10 ms·

I just hope ipv6 doesn't have privacy nightmare that 1 device will always get 1 IP. Currently, the isp I use provides dynamic ip, so on every router restart my

I just hope ipv6 doesn't have privacy nightmare that 1 device will always get 1 IP. Currently, the isp I use provides dynamic ip, so on every router restart my ip gets changed. If they starts to provide ipv6, I hope they give options to rotate it frequently, so toxic companies like meta, facebook, microsoft can't connect my device & ip.

wishfish 4y ago
It's sad how much has changed in the past 10+ years. I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great. I agree with what you said. It's just interesting how it illustrates how different things are now.
- HWR_14 4y ago
  > I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great. I remember a bunch of people being horrified by the idea of 1 device per IP. I think it's more a matter of who you were around then the group changing their mind, but maybe that happened too.
trashburger 4y ago
With IPv6 each device getting a unique IP is not a bug but a feature -- what will probably happen is that your ISP will lend out a /64 range to you, which your devices will use to assign a unique IP to themselves. This completely removes the need for NAT (also, keep in mind that a NAT is not a firewall or a security feature). BTW, dynamic IP rotation was never a guarantee and is only used because the pool of IPs were small. Use a VPN to avoid FAANG.
- ngetchell 4y ago
  While I understand the sentiment, NAT does so much to protect most users, it should be considered a security feature.
  - pzmarzly 4y ago
    You can still set up inbound firewall on IPv6, my ISP does it (to my annoyance).
  - withinboredom 4y ago
    NAT itself doesn't provide any protection at all. You can set up NAT in dozens of different configurations (1:1 NAT comes to mind), but in the way consumer routers generally set up NAT, I can see why you'd say that (despite there being standard ways to forward ports without any user intervention such as uPnP). There's nothing "secure" about NAT.
    - collsni 4y ago
      I think the argument is about the address origin being overwritten vs forwarded to the destination. Is about device tracking and privacy
      - withinboredom 4y ago
        I don't think that works. A router should decrement the TTL of the frame, and thus showing that there is a router between the host device. The linux default is 64 and windows is 128 IIRC, so you can easily deduce the OS just from looking at the TTL. This can tell you whether an ipv4 device is directly connected. From there, you just need to look at IP ID in the packet and figure out which ones are increasing independently to determine individual devices behind the NAT. So, no. NAT gives you 0 privacy.
    - ngetchell 4y ago
      Not having client devices accessable via unique IPs is a great security feature. Certainly an unintended side effect but NAT is what is dropping unwelcomed incoming traffic on consumer devices.
      - withinboredom 4y ago
        You mean a firewall? NAT doesn’t have to drop any packets. It can translate unknown flows into broadcast packets, forward them to a set ip (dmz), or drop them. NAT is not a firewall, even if some configurations make it kinda sorta, if you squint, look like one.
- collsni 4y ago
  oh perfect for device tracking!! hope you dont have any tweets that offend your goverment lol
  - cowtools 4y ago
    How is it any worse than the current system? Use Tor or I2P. NAT is not a privacy or security feature. You can treat it like it is, but only at your own risk.
legrande 4y ago
IPV6 is sort of like the new MAC address hardware identifier. An IP for every atom in the universe!
- oldjavacoder 4y ago
  That's the issue I have with it, it's not a feature.
- p1mrx 4y ago
  There are a lot more atoms (10^80 or so) than IPv6 addresses (10^38). How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?
  - Dylan16807 4y ago
    > How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use? By putting the hardware part in the second half, and the ISP part in the first half. You know, like how it works by default.
    - p1mrx 4y ago
      Most devices randomize the second half by default, using RFC3041 and its successors.
      - Dylan16807 4y ago
        They do, these days. But then why were you asking "how" a device could have a permanent hardware identifier with its address? Just don't implement those optional RFCs. And the comment you were replying to didn't say it had to be the entire address, and there's no reason for it to be.
jlouis 4y ago
It rotates about once a day in most operating systems. Called ipv6 privacy extensions. This is of course defeatable, but it provides a nice black hole for a device. It moves on and you can't connect to it anymore.
- ospray 4y ago
  Rotating the IP to get similar privacy to what NAT/PAT gave you is annoying I know with v6 we need to use DNS but I hate to say it. I miss Nat I hope the just give us nat66.
  - Dagger2 4y ago
    It only rotates the IP used for outbound connections; you still have a non-rotating IP you can use for inbound.
- oldjavacoder 4y ago
  "This is of course defeatable" Yes, which is why I don't use IPv6. https://blog.apnic.net/2022/01/31/defeating-ipv6-prefix-rotation-privacy/ https://blog.apnic.net/2022/01/31/defeating-ipv6-prefix-rota...
  - Sesse__ 4y ago
    You are mixing up IPv6 prefix rotation and IPv6 privacy extensions, and you don't seem to take into account that IPv4 from most ISPs is much worse (typically, you get an IPv4 address from your ISP via DHCP and keep it nearly forever, nothing to defeat).
- collsni 4y ago
  yeah im not sold by this. i want all of my source traffic to show my gateway as the origin, not my unique end devices. privacy nightmare
  - est31 4y ago
    On a protocol level, there is nothing in ipv6 preventing you from doing NAT. There are only less implementations of that, but it doesn't need buy-in from your ISP, as long as you control the router (and if not, you put a second router behind the first one which has your actual network).

wishfish 4y ago

It's sad how much has changed in the past 10+ years. I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great. I agree with what you said. It's just interesting how it illustrates how different things are now.

HWR_14 4y ago
> I remember arguments advocating for ipv6 for exact reason. 1 device per 1 ip. Back then, it was seen as something great. I remember a bunch of people being horrified by the idea of 1 device per IP. I think it's more a matter of who you were around then the group changing their mind, but maybe that happened too.

trashburger 4y ago

With IPv6 each device getting a unique IP is not a bug but a feature -- what will probably happen is that your ISP will lend out a /64 range to you, which your devices will use to assign a unique IP to themselves. This completely removes the need for NAT (also, keep in mind that a NAT is not a firewall or a security feature). BTW, dynamic IP rotation was never a guarantee and is only used because the pool of IPs were small. Use a VPN to avoid FAANG.

ngetchell 4y ago
While I understand the sentiment, NAT does so much to protect most users, it should be considered a security feature.
- pzmarzly 4y ago
  You can still set up inbound firewall on IPv6, my ISP does it (to my annoyance).
- withinboredom 4y ago
  NAT itself doesn't provide any protection at all. You can set up NAT in dozens of different configurations (1:1 NAT comes to mind), but in the way consumer routers generally set up NAT, I can see why you'd say that (despite there being standard ways to forward ports without any user intervention such as uPnP). There's nothing "secure" about NAT.
  - collsni 4y ago
    I think the argument is about the address origin being overwritten vs forwarded to the destination. Is about device tracking and privacy
    - withinboredom 4y ago
      I don't think that works. A router should decrement the TTL of the frame, and thus showing that there is a router between the host device. The linux default is 64 and windows is 128 IIRC, so you can easily deduce the OS just from looking at the TTL. This can tell you whether an ipv4 device is directly connected. From there, you just need to look at IP ID in the packet and figure out which ones are increasing independently to determine individual devices behind the NAT. So, no. NAT gives you 0 privacy.
  - ngetchell 4y ago
    Not having client devices accessable via unique IPs is a great security feature. Certainly an unintended side effect but NAT is what is dropping unwelcomed incoming traffic on consumer devices.
    - withinboredom 4y ago
      You mean a firewall? NAT doesn’t have to drop any packets. It can translate unknown flows into broadcast packets, forward them to a set ip (dmz), or drop them. NAT is not a firewall, even if some configurations make it kinda sorta, if you squint, look like one.
collsni 4y ago
oh perfect for device tracking!! hope you dont have any tweets that offend your goverment lol
- cowtools 4y ago
  How is it any worse than the current system? Use Tor or I2P. NAT is not a privacy or security feature. You can treat it like it is, but only at your own risk.

legrande 4y ago

IPV6 is sort of like the new MAC address hardware identifier. An IP for every atom in the universe!

oldjavacoder 4y ago
That's the issue I have with it, it's not a feature.
p1mrx 4y ago
There are a lot more atoms (10^80 or so) than IPv6 addresses (10^38). How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use?
- Dylan16807 4y ago
  > How could a device have a hardware-embedded IP address, if the hardware vendor doesn't know which ISP you will use? By putting the hardware part in the second half, and the ISP part in the first half. You know, like how it works by default.
  - p1mrx 4y ago
    Most devices randomize the second half by default, using RFC3041 and its successors.
    - Dylan16807 4y ago
      They do, these days. But then why were you asking "how" a device could have a permanent hardware identifier with its address? Just don't implement those optional RFCs. And the comment you were replying to didn't say it had to be the entire address, and there's no reason for it to be.

jlouis 4y ago

It rotates about once a day in most operating systems. Called ipv6 privacy extensions. This is of course defeatable, but it provides a nice black hole for a device. It moves on and you can't connect to it anymore.

ospray 4y ago
Rotating the IP to get similar privacy to what NAT/PAT gave you is annoying I know with v6 we need to use DNS but I hate to say it. I miss Nat I hope the just give us nat66.
- Dagger2 4y ago
  It only rotates the IP used for outbound connections; you still have a non-rotating IP you can use for inbound.
oldjavacoder 4y ago
"This is of course defeatable" Yes, which is why I don't use IPv6. https://blog.apnic.net/2022/01/31/defeating-ipv6-prefix-rotation-privacy/ https://blog.apnic.net/2022/01/31/defeating-ipv6-prefix-rota...
- Sesse__ 4y ago
  You are mixing up IPv6 prefix rotation and IPv6 privacy extensions, and you don't seem to take into account that IPv4 from most ISPs is much worse (typically, you get an IPv4 address from your ISP via DHCP and keep it nearly forever, nothing to defeat).
collsni 4y ago
yeah im not sold by this. i want all of my source traffic to show my gateway as the origin, not my unique end devices. privacy nightmare
- est31 4y ago
  On a protocol level, there is nothing in ipv6 preventing you from doing NAT. There are only less implementations of that, but it doesn't need buy-in from your ISP, as long as you control the router (and if not, you put a second router behind the first one which has your actual network).