Hacker News Reader

Comment by alias_neo | Hacker News Reader

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic.

The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.

View on HN

Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read.

Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features.

Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.

> IPv6 can be a privacy issue

Why do people throw this out there as if it's a fact we all agree on?

I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes.

So... why keep saying this?

Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.

For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.

Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular.

P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.

>In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly).

Fair, but that's still IPv4 and IPv6 rotating at the same rate.

>In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly).

I'm in the rest of the world and my non-static IP address almost never changes. I actually memorised my external IP address at one point since I saw it so often.

This is wrong, at least in Europe, static IP is considered to be best practice.

I live in France and work in IT and never heard about this "best practice". Who claims that?

In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".

RIPE : https://www.ripe.net/publications/docs/ripe-690#5-2--why-non...

That's funny, because I kind of have the "lowest" fiber offering from Orange, and I don't think my IP ever changed ? (I wouldn't bet on it thought.)

The RIPE article is about IPv6. I use only v4

I monitor closely my Internet connection (since I serve stuff on it, and also because why not) and I saw my IP changing and wandering throughout the Ile-de-France. I would say that the changes are every 6 months or so (since one of my domain is with Gandi I had to write a checker and change the assignment through their API)

If you only use IPv4, then these days (with not only the Asiatic countries never having got IPv4, but Europe having ran out if IPv4 addresses), technically you don't have a "real" Internet connection any more.

I do not understand what you are saying. Do you imply thet IPv4 is non-existant in Asia??

How having ran out of IPv4 means that there is no "rea" Internet?

Honestly - it would be great if IPv6 caught up but the standard, first choice is IPv4.

My bad, I should have said that "some" Asian countries never had enough IPv4 addresses to start with. AFAIK this explains why India is one of the world leaders in IPv6 deployment ? (I've also heard that IPv6-only networks are not uncommon in some Asiatic countries ?)

IPv6 has been slowly rolled out for more than a decade now, though AFAIK the standard has only been finalized in 2017.

Since 2017, first choice should have been IPv6.

"Internet" stands for "International network". If you're using IPv4 only, when someone else uses IPv6 only, then obviously you won't be able to connect to each other. Therefore you aren't on the same network. And only one of them can be "really" called "Internet".

(Also, IPv4 was an experimental ARPANET protocol which wasn't supposed to be used "in production" worldwide, but here we are...)

Internet stands for interconnected network, with the capital "I" signifying that it's "the" interconnected network.

Not according to my network teacher (for the upper case one), but this is a moot point, since the result is the same.

Sadly anyway in theory, dual stack is less secure than single stack, despite whether IPv6 good or bad.

No firewall or opt-in firewall (which only a tiny fraction of people turn on) is pretty common for IPv6. It's also somewhat an open question whether router firewalls are even a good idea on IPv6 (since the security advantages are not that certain, and it can prevent the adoption of new protocols).

> pretty common for IPv6

Source? Every consumer router I've ever seen that supported IPv6 also had a firewall covering IPv6. Given the crapshot routers tend to be I wouldn't be surprised if some messed that up, but "pretty common" seems unlikely.

https://lafibre.info/ipv6/ipv6-le-firewall/

For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.

Ugh. Idiots. CPEs should default to firewall on.

Well, OTOH, the fact that tens of millions of people have now been connected through firewall-free/disabled IPv6 for years, yet the (somewhat expected) disaster of widespread hacking/compromises clearly didn't happen... which could mean that this is not that critical of a security feature as could be expected ?

IPv6 privacy issue? You know that you get /32 block, you can change your IP from that block every hour if you want.

The issue with IPv6 is that links are significantly slower than IPv4 links today.

see: https://tools.ietf.org/html/rfc4941

Reply on news.ycombinator.com