a "server". Programs act as servers. Computers might be "server-class", but all that means is that they are high quality. Driving a wedge between "servers" and normal PCs just pushes more control out of individual's hands.

Spivak 8y ago
1. It would be the norm with an IPv6 gateway. It's not like it takes anything special to replace NAT with a firewall: allow outbound, allow established/related inbound, and replace port forwarding in the UX with allow rules for (host, port). 2. No argument, does seem odd that it wouldn't be the app though. Figure a door bell wouldn't be all that intensive. 3. Yeah, recurring revenue is pretty much the gold standard. A device that stands between your device and the public internet, provides security and access control, and is standards based... so a perimeter firewall? But with an API to allow internal devices to punch their own holes. Ehh don't get me wrong I like the spirit, but that would immediately get used by malware.

MrMorden 8y ago

If you can convince your monopoly ISP to implement IPv6, among other hurdles.