5 ms·
I vastly prefer CGNAT to IPv6, because CGNAT preserves my privacy by default, and IPv6 eliminates it by default. It’s that simple. While it’s possible for an I
by beagle3 2y ago
I vastly prefer CGNAT to IPv6, because CGNAT preserves my privacy by default, and IPv6 eliminates it by default. It’s that simple.
While it’s possible for an ISP to unmask me on CGNAT (Verizon and AT&T did in the early smartphone days)- and it’s possible for an ISP to NAT/Wildcard my IPv6 address for privacy - it’s the default in 99% of the cases; and I prefer default privacy to the ability to be directly addressable at home.
- seanlinmt 2y agoBut how do you host services through CGNAT though?
- msk-lywenn 2y agoYou can’t. When my ISP switched me to CGNAT, I spent days upgrading everything to IPv6, only to discover that gmail didn’t even support it! (Mail Server to mail server, not the web app) I gave up, asked my ISP IPv4 back and, fortunately, got back a new IPv4. But I fear the day that option will disappear…
- hlandau 2y agoMy mail server has been known to deliver mail to Gmail using IPv6 if I don't tell it not to. Not sure if Gmail will use IPv6 for incoming mail though.
- tambre 2y agoWhat year was this? While I can't find a source I believe Gmail has supported IPv6 for sending and receiving since the World IPv6 day back in 2011. I've certainly been doing it since 2017. Your issue might be rather that Gmail actually enforces all their guidelines on IPv6 instead of silently degrading your reputation behind the scenes like they do for IPv4. So proper RDNS, SPF and DKIM are tablestakes with DMARC and MTA-STS strongly recommended.
- msk-lywenn 2y agoThis was maybe three four years ago. That might be it. I lack rDNS but I have everything else. Except for MTA-STS, I’ll check that out
- tambre 2y agoYeah, rDNS is a hard requirement for IPv6. I believe you should get a hard reject for missing that with a pointer to the documentation.
- eru 2y agoBy and large, you don't. I suspect beagle3 cares more about the privacy aspects than hosting a service from their home. There are some trick for hosting through CGNAT, if you have a server on the outside.
- sambazi 2y agoeither buy paying a few bucks for a vps with static v4 or try techniques like "nat hole punching" to keep the cgnat statemachine happy. but tbf it isn't meant to
- kuschku 2y ago> but tbf it isn't meant to Then it's not internet. Internet means there is no distinction between "servers" and "clients", everyone is a peer. If you can't host things, you don't have internet. You've just got a modern version of MSN/BTX/Telex/whatever
- sambazi 2y agohow it started, how it's going. billions of ppl access the internet thru nat everyday, i'm glad it exists and also happy for alternatives
- orangeboats 2y ago>billions of ppl access the internet thru nat everyday A caveat is that a lot of people are knowing or unknowingly relying on things like UPnP and NAT-PMP to have services operating normally under NAT. That conveniently masked a lot of the issues with NAT in P2P usecases such as online gaming and torrenting. Unfortunately, even that is broken under CGNAT. The more layers of NAT you put on your connection, the more things you break.
- sambazi 2y agointerestingly, i religiously disable upnp/pmp on all residential cpe's that i configure due to it's glaring security implications. never heard of a problem though i do defend v4-nat internet as the way it was meant to be, being jailed behind a cgnat w/o repercussions would push me to another isp.
- orangeboats 2y ago
- miyuru 2y agoWhat kind of privacy are you getting with CGNAT? ISPs and websites can still track you.
- jasode 2y ago>CGNAT? ISPs and websites can still track you. Yes, ISP's can still track but the other websites-that-are-not-the-ISP that depend on logging unique ip addresses for tracking can't identify you behind a CGNAT. My previous comment about how CGNAT can be another layer of privacy for things like torrents: https://news.ycombinator.com/item?id=38176079 https://news.ycombinator.com/item?id=38176079 EDIT reply to : >Sure except for the like 800 other metrics they use to track you besides IP lol. Advertisers Yes, browser fingerprints and "device behavior" heuristics etc demonstrated at https://amiunique.org/ https://amiunique.org/ and https://fingerprint.com/blog/browser-fingerprinting-techniques/ https://fingerprint.com/blog/browser-fingerprinting-techniqu... ... also exist but that's not what my reply was about. My comment was specifically talking about those websites that depend on ip addresses and not fingerprinting. Examples are torrent trackers, torrent honeypots, and Wikipedia articles' edits history where their server logs keep track of ip addresses instead of browser fingerprints. CGNAT will make users more anonymous in those situations. Lawsuits and subpoenas from RIAA and movie studios against torrenters for copyright infringements were filed against ip addresses and not browser fingerprints. As for Google/Facebook sophistication levels of browser fingerprints tracking and surveillance, I'm not so sure how paranoid I should be about it because they still think I'm in Idaho because I happen to open my laptop in a hotel one time there 10 months ago.
- datascienced 2y agoYou can have a different IPv6 every minute if you like. They are plentiful! Maybe have a fixed one for your web server too.
- alduin32 2y agoThat different IPv6 will still identify the subscriber, because it will have a shared prefix, usually statically allocated by the provider.
- 0xDEADFED5 2y agothey both suck for me. i can't port forward any IPv4, and Verizon blocks any incoming IPv6 on their side
- sambazi 2y agorock and a hard place both seem to be political problems rather than technical ones
- justinclift 2y agoInstead of port forwarding for IPv4, couldn't you use that Cloudflare service tunnelling thing?
- nirui 2y agoWell, I'm inside a CGNAT. It's like living in an apartment building with 20,000 other families. Maybe it's all fine when everything is normal, but one day, the water pipe on the top floor might go burst while no one is answering the door. It is true that a NAT could give you some privacy, but the downside is also very obvious. For example, your network neighbor might rub some service in the wrong way, then the service ended up sanction/ban the shared NAT exit. Then, you might be thinking, "just use a smaller CGNAT then". Well, then a smaller CGNAT will allow the website to track you more easily. If I really really don't want to be tracked, I'd rather use Tor.
- sambazi 2y agothis is a real downside of ip reputation systems
- anonym29 2y agoDing ding ding. IPv6 doesn't solve this problem either because not all malicious activity from a given IP address is guaranteed to be conducted with the knowledge or consent of the folks paying for the connection anyway. There should only ever be discrimination against traffic, not against addresses. Addresses should not be presumed to be fixed, and it should therefore never be assumed that seeing the same client IP twice means it's the same end user.
- sambazi 2y agoding ding. your last sentence hit the mark. though from a operations/defensive perspective it often makes sense
- GoblinSlayer 2y agoIn order to ban an ip6 client one must ban entire /64 network due to address randomization. So you still get banned.
- nickburns 2y ago
- orangeboats 2y agoIt's something I had said before in another thread, but oh well... Here goes again: The so called privacy-presevation of CGNAT is a double edged sword. Other websites can't track you, simultaneously that also means other internet users can't reach you. The most obvious consequence is that to host a server, you must purchase a VPS or rent an public IP address from your ISP, and the price for a public IPv4 address is getting higher and higher. The less obvious consequence is that you're giving up control to the VPS providers (and other centralized services). Does your VPS provider allow you to host Tor services? Run BitTorrrent? It's rather ironic that people on HN, a website whose name literally includes the term "hacker", would support things like CGNAT which hurt hackers/hobbyists/"privacyists" the most.
- beagle3 2y agoTo each their own. Want to be reachable? Use IPv6. My privacy is more important to me than being directly reachable.
- orangeboats 2y agoIf you think privacy can be achieved using CGNAT and not services like Tor or VPNs... then good luck. I will be blunt: Long term, IPv4 and any technology that extends the lifetime of IPv4 will actually result in the death of online privacy.
- beagle3 2y agoI do a lot to preserve my privacy. The CGNAT makes it impossible for random websites to correlate my actions among them - which is something they try to do while profiling me. It is, as you point out, useless against state actors and similarly funded-and-legally-equipped bodies; For those, you indeed need Tor and VPN and likely that's not enough even then. But I care about the civilian "spies" following me; like Facebook, Google, Microsoft, and friends. I use as little of their services as possible, with add blockers, a restrictive JS policy, ultra restrictive cookie policy, etc. It's unlikely any of them can correlate me with the other (or with myself from yesterday, for many uses). Giving me an externally imposed unique identifier (and a /64 prefix is just that, regardless of randomizing the remaining bits) makes it trivial for them and impossible for me -- unless I do all my browsing through Tor or something like that. For the record, I have no proper FB or G account, but cannot avoid Whatsapp and an occasional Google product. > I will be blunt: Long term, IPv4 and any technology that extends the lifetime of IPv4 will actually result in the death of online privacy. Can you explain why you believe that? To me it sounds like baseless scaremongering.
- nickburns 2y agoif you're a privacy by-default kinda guy—then regrettably you must live in a lonely, lonely world. how do i get there? at least i have my edge firewall until you let me know.
- beagle3 2y agoI live in a very social, active, healthy world. Indeed, I don't have "friends" on Facebook / Instagram (I don't use those) - I talk to friends on the phone, meet them in person, we have message groups on various services. Some of my friends do post on Facebook or Instagram; but they let me know personally if there's anything important I should know. I'm a privacy-by-default kind of guy, yes.
- nickburns 2y agoyou're a privacy by-default kinda guy because you don't maintain any 'traditional' 'social media' accounts i guess you mean to say? that's a somewhat random notion and not entirely relevant as social media is about the lowest hanging fruit any of us could conjure. so you believe yourself to be privacy-minded, yeah. i had already gathered that much. my point was that there's all but no such thing and typically merely only the illusion of 'privacy by-default'—hence the lonely, lonely world in which you could only claim to live.
- beagle3 2y agoI fail to understand your perception in which I am lonely just because I don’t leave a breadcrumbs everywhere for state and commercial actors (whose interests don’t align with mine) to find.
- nickburns 2y agoi don't think you're lonely. i was simply employing sarcasm to suggest that maybe the private world you merely believe yourself to live in doesn't actually exist. not for any of us, myself included. we're definitely replying past each other a bit. i now realize after seeing a few of your other comments throughout this thread that your opinions surrounding personal privacy are much more aligned with my own than i think your opinions on CGNAT represent. thanks for the discourse no less.
- allarm 2y ago> because CGNAT preserves my privacy by default This comment. Every single time. No it doesn't. NAT doesn't add privacy. NAT doesn't add security. Use firewall with IPv6. This is it.
- beagle3 2y agoYou are wrong, and I say that as someone who was employed by someone who (likely) invaded and still invades your privacy through a firewall and IPv6. Modern firewalls do nothing for privacy. IPv6 eliminates your ability to maintain your privacy. Security is a different matter, and NAT doesn't add much there (although it is another layer). But the comment you quoted was specifically about privacy.
- deleted 2y ago[deleted]
- allarm 2y agoEven though you're right, privacy is quite irrelevant in this case anyway. If no one can walk through the door, your personal space cannot be violated. If you want to hide your IP use VPN. You essentially should not rely on things out of your control, such as CGNAT. But yeah, I agree, I should have mentioned security, only.
- beagle3 2y agoMy threat model excludes state actors and my ISP actively collaborating with those who try to profile me. Thus, CGNAT - which I already get, is comparable to VPN (better in some respects, worse in others).