4 ms·

Huh? Almost all people have "broken" IPv6-only networks -- their computers don't have IPv4 addresses and must use NAT to access remote IPv4 nodes. The only ro

Huh? Almost all people have "broken" IPv6-only networks -- their computers don't have IPv4 addresses and must use NAT to access remote IPv4 nodes. The only routable IP address on a typical home computer is IPv6.

mindslight 5y ago
Even in your paradigm, NAT is a mitigation for a security deficiency of IPv4 (servers get too much visibility into client identity). Rather than relying on each node to implement "privacy extensions" on its own, I think it makes sense to keep up v6 NAT for outgoing connections. For example, distribute every outgoing connection from a network to be uniform over the full address space + port. (There may be even better strategies, like emulating a certain number of discrete devices. But you get my point)
- DarylZero 5y ago
  NAT isn't a security feature. It's forced on users when their ISP only allocates one IPv4 address per site.
  - mindslight 5y ago
    NAT has been forced on users. But NAT is also a security feature. I'm not talking about the implicit stateful firewall that could just as well be explicitly deployed for a whole subnet. Rather I'm talking about hiding as much information as possible about devices on your network. If you have a /28 with an IP for each computer on your network, then surveillance companies can build separate profiles on your desktop, your laptop, your wife's laptop, your kid's laptop, etc. When they're all behind a single IP, then they lose those bits of information. Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up.
    - DarylZero 5y ago
      That's a rather useless form of "security." It's not even going to be effective in preventing the machines running web browsers from being distinguishable, if that's a real concern.
      - mindslight 5y ago
        "Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up."
josephcsible 5y ago
You're using definitions of words that nobody else uses.

mindslight 5y ago

Even in your paradigm, NAT is a mitigation for a security deficiency of IPv4 (servers get too much visibility into client identity). Rather than relying on each node to implement "privacy extensions" on its own, I think it makes sense to keep up v6 NAT for outgoing connections. For example, distribute every outgoing connection from a network to be uniform over the full address space + port. (There may be even better strategies, like emulating a certain number of discrete devices. But you get my point)

DarylZero 5y ago
NAT isn't a security feature. It's forced on users when their ISP only allocates one IPv4 address per site.
- mindslight 5y ago
  NAT has been forced on users. But NAT is also a security feature. I'm not talking about the implicit stateful firewall that could just as well be explicitly deployed for a whole subnet. Rather I'm talking about hiding as much information as possible about devices on your network. If you have a /28 with an IP for each computer on your network, then surveillance companies can build separate profiles on your desktop, your laptop, your wife's laptop, your kid's laptop, etc. When they're all behind a single IP, then they lose those bits of information. Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up.
  - DarylZero 5y ago
    That's a rather useless form of "security." It's not even going to be effective in preventing the machines running web browsers from being distinguishable, if that's a real concern.
    - mindslight 5y ago
      "Higher level protocols can leak much more information, but it's better to address the problem at every level rather than giving up."

josephcsible 5y ago

You're using definitions of words that nobody else uses.