4 ms·
> So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument. Forget about the
by bb88 1y ago
> So it shouldn't matter if your address is public or not, in fact making it public raises the awareness for the problem. That's the argument.
Forget about the internet, we've had almost 100 years to prove we can secure identity theft. And the best thing we can do is to keep our SSN's secret -- security through obscurity. Keeping your SSN private reduces your personal attack surface.
We've had 50 years to secure the internet, and yet, we still have zero day attacks. Nuclear submarines try their best to keep their locations a secret? Why? You cannot attack something you cannot see or hear.
- gf000 1y agoExcept we are more on a chess table where we can just trivially probe each cell, unlike the vast volume of the ocean.
- dijit 1y agoA game of battleship is indeed a good analogy! Just because its a finite space that may eventually be discovered is a poor reason to announce where things are!
- augusto-moura 1y agoBattleship sounds like a good analogy, but is very different because you don't have other options to "secure your ship" besides obscurity. If you had other options, let's say a sonar or moving your ship, they would definitely be used along with obscurity. Besides, the time to scan the whole board is too time consuming in a battleship game, but scanning the whole internet on the other hand only take a few minutes[1] [1]: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
- bb88 1y agoYou're talking IPv4 here, not IPv6. A 24 bit network has 254 addresses in IPv4. A 64bit subnet in IPv6 has 2^64. If you can scan 1M ipv6's in a second, you can maybe scan 1 subnet in 584,942 years. So if you're a firewall, and you notice scanning from a particular ip or network, it's easy enough to block them. Also if you are scanning IPv4, you're not scanning addresses behind the NAT'd routers -- which is also effectively a form of obfuscation. So I would argue it's not the entire internet.
- DANmode 1y agoWell, this is a bad example, considering public/private key pairs exist, and work for identity validation, as long as you don't farm it out to a cheap, know-nothing vendor.