4 ms·

Whilst I agree with you, I rather depressingly suspect a lot of people equate NAT with “security”.

jiggawatts 2y ago
Only CG-NAT provides any semblance of "privacy" from the perspective of the outside world, but is a hideous technology that shouldn't exist. Normal NAT as seen with home internet routers provides zero privacy, because you still have a predictable public IP. People also think that IPv4+NAT provides security, but IPv4 is such a tiny address space that all public IPs are scanned daily by various malicious bots. Meanwhile IPv6 is so enormous that unless you register your address in some public way, you're completely invisible to port-scanning bots by default!
- FridgeSeal 2y ago
  Yeah exactly. I have a friend who works in the networking division of a telco in my country, their team had to spend significant time and effort educating a PM who was dead-to-rights convinced that IPv6 was “less secure” and seemed to think that IPv6 didn’t have subnets and that NAT’s were the same as firewalls and refused to be convinced otherwise. People like that make any forward progress extremely difficult.
  - jiggawatts 2y ago
    It's such a perfect example of erroneous thinking that it should be included in psychology textbooks. "A always comes with B, hence A is required to provide B" is obviously, trivially wrong, but a truly incredible number of people will dig their heels in and refuse to admit that "B can be provided in other ways". In this case where things went wrong was that: "Before A the availability B was rare, and A requires B, and hence B become commonplace only because of A." You can see how the association can be accidentally upgraded to an "if and only if" instead of merely "if".
PhilipRoman 2y ago
Security - not really, but to be honest CG-NAT is kind of nice for privacy. I don't have to worry about leaking a (by default) permanent identifier. Once/if I go full ipv6, I'll probably start using a VPN full time.
- orangeboats 2y ago
  Conversely, CGNAT also means that if someone in your neighbourhood decided to be a malicious actor, you will likely be affected too.
  - alwayslikethis 2y ago
    For law enforcement purposes most CGNAT operators should keep a log of who had what address at what time. You can still get blocked by websites until you get a new address, though.
- abhinavk 2y ago
  The IP that you use to connect outside is separate and not permanent by default. AFAIK both Windows 11 and Linux generate a new one every day.
  - PhilipRoman 2y ago
    AFAIK it is within the same /64, which for all tracking purposes means "the same ip". The CG-NAT ip on the other hand is not even unique at any particular moment, let alone permanently. Kind of like having your own free residential VPN.

Only CG-NAT provides any semblance of "privacy" from the perspective of the outside world, but is a hideous technology that shouldn't exist. Normal NAT as seen with home internet routers provides zero privacy, because you still have a predictable public IP. People also think that IPv4+NAT provides security, but IPv4 is such a tiny address space that all public IPs are scanned daily by various malicious bots. Meanwhile IPv6 is so enormous that unless you register your address in some public way, you're completely invisible to port-scanning bots by default!

FridgeSeal 2y ago
Yeah exactly. I have a friend who works in the networking division of a telco in my country, their team had to spend significant time and effort educating a PM who was dead-to-rights convinced that IPv6 was “less secure” and seemed to think that IPv6 didn’t have subnets and that NAT’s were the same as firewalls and refused to be convinced otherwise. People like that make any forward progress extremely difficult.
- jiggawatts 2y ago
  It's such a perfect example of erroneous thinking that it should be included in psychology textbooks. "A always comes with B, hence A is required to provide B" is obviously, trivially wrong, but a truly incredible number of people will dig their heels in and refuse to admit that "B can be provided in other ways". In this case where things went wrong was that: "Before A the availability B was rare, and A requires B, and hence B become commonplace only because of A." You can see how the association can be accidentally upgraded to an "if and only if" instead of merely "if".

PhilipRoman 2y ago

Security - not really, but to be honest CG-NAT is kind of nice for privacy. I don't have to worry about leaking a (by default) permanent identifier. Once/if I go full ipv6, I'll probably start using a VPN full time.

orangeboats 2y ago
Conversely, CGNAT also means that if someone in your neighbourhood decided to be a malicious actor, you will likely be affected too.
- alwayslikethis 2y ago
  For law enforcement purposes most CGNAT operators should keep a log of who had what address at what time. You can still get blocked by websites until you get a new address, though.
abhinavk 2y ago
The IP that you use to connect outside is separate and not permanent by default. AFAIK both Windows 11 and Linux generate a new one every day.
- PhilipRoman 2y ago
  AFAIK it is within the same /64, which for all tracking purposes means "the same ip". The CG-NAT ip on the other hand is not even unique at any particular moment, let alone permanently. Kind of like having your own free residential VPN.