3 ms·

An inbound firewall for all traffic has exactly the same security level as NAT. There's a very small argument for privacy but (a) we have privacy addresses and

An inbound firewall for all traffic has exactly the same security level as NAT. There's a very small argument for privacy but (a) we have privacy addresses and (b) even behind NAT many of your devices are probably already identifiable in many other fingerprinted ways that obscuring the address for this sake would be pointless

emmelaich 7y ago
I wouldn't say _exactly_ the same security level. https://samy.pl/pwnat/ https://samy.pl/pwnat/ > pwnat, pronounced "poe-nat", is a tool that allows any number of clients behind NATs to communicate with a server behind a separate NAT with no port forwarding no DMZ setup, and no 3rd party involvement. The server does not need to know anything about the clients trying to connect.
mindslight 7y ago
> exactly the same security level as NAT. > There's a very small argument for privacy You can't say it has the "same security", while also saying there is a "small" difference. Privacy is an integral part of security, especially for natural persons. > we have privacy addresses AFAIK "privacy extensions" merely pick a random host address rather than naively using the ethernet MAC (!!). This still allows identifying discrete hosts. The NAT scheme I described is strictly better than this. So yes, I can envision an IPv6 future where we have convenient global addresses for incoming traffic, but outgoing traffic gets NATted to a single address (single probability distribution, really). It's just not going to be a return to the trustful 1970's air-out-your-genitals simplicity that is widely envisioned. > behind NAT many of your devices are probably already identifiable in many other fingerprinted ways that obscuring the address for this sake would be pointless Those other ways are also security vulnerabilities. We shouldn't excuse vulnerabilities because other vulnerabilities exist, especially in the direction of the foundation. While it is appropriate for a higher protocol to simply accept a weakness of a lower layer that it is built on, going the other way is unjustifiably throwing in the towel.
gruez 7y ago
>(a) we have privacy addresses and AFAIK those get rotated every day or so. While this is better than fixed addresses, it's still worse than NAT, especially if you use some sort of tool obscure your sessions (eg. container tabs or private browsing). >(b) even behind NAT many of your devices are probably already identifiable in many other fingerprinted ways that obscuring the address for this sake would be pointless That sounds exactly like Google's excuse not to implement fingerprinting hardening on Chrome[1]. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075 https://bugs.chromium.org/p/chromium/issues/detail?id=49075
cesarb 7y ago
> An inbound firewall for all traffic has exactly the same security level as NAT. I've seen at another of these discussions an argument that an inbound firewall is actually stronger. Suppose you have a NAT router with 192.168.1.0/24 as its "inside" network, and 203.0.113.0/24 as its "outside" network, doing NAT between them. Now suppose another host at the 203.0.113.0/24 network sends a packet to this router, with a destination address within the 192.168.1.0/24 network. A router which only does NAT would accept and deliver this packet, while a router with a correctly configured firewall would reject it.

emmelaich 7y ago

I wouldn't say _exactly_ the same security level. https://samy.pl/pwnat/ https://samy.pl/pwnat/ > pwnat, pronounced "poe-nat", is a tool that allows any number of clients behind NATs to communicate with a server behind a separate NAT with no port forwarding no DMZ setup, and no 3rd party involvement. The server does not need to know anything about the clients trying to connect.

mindslight 7y ago

> exactly the same security level as NAT. > There's a very small argument for privacy You can't say it has the "same security", while also saying there is a "small" difference. Privacy is an integral part of security, especially for natural persons. > we have privacy addresses AFAIK "privacy extensions" merely pick a random host address rather than naively using the ethernet MAC (!!). This still allows identifying discrete hosts. The NAT scheme I described is strictly better than this. So yes, I can envision an IPv6 future where we have convenient global addresses for incoming traffic, but outgoing traffic gets NATted to a single address (single probability distribution, really). It's just not going to be a return to the trustful 1970's air-out-your-genitals simplicity that is widely envisioned. > behind NAT many of your devices are probably already identifiable in many other fingerprinted ways that obscuring the address for this sake would be pointless Those other ways are also security vulnerabilities. We shouldn't excuse vulnerabilities because other vulnerabilities exist, especially in the direction of the foundation. While it is appropriate for a higher protocol to simply accept a weakness of a lower layer that it is built on, going the other way is unjustifiably throwing in the towel.

gruez 7y ago

>(a) we have privacy addresses and AFAIK those get rotated every day or so. While this is better than fixed addresses, it's still worse than NAT, especially if you use some sort of tool obscure your sessions (eg. container tabs or private browsing). >(b) even behind NAT many of your devices are probably already identifiable in many other fingerprinted ways that obscuring the address for this sake would be pointless That sounds exactly like Google's excuse not to implement fingerprinting hardening on Chrome[1]. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=49075 https://bugs.chromium.org/p/chromium/issues/detail?id=49075

cesarb 7y ago

> An inbound firewall for all traffic has exactly the same security level as NAT. I've seen at another of these discussions an argument that an inbound firewall is actually stronger. Suppose you have a NAT router with 192.168.1.0/24 as its "inside" network, and 203.0.113.0/24 as its "outside" network, doing NAT between them. Now suppose another host at the 203.0.113.0/24 network sends a packet to this router, with a destination address within the 192.168.1.0/24 network. A router which only does NAT would accept and deliver this packet, while a router with a correctly configured firewall would reject it.