3 ms·

CGNAT is pretty much the only setup on mobile though. Dunno if any equipment vendor doesn’t do that. Would worry about most average cell phones sitting directl

CGNAT is pretty much the only setup on mobile though. Dunno if any equipment vendor doesn’t do that. Would worry about most average cell phones sitting directly on the public internet. I think there’s a reason we haven’t heard about mass-owns of mobile phones and it’s because they’re always effectively behind firewalls, not because of their superior security.

qalmakka 4y ago
This is not correct. Especially in the USA lots of mobile phones now have IPv6 connectivity. From https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-internet-is-rapidly-moving-to-ipv6/ https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-inte... "80% of smartphones in the US on the major cellular network operators use IPv6 and major mobile networks are driving IPv6 adoption with Verizon Wireless at 84%, Sprint at 70%, T-Mobile USA at 93%, and AT&T Wireless at 57%" And this were numbers from four years ago. NAT is not a firewall and it's dangerous to think of it as such, because it causes people to follow a lax approach to security and think they are protected, when they actually aren't.
- Scoundreller 4y ago
  That’s fine and all: but are they issuing mobile phones a publicly addressable IP or not? Can a Verizon subscriber run a web server on their mobile phone and share their IPv6 or not?
  - qalmakka 4y ago
    NAT66 is, in general, utterly broken and most OSes prefer IPv4 to ULAs - thus, if a mobile subscriber can connect to an external IPv6 service, it's very likely the address they were given by their carrier is publicly routable.
- theamk 4y ago
  From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time. I hope that IPv6 is rolled out to homes, most ISPs would do the right thing and set up customer routers firewall in "default deny incoming " mode. Otherwise, the number of worms would increase a lot.
  - qalmakka 4y ago
    We may argue that Windows Firewall (and macOS) by default already do that. On Linux, I usually set nftables like such on all my machines, but it's trivial for "user friendly" distros to ship sane defaults for nftables. What scares me a lot is that lots of folks out there still rely on iptables, and do not realize that they need ip6tables to set IPv6 tables - I dread of the moment some random ISP will push IPv6 routes, SLAAC picks up an IPv6 on a random Linux box and that box gets instantly pwned because it has no ip6tables rule whatsoever blocking inbound traffic.
    - extra88 4y ago
      The many embedded devices in homes are much scarier than home sysadmins not configuring their boxes correctly.

qalmakka 4y ago

This is not correct. Especially in the USA lots of mobile phones now have IPv6 connectivity. From https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-internet-is-rapidly-moving-to-ipv6/ https://www.arin.net/blog/2020/01/16/mobile-edge-of-the-inte... "80% of smartphones in the US on the major cellular network operators use IPv6 and major mobile networks are driving IPv6 adoption with Verizon Wireless at 84%, Sprint at 70%, T-Mobile USA at 93%, and AT&T Wireless at 57%" And this were numbers from four years ago. NAT is not a firewall and it's dangerous to think of it as such, because it causes people to follow a lax approach to security and think they are protected, when they actually aren't.

Scoundreller 4y ago
That’s fine and all: but are they issuing mobile phones a publicly addressable IP or not? Can a Verizon subscriber run a web server on their mobile phone and share their IPv6 or not?
- qalmakka 4y ago
  NAT66 is, in general, utterly broken and most OSes prefer IPv4 to ULAs - thus, if a mobile subscriber can connect to an external IPv6 service, it's very likely the address they were given by their carrier is publicly routable.
theamk 4y ago
From practical standpoint, most common NAT setups come with "default deny incoming" firewall, and systems have relied on this fot a very long time. I hope that IPv6 is rolled out to homes, most ISPs would do the right thing and set up customer routers firewall in "default deny incoming " mode. Otherwise, the number of worms would increase a lot.
- qalmakka 4y ago
  We may argue that Windows Firewall (and macOS) by default already do that. On Linux, I usually set nftables like such on all my machines, but it's trivial for "user friendly" distros to ship sane defaults for nftables. What scares me a lot is that lots of folks out there still rely on iptables, and do not realize that they need ip6tables to set IPv6 tables - I dread of the moment some random ISP will push IPv6 routes, SLAAC picks up an IPv6 on a random Linux box and that box gets instantly pwned because it has no ip6tables rule whatsoever blocking inbound traffic.
  - extra88 4y ago
    The many embedded devices in homes are much scarier than home sysadmins not configuring their boxes correctly.