How does one get the system to actually use the IPv6 Temporary Addresses? | Hacker News Reader

How does one get the system to actually use the IPv6 Temporary Addresses?

social.technet.microsoft.com

61 pointsthe847230 comments

Windows 10 also re-enables ipv6 on major updates. It’s nice to try to explain to grandma how to turn it off again, so the pc would actually have working internet again.

Yes, turning on ipv6 should not break the net. Let me introduce you to the concept of ”shitty modems from shitty isps”.

I wonder which modems are most problematic that is commonly used.

These ISPs don't care that almost half their customers have broken service? They should be drowning in support calls. Something's not right here.

They are drowning in calls anyway. They are long past the point of trying to find structural issues from service calls.

I'm going to go out on a limb and say maybe this isn't Microsoft's fault. Microsoft's updates have triggered a bug, but the bug is in the firmware of that crappy router. Thats where the issue needs to be fixed.

It now costs 5 dollars to talk to a CSR at AT&T I found that one out yesterday when I called to pay for my new service

My mother discovered that the DirecTV collections department doesn't put you on hold and are happy to fix problems in exchange for you paying your bill. I wonder how many companies this applies to.

What is the modem doing to cause v6 to break in such a way that it affects the user's experience? In theory, broken or degraded v6 should be taken care of with Happy Eyeballs [1] at the user's device, so the user doesn't even know anything is wrong. I'm really curious what kind of breakage would slip through the cracks.

eg, when Netflix started blocking IPv6 tunnel brokers in their VPN crackdown, my house was affected and Netflix was broken. As a "short term" fix, I blocked traffic towards the v6 tunnel at the firewall, but was too lazy to disable v6 prefix advertisement or actually take the tunnel down. I intended to revisit the whole situation, but forgot.

Despite all the devices on my home network having global v6 addresses, you'd never know that anything is broken because Happy Eyeballs is working as intended across everything - Mac OS, Linux, iOS, Android, Windows.

[1] https://en.wikipedia.org/wiki/Happy_Eyeballs

If in doubt, it's probably an MTU discovery issue. Initial TCP handshake succeeds, then the connection hangs on the first major payload packet (e.g. HTTP response). At least I've seen that happen on lots of awful setups. Many ISPs seem to have routers that neither fragment packets, nor do they respond with ICMP Fragmentation Needed packets. So the connection eventually times out.

I'm at a late stage of an IT career, and I no longer care /why/ a piece of shit device is a piece of shit. With ipv6 on, larger objects like style sheets and images don't load. With ipv6 off, everything loads correctly.

If you want me to debug why this happens, we have some papers to sign and retainers to pay ;)

Happy Eyeballs cannot be implemented in libc/Winsock/etc. alone, because it crosses the abstraction barrier of the Berkeley socket API. Happy Eyeballs wants you to open two TCP connections to the same hostname, one over IPv4 and one over IPv6, and use the one that returns an ACK first. But the BSD socket API separates the process of looking up the hostname and opening a connection to it - getaddrinfo() returns a list of addresses, but you can only pass a single address, with a specific address family (IPv4 or IPv6), to connect(). So the intended use is that the application iterates over the returned addresses itself. You could come up with some scheme where libc caches the IPv4 and IPv6 results and has getaddrinfo() return a fake address to the application that's actually an index into the cache, and have libc implement Happy Eyeballs on its end once connect() is called, but that would probably have all sorts of negative side effects, starting with the fact that getaddrinfo() couldn't be used for any other purpose than generating addresses for connect().

Also, not every protocol is compatible with Happy Eyeballs, because there's no guarantee that opening a connection is harmless. It's perfectly valid for me to e.g. implement a smart lightbulb protocol by having it toggle off/on when it receives a connection from a trusted network interface without actually requiring data to be sent. If you used Happy Eyeballs in this case and both IPv4 and IPv6 worked, you wouldn't be able to turn on your lights. This is of course a contrived example, but the authors of generic libraries like your libc have to worry about contrived examples.

So it has to be implemented by application software or at least a library for the specific protocol like HTTP (layer 5 or up), which means that in practice, lots of apps won't have it implemented. And therefore in practice, broken or degraded IPv6 is very end-user visible.

although otoh in theory there are 65535 usable ports, but shitty shitty firewalls and shitty shitty "sysadmins" often mean you just get 2, and TCP only at that, but it seems that just that bare minimum "connectivity" works well enough that "regular users" don't notice.

Or with some luck, shitty isps fix their shitty modems because a major OS breaks with them. Look at what Mac OS X did with projectors!

Have you considered that your grandma might be blackholing IPv6 packets to a raspberry pi in order to have an excuse to call you?

"Initially browsers use the temporary IPV6 address. After a while they start consistently using the permanent one."

This is the most troubling aspect to me. The process of enabling the random ipv6 address would be:

1.Click the "enable" checkbox

2. Check if it's working. (initially, it does)

3. Forget about it for the next 12 months

Somewhere between Step 2 and Step 3, the feature spontaneously turns off and the ipv6 address is leaked, and the user is none the wiser.

As I read the article, "after a while" is more like hours than months :(

I think IPv6 privacy extensions are a bit overrated in their usefulness. What I mean, at least for most residential deployments, is that the first 64 bits (the prefix) is the same no matter what you do with the last 64. Even if the exact IPv6 suffix is randomized your address can still be linked to an account by its suffix. Unless you are a part of a large network suffix randomization won't do much good. And large networks are probably better with DHCPv6 anyway. If only Google implemented DHCPv6 for Android...

The main issue is that it uses that same suffix no matter what connection you are on.

I don't disagree, but privacy extensions do not solve the problem of tracking, only alleviate it since there are still ways to be tracked. In any case believe a stateful solution like DHCPv6 is better for deployment anyway.

Link sends me to some sort of live.com login page.

Could someone link a mirror?

https://archive.is/P6R9H

Can one block IPv6 in Windows Firewall?

"Bug"

Windows 10 "privacy".

How many people are using IPv6 in the first place though?

Between zero and ninety percent depending on which network provider you are on. Comcast? Seventy percent. Reliance Jio in India? Ninety percent. Fptelecom in Vietnam? Sixteen percent. Telstra in Australia? Forty percent. Sky in the UK eighty percent. .. it depends. (I measure this for my day job, btw)

Hasn't it been on by default since 8 or 7?

Comcast supports it and it works as well or better than ipv4 for me.

I would guess everyone using a managed Comcast Gateway and Windows, or anyone on their Network who enabled it manually is running it by default.

See for yourself: https://www.google.com/intl/en/ipv6/statistics.html

Almost 36% of US based Google traffic, and 18-20% of worldwide Google traffic. It’s not exactly tiny anymore. Akamai claims over 40% of US traffic, 46% of Belgium, 36% of India, etc. The old meme that nobody is on IPv6 isn’t true anymore. Almost every major ISP from cable to AT&T has an IPv6 deployment in progress with considerable progress.

It's hard to determine meaning from two words, a number, and some scare quotes, but I'll take a wild guess at what you meant anyway. IPv6 privacy addresses are a mechanism to restore the privacy previously provided by NAT on IPv4, i.e., masking which actual device behind the same ISP customer (home or business) is opening a connection. Windows 10 breaking this functionality does not make sense under any reasonable threat model of Microsoft attacking your privacy: privacy addresses do basically nothing for the average home (just like NAT does basically nothing to privacy of outbound connections for the average home), MS has no access to the traffic that would contain a private address unless something else has already gone wrong, and it's easy enough to find your private IP address anyway: https://diafygi.github.io/webrtc-ips/ (which works for me in Debian stable, using the packaged version of Firefox and no non-free software).

Reply on news.ycombinator.com