Hacker News Reader

Comment by ejdyksen | Hacker News Reader

> If I have an LTE iPhone on Verizon, is it even capable of talking to an IPv6 site?

Yes. All LTE devices on Verizon are given real, globally routable IPv6 addresses. You can test this here: http://test-ipv6.com.

This presentation [1] is pretty interesting, showing how aggressive Verizon was with IPv6 on their LTE network.

> At first read I thought the headline meant that 25% of consumer traffic was going to IPv6 sites, which seems impossibly high.

Keep in mind that many popular websites--Yahoo, Facebook and Google among them--now publish AAAA records in DNS. With that in mind, this statistic isn't that unreasonable. If you have a Verizon iPhone, you're probably reaching Google via IPv6 without realizing it.

[1] http://conference.apnic.net/__data/assets/pdf_file/0017/5081...

View on HN

> If you have a Verizon iPhone, you're probably reaching Google via IPv6 without realizing it.

Which is the only way it should ever be.

Unfortunately, if IPv6 is invisible it doesn't provide any feedback against the "IPv6 is not happening and will never happen" narrative (example: https://news.ycombinator.com/item?id=5586519 ).

> Yes. All LTE devices on Verizon are given real, globally routable IPv6 addresses.

With globally routable addresses, where is the protection for attached devices from global attacks? Does VZW firewall their network, or are they relying on their supported devices not having open, vulnerable ports?

Verizon runs an IPv6 firewall on their LTE network. This means that even with a public IPv6 address you still can't make a connection to your phone from the outside. I understand why they did it, but it is sad to not be able to SSH into my LTE device over the WAN.. Maybe that will be an optional feature in the future?

I was a little surprised by your comment. Maybe I'm reading it wrong but it seems that you expect your service provider to filter traffic for you. I have the exact opposite expectation. Do you expect the same thing from your ISP at home?

Of course not, but most consumers rely on default home router NAT configurations to at least protect them from drive by attacks on insecure devices. That's not an option in a mobile context, so I was curious at what level VZW expected their customers to be protected.

I do expect my service provider to filter packets for me. Not for any freedom-loving perspective, but for very practical ones:

My phone is battery powered. My cell phone link uses a lot of power when active compared to when inactive. I don't want some random ass killing my battery life by packet spamming me.

My cell phone provider charges me for data. Would that include random UDP packets spammed at my device?

The abuse potential is high enough that it concerns me. Having some sort of firewalling on the provider side seems straight up useful.

For the umpteenth time, NAT is not a replacement for a firewall.

http://security.stackexchange.com/questions/8772/how-importa...

The parent doesn't seem to be arguing for NAT, just asking what sort of protections are in place. Verizon has done the correct thing here. No NAT, global addresses, firewall in place. That said, their firewall rules are very conservative, to the point where they provide NAT-like default deny of all unsolicited incoming traffic.

How ISP level firewalls should be configured is an interesting and open question for consumer level connections. For mobile connections default deny seems like an OK place to start, given that mobile connections tend to be shared and metered. I hope that this doesn't stifle the innovation that could come from true peer to peer mobile connectivity though.

If your device is open by default, it's open on WiFi or to other VZW customers. In every case, the wrong answer is trusting the network to protect you.

The typical WiFi network is NAT'd with a default no-forward policy (or even more locked down), so even an insecure device is vulnerable only to other devices on the same network. That's much smaller than the universe of folks running portscans against globally routable addresses.

Presumably VZW's IPv6 configuration is similar, though I'd be interested to hear exactly what connections are allowed between devices at different locations within their own network. Wouldn't be surprised if they're completely forbidden.

Of course the network should not be trusted to protect you. But in the real world, everyday consumers are connecting insecure devices, and I'm curious how VZW is going about saving them from themselves.

> That's much smaller than the universe of folks running portscans against globally routable addresses.

You do realize just how many IPv6 addresses there are? The good old days of randomly scanning the interwebs in the hopes of finding an IP are gone, at least, for IPv6.

The minimum assignment form RIPE/ARIN etc to an ISP is a /32. Meaning Verizon on it's own has at least the same number of /64's as the entire IPv4 internet has IPs..

That's 4,294,967,296 /64's.

A single /64 is 4 billion times the entire IPv4 address space.

It's true that NAT reduces the risk of portscans but that's not much of a benefit any more. For at least a decade the accepted best practice has been host rather than perimeter level security and that's only become more important over time. It took awhile but the average device sold today doesn't have anything listening by default; at this point you're just subsidizing a few market-trailing manufacturers.

Reply on news.ycombinator.com