Comment by beagle3 | Hacker News Reader

Comment by beagle3 | Hacker News Reader

Parent Full thread

I am not familiar with the UK situation these days, but every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing.

> And much of the world, especially on mobile, doesn't even have an IPv4 address of their own - they're NATed along with their ISP's other subscribers through a handful of IPs for a whole ISP. An IPv6 address is the only address they actually have.

And that's a great thing, if you care about privacy (and I do). And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends, and if you want a public IPV4 address, the going rate wherever I look is about $1/month.

> IPv6 is the only way we're ever going to create working peer-to-peer infrastructure

We practically have less-than-perfectly-but-still working peer to peer; the lack of immediately direct connection is not, I believe, what's stopping "working peer to peer" from happening -- the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25, and for good reasons - most users cannot be trusted to run an addressable peer. So with IPv6 it would be technically easier to p2p, but practically the same as it will be firewalled by the ISPs.

And the price for this improvement will be utter complete tracability of your actions among every website -- right now, google and facebook can only (easily) exchange info about you if you gave enough of it to them, or if they decide to share cookies (which you can see and stop). On IPV6, it would be enough for them (and wikipedia, and ISPs and everyone else) to just trade access logs.

> every country I've visited in the last year (US, quite a few european and a couple of asian) IPV6 wasn't more than a small irrelevant thing

Well, yes. It works so long as you're connecting to someone else who has an IPv6 address, you don't really care about it unless it's broken.

> And that's a great thing, if you care about privacy (and I do).

It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript.

Again, if you want to be anonymous on the internet, use Tor. It accomplishes what you're looking for in a NAT to a much better degree. If you want to keep other users' privacy, encourage the use of onion routing in new protocols, and encourage the use of Tor to access the legacy internet.

> And yet, peer to peer on these things works reasonably well using ICE, STUN, TURN and friends

Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system.

> the vast majority of the ISPs in the US, for example, block incoming port 80 and outgoing port 25

And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented.

FTR, they block incoming port 80 because they want to maintain an artificial differential between "consumer" and "business", not any security rationale - most of the rest of the world doesn't do that, they just have a firewall blocking everything incoming on the ISP-provided router by default, and you can unfirewall port 80 if you want to. Blocking outgoing port 25, otoh, is done because SMTP is a terrible protocol that by default assumes every node on the internet is trustworthy, and ISPs were roped in to ensure nobody ever had to change it.

> It's really not. Your ISP can quickly deanonymize you, and there's regular "misconfigurations" which do. Facebook et al have no problem tracking you between sites pretty much no matter what you do - your browser cache can be used for that without even touching javascript.

Actually, facebook has a great problem tracking me between sites, because I make sure that they have these great problems (by using different VMs for different aspects of my works and life, none with access to hardware acceleration, by using proper web filtering at both the browser and gateway level). They have it easy with the vast majority of the population, no doubt, but for now my actions gets mixed with everyone elses in such a way that Facebook would actually have to assign a person to deanonymize me. Similarly Google.

My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request (I'd be surprised if they actually demand a warrant). Switching to IPv6 would effectively deanonymize me constantly.

> And allow all other ports, hopefully? Peer-to-peer infrastructure is not going to run over HTTP and email. It's going to run over brand new protocols and ecosystems, many of which are sitting in a variety of research papers waiting to be implemented.

That's a great ideal. No, they don't allow all other ports, but what they allow or block varies a lot by service class, area and ISP, and you'd know for sure only after you tried (it used to also change often, but I heard it's converged; I'm not living in the US anymore)

> Which require, of course, somebody running a centralised server and willing to pay for the bandwidth of TURN. This outright prevents proper peer-to-peer infrastructure from happening - the people running these services need to pay for them somehow. Even working around it via e.g. Skype's "supernodes" is expensive in terms of developer cost and the amount of expertise needed to create such a system.

Supernodes were retired because they do not work well anymore (haven't in a few years). I do not find "pay $1/month to provide service" too onerous; there are also public ICE/STUN/TURN.

I find it disingenuous that you completely dismiss the societal cost (privacy), and the engineering costs (the reason IPv6 is still not dominant despite being "in the works" for 20 years now), because some future protocol which had not been shown useful over those 20 years ("research papers waiting to be implemented"). There is enough IPv6 to make the case for the need, and the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago.

> My ISP can quickly deanonymize me, but at this point in time they don't unless they get a government request

http://www.bbc.co.uk/news/technology-16721338 - something I remember from recent-ish history. That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it.

> I find it disingenuous that you completely dismiss the societal cost (privacy)

I don't. I think there's other, significantly better solutions for it. I don't think NAT provides reasonable privacy in and of itself.

> the engineering costs

In practice, the fact that it's been spread out over 20 years so far is because that's how long it takes to get round to replacing an entire nation-wide deployment of carrier-grade infrastructure at all unless there's other reasons to do so. Smaller/regional ISPs have been on IPv6 for years now, partially because buying enough IPv4 space would be prohibitively expensive and partially because there's no reason not to. The technical details of IPv6 support were resolved in pretty much all networking kit a long, long time ago - it's a marginal cost at this point. The rest of it is primarily planning, testing, and replacing ancient consumer routers.

> the ONLY case that has been made is "we're running out of IPv4" which is not wrong, but far from dire as I can still get 100 IPv4 addresses for $50, which is the same price I've paid for it 10 years ago

And yet I can't get a real IP address for most of the things I'd like to. My ISP tries its hardest not to sell IPv4 addresses to anyone (it can't buy them quickly enough, and buying them is a huge resource drain - they lose money on every address sold, which is then made back up in subscription costs), let alone "home" users. On the other hand, it literally gives out static IPv6 ranges if you ask nicely.

> That data is, of course, still passed to O2's partner organisations (which don't seem to actually be listed anywhere), and you have no control over it.

Verizon was also doing this for mobile customers in the US, perhaps still do. I vote with my wallet against these ISPs. You did have some control over it, for example, by using HTTPS. But IPv6 prefixes are so plentiful, that they are assigned one-per-customer which makes correlating logs incredibly trivial; Even things like this O2/Verizon still required some per-ISP effort; no such thing with IPv6; no need to inject headers. The prefix is your undeletable cookie.

> I don't. I think there's other, significantly better solutions for it. I don't think NAT provides reasonable privacy in and of itself.

It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them.

The NAT only affords as much privacy as suffix randomization (as has been noted in this thread), which is "very little" to "not at all".

What are those other "significantly better" solutions you are aware of ? I've been looking for them, and found none.

> And yet I can't get a real IP address for most of the things I'd like to.

Likely because you are on a residential ISP and it's not their business (my ISP will gladly sell me one if I switch to the "business class" service, which is exactly the same except it costs about twice as much; I'd pay more to NOT have a fixed IP address).

Get an Amazon free tier and tunnel through it. Or pay $2 for a lowly VPS to tunnel through.

I don't think your wish to experiment is somehow more important than my wish for privacy. Neither of us get to actually vote (except with our wallet), though.

> It's not the NAT that affords privacy - it's the size of the address space which does have enough IP addresses, but not so many that an ISP can avoid reassigning them.

Again, we live in a world where CGNAT is a thing. My own ISP puts all IPv4 connections through CGNAT by default unless you explicitly opt out. Many smaller ISPs do the same - one of the new gigabit broadband services in my country will not allocate IPv4 addresses to customers, instead going for CGNAT and requiring an additional payment of £5 a month for an IPv4 address.

Mobile ISPs all implement CGNAT on IPv4 at this point - if they attempted to buy enough address space for every active mobile phone to have an IP, there'd be a serious problem.

Every single user on each of these networks does not have a routable IPv4 address. You cannot make a direct connection to these devices. IPv6 solves that problem.

> What are those other "significantly better" solutions you are aware of?

Tor. Future protocols should integrate HORNET or similar. If you really want a NAT without onion routing, use a VPN that'll do it.

> Likely because you are on a residential ISP

That's literally the point here. There's a differentiation between a "residential ISP" which can only ever consume and never participate as an equal part of the network, and a "business ISP" which is significantly more expensive because it comes with an SLA that I don't need or want.

IPv6 allows me to be an equal part of the network at the same cost as my current broadband service. I can run a website off my raspberry pi without paying anyone a penny. I can SSH/remote desktop into my home machine without having to create a "jump server". I can participate in peer-to-peer networks without depending on the hope that some other people on the network have machines that I can directly connect to, so that nobody else has to directly connect to me.

Ok, just to clear up the confusion (because not all posts in this thread use the same terminology):

Home NAT, which is equivalent to suffix randomization, does NOT afford any privacy.

Carrier Grade NAT, which would be equivalent to prefix randomization (if such a thing existed) DOES afford some privacy, provided that care is taken not to leak other data (through cookies, browser fingerprinting, stylometrics, etc).

I am not currently at home behind a CGNAT, because my ISP is apparently IPv4 rich, but they are planning to switch at some point. I am behind a CGNAT on my mobile. I have no problem doing peer to peer on either using a STUN server I run on a $2 VPS that comes with an IPV4 address. I also tunnel ssh to my home through it when I want to.

The same ISP, if I request an IPv6, will give me the prefix it assigned to me the day I signed up. That's how they roll (They actually play it as a feature - "you pay for a fixed IPv4, but you get a fixed IPv6 for free! without even asking!")

IPv6 allows you to play "equal part" - it's routable, yes, but if everyone was equal we would have mob rule by DDoS attacks way worse than we do now (perhaps everyone is equal and we will have them .... if that's the case, it will stop being the case after a few high profile attacks as such).

Also, 99.9% of the people do not know how to secure their networks or devices. If everything was routable, as you seem to desire, I think we'd be worse off. As it is, the local home NATs provide a bit of security (which no one would have designed - we got lucky they were there because of address scarcity) and the CGNATs/random V4 assignment provide a bit of privacy (which got lip service, but would not have been as effective if not for address scarcity).

My threat model includes "$company can track my whereabouts online regardless of what I do about it". Your threat model seems to be "I can't route to my server without another hop". It's not that one is valid and on is invalid - it's just that they are incompatible with each other.

> Also, 99.9% of the people do not know how to secure their networks or devices.

I take it that you've never heard of a firewall on your router. Mine ships default deny. I assume yours does too.

Doesn't help if the router is easily hackable - http://www.bbc.co.uk/news/technology-40382877

> "Because the default wi-fi password formats are known, it's not difficult to crack them," said Mr Munro. > Once an attacker has access to your wi-fi network, they can seek out further vulnerabilities.

I'm well aware of it, but that just means all those amazing peer to peer protocols[0] that are waiting to be implemented were hyperbole, doesn't it? You know, "default deny" and stuff. Oh sure, there will be a protocol, probably called "Universal hole-Punch aNd-get Pwned" or some acronym thereof, to relax that "default deny".

[0] https://news.ycombinator.com/item?id=14988022

v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front. You'll still be tracked with cookies and browser fingerprinting either way.

Out of curiosity... without cheating, what do you reckon v6 deployment is at for clients in the US -- that is, what percentage of clients do you think use v6 to connect to v6-enabled sites?

> v6 with privacy addresses is not very much different to current v4 with NAT on the privacy front.

Are you familiar of an ISP that will give you a new v6 prefix on demand (say, once every hour or day or week?) Or one that mixes all customers? otherwise, the NAT you do on your own behind that prefix is of very little (though not strictly zero) practical use; It just means that if someone gets access logs from two websites, they don't know if two requests were made from my laptop or one was from mine and the other from my kids.

I am not living in the US these days and have no knowledge on which to base the estimate ... but I haven't received an AAAA DNS record to any request I've made through several countries.

edit: added: My specific browser setup, described somewhere else around here, makes it hard to track or fingerprint. IPv6 takes that ability away from me (and everyone else).

> I haven't received an AAAA DNS record to any request I've made through several countries

Wait, whether you receive an AAAA DNS record has nothing to do with whether you're in IPv6 - it's to do with whether you're requesting AAAA records. How exactly are you testing this? What does `dig google.com AAAA @8.8.8.8` get you?

I actually never asked for Google, because I knew it worked; I've never asked for Amazon, because I assumed it worked -- only for the not-top-10 sites I use. However, I just tried amazon for the first time ever and got this:

$ dig www.amazon.com AAAA @8.8.8.8

    ; <<>> DiG 9.7.1-P2 <<>> www.amazon.com AAAA @8.8.8.8
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: xxxxx
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;www.amazon.com.			IN	AAAA

    ;; ANSWER SECTION:
    www.amazon.com.		1208	IN	CNAME	www.cdn.amazon.com.
    www.cdn.amazon.com.	55	IN	CNAME	opf-www.amazon.com.

    ;; AUTHORITY SECTION:
    opf-www.amazon.com.	895	IN	SOA	ns-191.awsdns-23.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60

    ;; Query time: 70 msec
    ;; SERVER: 8.8.8.8#53(8.8.8.8)
    ;; MSG SIZE  rcvd: 147

Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.

> Maybe they hate my ISP, but also anything behind cloudflare (e.g. news.ycombinator.com, and about 80% of the sites I regularly visit) doesn't seem to have an AAAA address.

We provide IPv6 for all our customers by default. Some customers choose to disable IPv6 (the most typical reason appears to be they have anti-abuse systems that require the client IP to be v4).

https://blog.cloudflare.com/98-percent-ipv6/

Thanks. I was aware of that, and still every cloudflared website I've ever checked was IPv4 only, for whatever reason - I assumed it was off by default, it's surprising that it's on by default and still so many turn it off.

I'm even more surprised at Amazon lacking an AAAA record, though. They surely have the data to tell, and IPv6 won't improve their retail business (or they have IPv6 fraud problems that would negate whatever improvement).

Can you share what percentage of customers have IPv6 turned off explicitly?

Can you share what percentage of hits to cloudflared sites can be IPv6 (even if they happen through IPv4)?

Last time I looked >99% of Cloudflare sites have IPv6 enabled.

Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record. Unfortunately many sites can't be bothered to do that despite it being a 5-minute job, since not doing it doesn't currently break anything in most cases, and might break things for the minority with broken IPv6 configuration.

Cloudfront now supports IPv6, so the reasoning for not enabling it on Amazon.com is likely similar.

> Cloudflare does support IPv6 (has since 2012), but requires that you actually set up the AAAA record

No, we don't. We operate a v6 to v4 gateway for you.

Reply on news.ycombinator.com