4 ms·

The idea of IPv6 is that every few hours or so my iPhone gets a new set of IPv6 addresses (usually 4 at a time I don't exactly know my currently config but they

The idea of IPv6 is that every few hours or so my iPhone gets a new set of IPv6 addresses (usually 4 at a time I don't exactly know my currently config but they keep changing always). So the obscurity is from the fact that you have ipv6 ips shuffling all the time. Since the /64 address space is so vast for a home network you will ideally not notice someone targeting your IP because it may not be worth the effort for those targeting it. Now if you pin a ::1/64 to a machine or lets say some low addresses that you did because you remember them easily (or even if you pin any address lets say thats /64) you are now no longer using the obscurity part. This means your IPv6 /64 is basically just IPv4 now for that one machine. The whole problem here is that you got a public IP (because now thats hard for home networks with ipv4). It's going to behave like any public IP, get targeted by attackers to see if some port is open or if there are any issues with security. IPv6 doesn't bring any advantage here unless you actually use its features like SLAAC and rotating IPs.

immibis 2y ago
It's more of an accidental side effect than an intentional feature. The actual reason the customer gets 2^64 addresses is to make sure they have enough addresses and don't need NAT. And SLAAC (also an accidental feature) ossified it at 2^64 - a good ossification, for once. And then, if you have so many addresses, may as well rotate through them so it's hard for anyone to observe how many separate devices from your network are accessing their server.
- k_roy 2y ago
  not at all an "accidental side effect" though. By any stretch of the imagination. Very purposeful
k_roy 2y ago
> The idea of IPv6 is that every few hours or so my iPhone gets a new set of IPv6 addresses (usually 4 at a time I don't exactly know my currently config but they keep changing always). So the obscurity is from the fact that you have ipv6 ips shuffling all the time. Since the /64 address space is so vast for a home network you will ideally not notice someone targeting your IP because it may not be worth the effort for those targeting it. This is fundamentally not a part of IPv6. It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. My home address space is a /48. And when do some really simple subnet math on my IPs, you can easily identify my addresses. And again, the point is, just because you live out in the country, doesn't mean you shouldn't lock your doors. Even though right now it's impossible to feasibly to even really scan a /64, that may not be true in a week.
- cyberax 2y ago
  > It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. Not quite true. The original braindead design embedded your MAC address into your public IPv6. So that all those nice companies can uniquely identify you _everywhere_.
  - k_roy 2y ago
    What part isn't quite true? What you are talking about is RFC 4862. The SLAAC part of ipv6, which is auto-configuration. What I am talking about is RFC 4941: Privacy Extensions for Stateless Address Autoconfiguration in IPv6 Which is pretty close to: "extension added later for privacy" 4862 < 4941
    - cyberax 2y ago
      I'm just saying that the IPv6 privacy extension is far from useless. Without it, advertisers can track your device everywhere.
      - k_roy 2y ago
        It’s a nice thought but… Nobody is tracking 48 bits out of 128 bits and tying that to a specific user. Pretty simple browser fingerprinting will get you much closer. Not to mention that you know MAC addresses aren’t unique right. They only have to be unique on the same L2. And with some shipping logistics, you can make sure this is usually true. I say this as a person who received a case of Intel NICs back in the day and every MAC was the same.
        Dylan16807 2y ago
        > Nobody is tracking 48 bits out of 128 bits and tying that to a specific user. Of course they would, if it was how everyone still did addresses! It's a super easy to access permanent ID. > aren’t unique Rarely. That's hardly enough trouble to make trackers not use it.
blackeyeblitzar 2y ago
How do defenses against attackers work with rotating IPs etc? Could you still identify and block problematic traffic? Sorry if this is a naive question.
- k_roy 2y ago
  You don't consider an IP address when blocking traffic. Whether IPv4 or IPv6, it's trivially easy to grab a new one. And unless you are willing to start blocking huge swathes of the world and ultimately legitimate traffic, you do other things.
Tractor8626 2y ago
No. Privacy extensions solve completly different problem - preventing tracking you across different network via stable slaac suffix.

immibis 2y ago

It's more of an accidental side effect than an intentional feature. The actual reason the customer gets 2^64 addresses is to make sure they have enough addresses and don't need NAT. And SLAAC (also an accidental feature) ossified it at 2^64 - a good ossification, for once. And then, if you have so many addresses, may as well rotate through them so it's hard for anyone to observe how many separate devices from your network are accessing their server.

k_roy 2y ago
not at all an "accidental side effect" though. By any stretch of the imagination. Very purposeful

k_roy 2y ago

> The idea of IPv6 is that every few hours or so my iPhone gets a new set of IPv6 addresses (usually 4 at a time I don't exactly know my currently config but they keep changing always). So the obscurity is from the fact that you have ipv6 ips shuffling all the time. Since the /64 address space is so vast for a home network you will ideally not notice someone targeting your IP because it may not be worth the effort for those targeting it. This is fundamentally not a part of IPv6. It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. My home address space is a /48. And when do some really simple subnet math on my IPs, you can easily identify my addresses. And again, the point is, just because you live out in the country, doesn't mean you shouldn't lock your doors. Even though right now it's impossible to feasibly to even really scan a /64, that may not be true in a week.

cyberax 2y ago
> It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. Not quite true. The original braindead design embedded your MAC address into your public IPv6. So that all those nice companies can uniquely identify you _everywhere_.
- k_roy 2y ago
  What part isn't quite true? What you are talking about is RFC 4862. The SLAAC part of ipv6, which is auto-configuration. What I am talking about is RFC 4941: Privacy Extensions for Stateless Address Autoconfiguration in IPv6 Which is pretty close to: "extension added later for privacy" 4862 < 4941
  - cyberax 2y ago
    I'm just saying that the IPv6 privacy extension is far from useless. Without it, advertisers can track your device everywhere.
    - k_roy 2y ago
      It’s a nice thought but… Nobody is tracking 48 bits out of 128 bits and tying that to a specific user. Pretty simple browser fingerprinting will get you much closer. Not to mention that you know MAC addresses aren’t unique right. They only have to be unique on the same L2. And with some shipping logistics, you can make sure this is usually true. I say this as a person who received a case of Intel NICs back in the day and every MAC was the same.
      - Dylan16807 2y ago
        > Nobody is tracking 48 bits out of 128 bits and tying that to a specific user. Of course they would, if it was how everyone still did addresses! It's a super easy to access permanent ID. > aren’t unique Rarely. That's hardly enough trouble to make trackers not use it.

blackeyeblitzar 2y ago

How do defenses against attackers work with rotating IPs etc? Could you still identify and block problematic traffic? Sorry if this is a naive question.

k_roy 2y ago
You don't consider an IP address when blocking traffic. Whether IPv4 or IPv6, it's trivially easy to grab a new one. And unless you are willing to start blocking huge swathes of the world and ultimately legitimate traffic, you do other things.

Tractor8626 2y ago

No. Privacy extensions solve completly different problem - preventing tracking you across different network via stable slaac suffix.