Re: Address privacy

[Fernando Gont <[e-mail]>]

On 30/1/20 15:03, Ted Lemon wrote:
> On Jan 30, 2020, at 1:00 PM, Michael Richardson <[e-mail] 
> <mailto:[e-mail]>> wrote:
>>> Anecdotally, i would say unequivocally yes at a large scale eyeballs
>>> network, random iid has materially improved security of the host.
>>> The
>>> inability to do network scanning is huge.
>>
>> This feels like an anecdotal observation.
> 
> Furthermore, it’s mathematically simply wrong or else a non-sequitur.   
> If I have N addresses out of a space M, my chance of getting hit 
> randomly is N/M.  So the more temporary addresses I have, the higher the 
> change of a probe hitting me.

Of course attacker's don't think that way: Attackers don't randomly scan 
the IPv6 address space. That's a waste of time.

That said, what has addressed the problem of address scanning is 
RFC7217, *not* RFC4941. -- since attackers were after addresses that 
follow patterns, not the random ones.

On the other hand, when you consume information from the Internet, you 
are exposing your address. Host can simply not bind any ports to 
temporary addresses: -- this means that even if you expose your address 
for *consuming information* none of such nodes can contact you back. 
This would be a big improvement achieved via RFC4941.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492