31 ms·
Giving every IPv6 address a name
- robbya 7y agoThis is cool, but keep in mind that the operator can also get SSL certs for your site (they just point the domain somewhere else and use Lets Encrypt or similar to get a certificate). So from a security perspective, you are putting a ton of trust if you use this for anything real.
- anaphor 7y agoI don't think they even need to point the A record somewhere else. They can just create a TXT record and some CAs will allow you to validate it that way, if I'm not mistaken.
- joosters 7y agoPresumably they could just get a wildcard certificate for *.has-a.name perfectly legitimately and then they can mimic every IPv6 has-a.name site they want.
- milankragujevic 7y agoNot without the ability to add a TXT record to the root domain.
- joosters 7y agoWhich root domain? If they own has-a.name then that is good enough, right?
- LeonM 7y agoNo, they'd have to get a cert for your domain name. Which they can't, because they cannot prove they own your domain name. All they are doing if pointing to your IPv6 address, anyone can do that, that is why DNS TXT validation if needed in the first place.
- MrOxiMoron 7y agowhatever.has-a.name is the domain name they are suggesting you use, if you had your own you wouldn't need their service. So yes, you are basically giving them control that way. But for simple solution to temporarily get SSL to work on your container during development it's fine. But in that case a self signed certificate works too.
- LeonM 7y agoI haven't looked at it from that angle yet, but you are right: If you share the whatever.has-a.name address with other people and tell them to trust it, then this is very dangerous. However, the OP wrote this: > but keep in mind that the operator can also get SSL certs for your site Which made it sound as if they can get a cert for your domain, which they cannot.
- yzmtf2008 7y ago> Which made it sound as if they can get a cert for your domain, which they cannot. Why? They own and operate the DNS server for has-a.name, so (if they wish to) they can just add any record that they wish, to any domain, right? Of course this is true for any registrar, but that's also why not anyone can just become a registrar.
- ownagefool 7y agoObviously if you can sign a cert which is trusted by browsers, then you technically have the ability to impersonate anyone, but processes are used to fight against this. PSL (https://publicsuffix.org/ https://publicsuffix.org/), DNS Certification Authority Authorization , and Certificate Transparency could be combined so browsers are allowed to know who can sign what, who's a registrar, and who's doing what.
- yzmtf2008 7y agoPSL protects the other way around: it can only prevent whatever.has-a.name to compromise has-a.name or another.has-a.name DNS Certification Authority Authorization assumes trust of the DNS server. Doesn't work if the DNS server itself is compromised / malicious. (Maybe with DNSSEC, but DNSSEC has its own problems and definitely doesn't work when your TLD itself is compromised.) CT is really the only thing that works in this scenario (attackers/third party gaining write access to DNS records), but not every CA has CT and not everyone has the means to monitor CT logs. CT isn't even required for every browser/certificate (only EV certs (dead) for Chrome, and you need HPKP (dead) or Expect-CT (no browser support) for this to work reliably). Plus, what are you supposed to do when you find out there's a bad cert for your domain out there? Yell at someone on Twitter? It's going to be hard to convince a CA that you're not doing business with that someone with write access to DNS does not own the domain. Attackers are already impersonating you while it takes hours to sort things out. ... all of this is not to say that these security measures are bad, just not enough. We really put more trust on DNS servers than we ought to.
- milankragujevic 7y agoCan all the nice people who have downvoted explain what I said wrong?
- LeonM 7y agoAs far as I understand, all they are doing is resolving the ipv6 address in the domain name to an AAAA record that matches the IP address in the name. The domain name will still be 'has-a.name', so I don't understand how the certificate part is supposed to work. If anything you'd have to get their TLS cert for this to work, not the other way around.
- takeda 7y agoMaybe that's restriction for LetsEncrypt (I haven't used it myself) but certificates aren't restricted to 2nd level.
- LeonM 7y agoNo, this is nothing specific for Lets Encrypt, this is how PKI works. A certificate is for a domain name, not an IP address. Anyone can point a (sub)domain that they own to an IP address that they do not own. And then get a valid certificate for that domain. I can point an A record to [your-ip].[my-domain] and I will be able to get a valid cert for that address. However, the address in your address bar will still point to [my-domain], not yours.
- shawnz 7y agoYou can get a certificate for an IP address, but LetsEncrypt doesn't support it. So this might be somewhat specific for LetsEncrypt.
- djsumdog 7y agoI think the implication is if there is a security breech at their end, someone could hijack the service to point IPv6 addresses to somewhere unexpected. If it's only used in development, it's not too big a deal, but could still be use to compromise things.
- gregmac 7y agoAlso don't use for anything real, because you should not be teaching users that https://1234-5678-9adc-def0-1234-5678-9abc-def0.has-a.name https://1234-5678-9adc-def0-1234-5678-9abc-def0.has-a.name is the proper, trusted domain for your service. Because it was supposed to be https://1234-5678-9abc-def0-1234-5678-9abc-def0.has-a.name https://1234-5678-9abc-def0-1234-5678-9abc-def0.has-a.name and I just tricked you.
- numlock86 7y agoI actually had to look three times before I spotted it. Good one!
- Natfan 7y agoIn case anyone wants to know the difference it's that the third "section" on the first URL is "9adc" and the third "section" on the second URL is "9abc".
- TallGuyShort 7y agoI had to diff it! Even if there was no difference, the time it would've taken to be sure really illustrates the problem.
- treysis 7y agoSame/similar working mechanism is built-in into Windows since Vista: 1234-5678--abcd.ipv6-literal.net This doesn't even need functioning DNS and can work offline (add s<devnumber> for link-local addresses).
- jandrese 7y agoThe fundamental problem with this whole scheme is that it is still just trying to memorize the entire IP address. The point of a name is to make it something that feels natural for actual people. Maybe it would make more sense to choose the 65,536 most common English words (or whatever language you want) and break the address up into 8 words to form a crazy looking phrase. This is still difficult to memorize but not as bad as just stuffing 128 bits of hex down your throat. You could even allow for the collapsing 0s by making entry 0 be "and" and adding a bit of logic that does the collapse. For fun I wrote a tiny script that does this and tried it with their example domain: 1234:5678:9abc:def0:1234:5678:9abc:def0 -> balcony gaining pawn toothill balcony gaining pawn toothill Or Google's address from that page: 2a00:1450:4009:811::200e -> chinker bauchle dorter amor and bromidic So maybe this wasn't the best idea, but at least they're a bit more amusing than the hex noise in the article. Anyway, if anybody else wants to play around with it I have a tiny demo: http://jubei.ceyah.org/cgi-bin/ipv6toenglish http://jubei.ceyah.org/cgi-bin/ipv6toenglish
- stkdump 7y agoThe same amount of trust you put into any service managing domain names for you?
- perlgeek 7y agoUsually when you use a service to manage domain names for you, you have a contract with the managing party, which puts your relationship on much firmer legal grounds than when you use a random service provided for free and without legal guarantees.
- lucb1e 7y agoNote that xip.io does this for IPv4
- takeda 7y agothe xip.io is primarily used by private addresses (I hope no one uses it for public ones) there are no real private ipv6 addresses so by using the original service it's risky.
- lolc 7y agoI was sure there is a similar concept in IP6 to the IP4 private ranges. And indeed: Unique local address[0] serves the same purpose. And you can use them with has-a.name: The domain fde4-8dba-82e1-0000-0000-0000-0000-0000.has-a.name is translated to address fde4:8dba:82e1:: just as expected. [0] https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
- takeda 7y agoOh boy, this is dangerous. A lot of things are tied to DNS name, so you're giving a lot of power if you point a routable address to it.
- cortesoft 7y agoNot sure what you mean by "point a routable address to it"... you don't point an address at a domain, you point a domain at an address. And you can point your domain at any address, whether you own it or not.
- takeda 7y agoIt was brain shortcut, I meant point your reverse DNS of a routable IP to that name.
- treysis 7y agoHow is that dangerous? If you don't "own" the IP, you can't add PTR for it.
- takeda 7y agoExactly, but if you own it and add `PTR` to `has-a.name` then in turn you give them power. They can request a new certificate under that name and point that host to another IP. I'm sure there are other ways to abuse it as well.
- nabla9 7y agoWhy you need this? You can get SSL certificates IP addresses Anything that is 'common name'. https://1234:5678:9abc:def0:1234:5678:9abc:def0 https://1234:5678:9abc:def0:1234:5678:9abc:def0. should work just as well as https://1234-5678-9abc-def0-1234-5678-9abc-def0.has-a.name https://1234-5678-9abc-def0-1234-5678-9abc-def0.has-a.name. Right?
- michaelt 7y agoLetsencrypt won't issue certificates to IP addresses - but will to domain names (including those assigned by dynamic DNS providers, but most dynamic DNS providers need manual sign-up with username and password) Of course, has-a.name will be rate-limited to 50 certificate a week by Letsencrypt until they get themselves onto the public suffix list. And whether it's a good idea to bypass LE's no-certs-for-ip-addresses policy is another matter...
- victorheld 7y agoCouldn't they just get a wildcard cert for "*.has-a.name"?
- cortesoft 7y agoAnd give it to everyone?
- VWWHFSfQ 7y agonot sure what you mean by give it to everyone. who are they giving it to?
- RKearney 7y agoAnyone who then wants their site accessible through this. It’s not a proxy, they’re just returning your IPv6 address based on what subdomain you type. In order for a wildcard to work, every single user of the service needs the private key for that wildcard certificate.
- mikeoxbig66 7y agoWhat would the value of this be? Why does it even matter? I am struggling to decide if this is even valuable.
- lolc 7y agoWith this you can refer to a machine in the IP6 space without setting up any DNS yourself. In some situations a hostname works where an IP-Address doesn't. They gave one such example: Getting SSL certs. Clearly it's not a good idea to rely on this for anything serious so the value is mainly convenience during prototyping.
- kej 7y agoIt would be interesting to combine this with something like the PGP word list [0] to get human readable names for an IP address. [0] https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list
- nojvek 7y agoOmg. That is super cool. I want to turn this as a phone interview question. Sounds like fun.
- iamzenitraM 7y agoNice! I had been thinking for a while on building something like this but that provided reverse PTR records, too. Some providers like Tunnelbroker easily allow you to change the delegation for the reverse records for your delegated range: if you have the 1234:5678:9abc:def0::/64 subnet, they let you change the delegation of the *.0.f.e.d.c.b.a.9.8.7.6.5.4.3.2.1.ip6.arpa DNS zone or add records to it as you please. So having a public service that responded to those (following the example, all you would need is the server to respond to 0.f.e.d.c.b.a.9.8.7.6.5.4.3.2.1.0.f.e.d.c.b.a.9.8.7.6.5.4.3.2.1.ip6.arpa with a PTR record to 1234-5678-9abc-def0-1234-5678-9abc-def0.has-a.name) would enable you to also make reverse DNS work for all your network easily, as long as you delegate your reverse zone to that server. Unfortunately probably only Tunnelbroker and hosting providers allow you to do this - I don't expect any residential ISP would (they would also probably provide their own reverse DNS, though).
- outworlder 7y agoThis sounds like a solution looking for a problem. Also, it's dangerous.
- Tho85 7y agoNice! I run a similar service at https://ip6.name/ https://ip6.name/. The service also supports empty groups, e.g. 2001.db8.8000.x.1.ip6.name resolves to 2001:db8:8000::1, as well as 2001.db8.8000.0.0.0.0.1.ip6.name. A neat one is x.ip6.name, which resolves to ::, e.g. localhost...
- sproketboy 7y agoIPV6McIPV6Face
- markushx 7y agoShouldn't this been appropriately named has-aaaa.name?
- kardos 7y agoTLS concerns aside, there appears to be no business model here, so it's not clear how this would become reliable
- cheschire 7y agoAnd from a position of active defense, it’s not clear how this free product monetizes our usage. I’m skeptical.
- treysis 7y agoTheir business seems to lie elsewhere. This appears to be a minor service they offer free of charge to the IPv6-interested community, maybe to promote IPv6 usage.
- telmich 7y agoThere is no business model behind has-a.name. It's main motivation came from our customers, who are using the IPv6VPN quite intensive. Many of our customers are app developers (ruby, python, clojure, you name it) and they develop on their notebooks that are IPv6 enabled (usually a /64 or /48 per device). To be able to share in-development state with other remote developers, the common thing to do would be to pass around a http://[2a0a:e5c0:...] http://[2a0a:e5c0:...] url that was http only. This is not only cumbersome (no one likes to type square brackets), but also potentially risky, as there is no MITM protection whatsoever. To fix this problem we created has-a.name, because customers/developers now go ahead and just create a docker container and share it as https://2a0a-e5c0-...has-a.name https://2a0a-e5c0-...has-a.name with their co-developers. Because our whole company consists of a bunch of Open Source Hackers we decided to make it public to allow others work around the same problem. Even though we promise to never change the automatic resolution (that's work, doesn't make sense to do that for us), you don't have to trust has-a.name. You can register your own domain and replicate our setup and use your domain instead. I hope that clarifies a bit the business model question.
- rexarex 7y agoIs this accomplished by ip6.arpa? https://www.ripe.net/manage-ips-and-asns/db/support/documentation/glossary/ip6.arpa https://www.ripe.net/manage-ips-and-asns/db/support/document...
- anderskaseorg 7y agoNo, ip6.arpa is for reverse DNS; this is forward DNS.
- Olipro 7y agoIf you are able to have the reverse zone for your subnet delegated to nameservers under your control, you can use it as a "forward" zone too. DNS doesn't technically have the concept of forward and reverse - it's just record types and an agreed format that the PTR records should be.
- commandersaki 7y agoThis is all well and good and all. I always see these ingenious developments with IPv6. But we kind of forget that deployment is a nightmare. I think we need forget that we're putting the cart before the horse. I don't see a future for IPv6 while there's no officially endorsed transition plan that has an actual incentive. IPv6 only makes sense for mobile since carriers use it to shed load off CGNAT. In turn this incentivises large traffic sites that cater to mobile (e.g. Youtube, Google, etc.) to also help out by operating over IPv6. The only reason carriers can do this is because they usually have full control to configure the IP stack connecting to the network. Penetrating the residential is a pipe dream. Let's not forget in the early to mid 90s IPv6 was decided on to mitigate the address exhaustion issue. Its use has basically made a scratch. So many other technologies have come and gone and a few paradigm shifts (e.g. cloud everything). And IPv6 continue to sits idle.
- elktea 7y agoMobile networks typically use 464XLAT. Deployment is not hard. The main hold up for resi networks is CPE vendors don't typically support CLAT, but most established players can do dual stack for now. IPv6 is at about 30% of traffic now.
- commandersaki 7y agoYep, any day now.
- stevage 7y agoOh, I was hoping this was going to be like the What 3 Words of IP addresses. Like "fourteen-mangled-yellow-squirrels.has-a.name".
- Spacemolte 7y agoWhat is a IPv6 application?
- badrabbit 7y agoCurious why the rfc didn't choose base64 as the representation format. It won't change what it looks like on the wire but will result in shorter addresses that can in part have some meaning. Matter of fact has there even been such a proposal. I naively think '2001:ALN:LabNet01::' or somethig of the like is not only better but displaces some of the need to use dns (at least in a lan). I am so curious about this, I hope someone more knowledgeable can explain.
- netsec_burn 7y agoOr base58
- jachee 7y agoMeanwhile, we're still waiting for VZ to put Fios on IPv6...
- fulafel 7y agoThis is nice: > With has-a.name you can now also use SSL certificates on any IPv6 address. Even better: any docker container can now have an official, valid certificate!
- peter_retief 7y agoMy ISP doesn't seem to support ipv6 If I check on https://test-ipv6.com/ https://test-ipv6.com/ I geta bunch of blue dot warnings. Like: "You appear to be able to browse the IPv4 Internet only. You will not be able to reach IPv6-only sites." Is this common or is my ISP behind the times and could this become a problem? I have done some development with CoAP and ipv6 so it has been an issue for me. On the name issue I think its a great idea, even if its a name that resolves to native ipv6 addresses it would be very useful to me
- treysis 7y agoYes, it seems like it is behind the times. It doesn't matter much at the moment, as there are no real IPv6-only services of relevance (unless you need to connect to the private IPv6-only NAS of a friend or sth like that).