5 ms·

Can you explain what privacy you think it offers over IPv6+privacy addresses? As far as I can see it offers that activities behind the NAT get grouped behind o

Can you explain what privacy you think it offers over IPv6+privacy addresses? As far as I can see it offers that activities behind the NAT get grouped behind one IP to the outside world, and I guess harder host discovery. Is there more?

etaioinshrdlu 6y ago
No, I think that's about it. But that is quite significant. It means that an IPv6 address uniquely identifies one computer (albeit temporarily). An IPv4 with NAT does not identify one user, it might be anywhere from 1 to thousands. A possible solution I'd like to see explored is to have each new web browser tab (and every process on your PC more generally) use a unique, fresh public IPv6 address by default. One would only use a semi-static IP if running some type of server.
- saurik 6y ago
  As those unique "fresh" addresses would have to come from some shared routable prefix (which is the core problem with the various IPv6 randomized address solutions), that would still provide strictly worse privacy than NAT: if you happened to be one machine before you are now outing to the world the connection correlations between your tabs, and if you were multiple machines before you are now separating the traffic from the multiple users; meanwhile, no one thinks you are a large number of unrelated addresses (as no one is dumb enough to be tricked by your supposedly-separate addresses that all share the same prefix). FWIW, one can totally implement NAT for IPv6, and in fact people have: everyone should always use NAT. NAT is the correct solution to this problem, whether you are mixing your traffic locally on your own network or are shifting your traffic through remote mixers (which is effectively what Orchid--the open source decentralized privacy network I work on, funded by some major VCs--does, though it frankly isn't there yet with "#privacy" despite having launched a long time ago and being usable today; btw: I haven't finished implementing this yet, but "use a separate circuit for each target host", which I think best achieves your dream of an address per tab, is one of the features I have been intending to have in Orchid for forever ;P). (It makes sense for me to attach this to this comment, but I appreciate I am likely preaching the choir with respect to responding to you ;P.) The downsides people like to whine about for NAT involving peer-to-peer connections and hole punching are either misunderstandings (people often like to claim things don't work that do), are caused by shitty NAT implementations (that ignore the RFC recommendations on NAT), or were fixed by PCP/NAT-PMP (which is the technology everyone should be implementing support for in their software stacks, not IPv6). (With respect to the attack in this article, this isn't an attack on NAT per se: it is an attack on these "application level gateways", which I frankly had always assumed were a "crazy" Linux IPMASQ feature, not something people were using in production. I appreciate why people are doing this: no one integrates PCP/NAT-PMP, and there exist older notably unencrypted and thereby already somewhat unfortunate protocols--such as FTP and SIP--that have port allocation assumptions that the router is trying to fix with heuristics. This mechanism doesn't work if the traffic is encrypted anyway--and all of these protocols support encryption as of 15 years ago, and a lot of users actually did switch--so I will claim these features should not be deployed: developers should use PCP/NAT-PMP in their clients or we should potentially integrate it into their operating systems, and not pretend that ALGs are much more than a dangerous MITM attack.)
  - jiggawatts 6y ago
    > one can totally implement NAT for IPv6, and in fact people have Please don't say things like this out loud! The purpose of IPv6 was to eliminate the need for filthy hacks like NAT. NAT does nothing for privacy, not in theory, not in practice. Everyone trying to get at your private information has figured out hundreds and hundreds of methods for tracking you. Single pixel images. Browser fingerprinting. Hardware fingerprinting. Mouse movement patterns. You name it, they're doing it. They're not at all slowed down by NAT, but the Internet is harmed by it. Stop giving advice like this.
    - Reelin 6y ago
      I think the situation is quite a bit more complicated than you make out. To my ISP, NAT obscures device browsing history (assuming there are multiple people and devices within a household). To the best of my knowledge an ISP has no realistic way of engaging in mass browser fingerprinting. To a web host, NAT obscures the number of users behind a given IP address. Sure, they can likely recover some amount of information by engaging in browser fingerprinting but right off the bat it makes their job harder. Security and privacy both involve layers. Every bit of information leaked is a concession to an adversary. When I switch my home network over to IPv6 I will almost certainly add NAT to it. > the Internet is harmed by it I don't believe you. Shitty software is harmed by it. If you have concrete examples to the contrary, I'm open to them.
      - labawi 6y ago
        That's a convincing privacy argument for NAT. I thought temporary addresses were supposed to (mostly) solve this and would be my preferred way. Though the default 24h lifetime is not quite as helpful, except for hopefully sidestepping the genius - embedded by MAC into my IPv6 - address generation. net.ipv6.conf.all.temp_prefered_lft = 86400
        Reelin 6y ago
        It's in a nearby comment chain, but apparently my understanding was outdated and/or just incomplete. The SLAAC privacy extensions will make use of a full /64 prefix instead of a device specific one. That makes it functionally equivalent to NAT if and only if addresses are rotated on a very frequent (ex per browser tab) basis. (I wonder if you could rotate per origin within the same tab?)
- darren_ 6y ago
  Ah, OK. I don't really find that too compelling, to be honest - what's your NAT buying you if you don't have many users to mix your traffic with? I live alone and as far as I can see, all my NAT does for my privacy is a smidgen of plausible deniability (maybe a visitor on my guest wifi made that request), and that you can't tell which of my devices I'm using when I access a particular service - which is a small privacy win, but not a meaningful one in my book. Even for what I imagine is the common case of a family sharing one router, I'd guess it's usually not challenging to distinguish traffic between the relatively small number of potential users/devices. If you're lucky(?) enough to be behind a NAT with enough hosts to be meaningful privacy-wise (dozens? hundreds?), and whoever's running this NAT isn't keeping logs about it (do they? honestly don't know), then you might be seeing a significant privacy upside. But it's not built-in to the protocol, and just adding a NAT doesn't buy you any privacy by itself. I think the problem is that the privacy enhancing part of NAT is an emergent side-effect, not the main goal. Now it's got me thinking there should be something like NAT but explicitly targeted to privacy, like guaranteeing that your traffic is mixed through an IP that minimum a hundred other people are using. Or something like that.
  - bigiain 6y ago
    > If you're lucky(?) enough to be behind a NAT with enough hosts to be meaningful privacy-wise (dozens? hundreds?), and whoever's running this NAT isn't keeping logs about it (do they? honestly don't know), then you might be seeing a significant privacy upside. I worked out of a co-working space for a while that were explicit about not logging anything on their NATed shared internet connection. I saw more Google captchas using that (without a VPN) that I’d even see with TOR. After I left, a friend I’d made there told me they eventually found out someone there was doing seriously blackhat seo stuff and they kicked him out. Took a few months but eventually all the captchas went away.

etaioinshrdlu 6y ago

No, I think that's about it. But that is quite significant. It means that an IPv6 address uniquely identifies one computer (albeit temporarily). An IPv4 with NAT does not identify one user, it might be anywhere from 1 to thousands. A possible solution I'd like to see explored is to have each new web browser tab (and every process on your PC more generally) use a unique, fresh public IPv6 address by default. One would only use a semi-static IP if running some type of server.

saurik 6y ago
As those unique "fresh" addresses would have to come from some shared routable prefix (which is the core problem with the various IPv6 randomized address solutions), that would still provide strictly worse privacy than NAT: if you happened to be one machine before you are now outing to the world the connection correlations between your tabs, and if you were multiple machines before you are now separating the traffic from the multiple users; meanwhile, no one thinks you are a large number of unrelated addresses (as no one is dumb enough to be tricked by your supposedly-separate addresses that all share the same prefix). FWIW, one can totally implement NAT for IPv6, and in fact people have: everyone should always use NAT. NAT is the correct solution to this problem, whether you are mixing your traffic locally on your own network or are shifting your traffic through remote mixers (which is effectively what Orchid--the open source decentralized privacy network I work on, funded by some major VCs--does, though it frankly isn't there yet with "#privacy" despite having launched a long time ago and being usable today; btw: I haven't finished implementing this yet, but "use a separate circuit for each target host", which I think best achieves your dream of an address per tab, is one of the features I have been intending to have in Orchid for forever ;P). (It makes sense for me to attach this to this comment, but I appreciate I am likely preaching the choir with respect to responding to you ;P.) The downsides people like to whine about for NAT involving peer-to-peer connections and hole punching are either misunderstandings (people often like to claim things don't work that do), are caused by shitty NAT implementations (that ignore the RFC recommendations on NAT), or were fixed by PCP/NAT-PMP (which is the technology everyone should be implementing support for in their software stacks, not IPv6). (With respect to the attack in this article, this isn't an attack on NAT per se: it is an attack on these "application level gateways", which I frankly had always assumed were a "crazy" Linux IPMASQ feature, not something people were using in production. I appreciate why people are doing this: no one integrates PCP/NAT-PMP, and there exist older notably unencrypted and thereby already somewhat unfortunate protocols--such as FTP and SIP--that have port allocation assumptions that the router is trying to fix with heuristics. This mechanism doesn't work if the traffic is encrypted anyway--and all of these protocols support encryption as of 15 years ago, and a lot of users actually did switch--so I will claim these features should not be deployed: developers should use PCP/NAT-PMP in their clients or we should potentially integrate it into their operating systems, and not pretend that ALGs are much more than a dangerous MITM attack.)
- jiggawatts 6y ago
  > one can totally implement NAT for IPv6, and in fact people have Please don't say things like this out loud! The purpose of IPv6 was to eliminate the need for filthy hacks like NAT. NAT does nothing for privacy, not in theory, not in practice. Everyone trying to get at your private information has figured out hundreds and hundreds of methods for tracking you. Single pixel images. Browser fingerprinting. Hardware fingerprinting. Mouse movement patterns. You name it, they're doing it. They're not at all slowed down by NAT, but the Internet is harmed by it. Stop giving advice like this.
  - Reelin 6y ago
    I think the situation is quite a bit more complicated than you make out. To my ISP, NAT obscures device browsing history (assuming there are multiple people and devices within a household). To the best of my knowledge an ISP has no realistic way of engaging in mass browser fingerprinting. To a web host, NAT obscures the number of users behind a given IP address. Sure, they can likely recover some amount of information by engaging in browser fingerprinting but right off the bat it makes their job harder. Security and privacy both involve layers. Every bit of information leaked is a concession to an adversary. When I switch my home network over to IPv6 I will almost certainly add NAT to it. > the Internet is harmed by it I don't believe you. Shitty software is harmed by it. If you have concrete examples to the contrary, I'm open to them.
    - labawi 6y ago
      That's a convincing privacy argument for NAT. I thought temporary addresses were supposed to (mostly) solve this and would be my preferred way. Though the default 24h lifetime is not quite as helpful, except for hopefully sidestepping the genius - embedded by MAC into my IPv6 - address generation. net.ipv6.conf.all.temp_prefered_lft = 86400
      - Reelin 6y ago
        It's in a nearby comment chain, but apparently my understanding was outdated and/or just incomplete. The SLAAC privacy extensions will make use of a full /64 prefix instead of a device specific one. That makes it functionally equivalent to NAT if and only if addresses are rotated on a very frequent (ex per browser tab) basis. (I wonder if you could rotate per origin within the same tab?)
darren_ 6y ago
Ah, OK. I don't really find that too compelling, to be honest - what's your NAT buying you if you don't have many users to mix your traffic with? I live alone and as far as I can see, all my NAT does for my privacy is a smidgen of plausible deniability (maybe a visitor on my guest wifi made that request), and that you can't tell which of my devices I'm using when I access a particular service - which is a small privacy win, but not a meaningful one in my book. Even for what I imagine is the common case of a family sharing one router, I'd guess it's usually not challenging to distinguish traffic between the relatively small number of potential users/devices. If you're lucky(?) enough to be behind a NAT with enough hosts to be meaningful privacy-wise (dozens? hundreds?), and whoever's running this NAT isn't keeping logs about it (do they? honestly don't know), then you might be seeing a significant privacy upside. But it's not built-in to the protocol, and just adding a NAT doesn't buy you any privacy by itself. I think the problem is that the privacy enhancing part of NAT is an emergent side-effect, not the main goal. Now it's got me thinking there should be something like NAT but explicitly targeted to privacy, like guaranteeing that your traffic is mixed through an IP that minimum a hundred other people are using. Or something like that.
- bigiain 6y ago
  > If you're lucky(?) enough to be behind a NAT with enough hosts to be meaningful privacy-wise (dozens? hundreds?), and whoever's running this NAT isn't keeping logs about it (do they? honestly don't know), then you might be seeing a significant privacy upside. I worked out of a co-working space for a while that were explicit about not logging anything on their NATed shared internet connection. I saw more Google captchas using that (without a VPN) that I’d even see with TOR. After I left, a friend I’d made there told me they eventually found out someone there was doing seriously blackhat seo stuff and they kicked him out. Took a few months but eventually all the captchas went away.