Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: ransomnote

IPv6 was necessary because IPv4’s 32 bits was inadequate even for every human to have their own IP address, much less the number of computers we have now.

But they “improved” things in a foolish way (IMHO). Not only was IPv6 quite incompatible with IPv4 (it needed new software and often new hardware), but they killed privacy by designing it to require a *unique* IPv6 address (128 bits) for every device on the Internet (computer, phone, TV, automobile, air conditioner, etc.).

It’s too bad they didn’t follow the lead of Ma Bell when they introduced Area Codes and Direct Distance Dialing in a backward compatible manner. When that was done (by simply adding digits to the phone number), you didn’t have to get a second phone number and add a new phone to use the new feature.

There were (and still are) some reserved IPv4 addresses that could have been used to indicate that what followed was actually IPv6, which then could probably have been handled in a compatibility mode.


22 posted on 09/05/2024 4:45:48 PM PDT by powerset
[ Post Reply | Private Reply | To 1 | View Replies ]


To: powerset

With IPv6 there are four days to allocate a unique IPv6 address for a device: SLAAC, DHCPv6 (stateful), RD (stateless), or static.

SLAAC (Stateless Address Autoconfiguration) is the default method for allocating a local LAN address. It uses the MAC address for the bottom 64 bits of the 128 bit address.

It didn’t take long for privacy concerns to be raised about SLAAC in the developer community, so they started randomizing the bottom 64 bits by default. Today, Windows, Android, Linux and Apple all use randomized SLAAC.

A SLAAC address is not routable on the public Internet. The upper 64-bits are hardwired to FE80:0:0:0. As such, it only works inside the LAN in your home (same as your MAC address). Conceptually it works similar to WiFi privacy settings for the MAC address. For this reason, some people like to change the default to back to the old way of using the MAC address for the bottom half, which can use useful in a home setting for tracking your devices.

A web/mail server will typically use a fixed public routable 128 bit IPv6 address, which gets published in DNS.

For non-static routable IPv6 addresses, the choices are DHCPv6 (stateful) or RD (stateless). DHCPv6 allocates the bottom bits from a fixed pool of manually assigned addresses. It is more complicated to set up than RD, as it requires a server to track the allocations (the state). The advantage is that it allows the centralized tracking all addresses on your LAN, which can be useful in a large organization that is concerned about internal security, e.g., to prohibit the use of unauthorized devices on the premises. Use of DHCPv6 is rare otherwise. (ISPs with older IPv6 implementations also sometimes use something called DHCPv6-PD for public routing.)

Most modern ISPs today use RD (Router Discovery). A set-top box that your ISP gives you will announce the 64-bit bit public prefix via periodic IPCMPv6 broadcasts on your home network. Your PC or phone picks up the broadcasts to get the routable prefix. RD is stateless in that router merely announces the upper 64-bit prefix and doesn’t care about the lower 64 bits. RD works similarly to SLAAC, except instead of using a fixed upper half (FE80:0:0:0) it uses whatever the your ISP announces as the public routable prefix.

RD newer than DHCPv6-PD, so it always has randomization baked-in for the bottom half. This is by design for privacy. I think you can turn it off if you want (similar to SLAAC). But be careful, however, because RD allocates a *public* IPv6 address prefix for your device. This means that it can be used to fingerprint your device using the bottom 64 bits. For this reason I recommend leaving your RD configuration alone if you care about anonymity on the Internet.

In the IPv6 world, every device gets at assigned least two addresses: a SLAAC address and an RD address. SLAAC is for local communication only, so privacy isn’t as much of an issue for it.


35 posted on 09/05/2024 11:03:45 PM PDT by Gideon7
[ Post Reply | Private Reply | To 22 | View Replies ]

To: powerset

It turns out that D.J. Bernstein (https://cr.yp.to/djb.html), who is well known for his cryptographic and computer security expertise, already had observed in his article “The IPv6 mess” (https://cr.yp.to/djbdns/ipv6mess.html) that:

“The IPv6 designers made a fundamental conceptual mistake: they designed the IPv6 address space as an *alternative* to the IPv4 address space, rather than an *extension* to the IPv4 address space.”


40 posted on 09/06/2024 9:22:00 PM PDT by powerset
[ Post Reply | Private Reply | To 22 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson