Re: Giving up security & privacy when manually configuring addresses

In message <20170607.142936.74725051.sthaug@nethelp.no>, sthaug@nethelp.no writ
es:
> > > That's precisely the point. I configure fixed addresses typically for
> > > servers, and I put the addresses in the DNS. I *want* those addresses
> > > to be publically known. Security and privacy is not relevant in this
> > > particular case.
> > 
> > For an authoritative server, sure.
> > 
> > But if you're a recursive resolver then using privacy addresses while doing
> > recursion (and changing the privacy addresses frequently) might indeed be
> > very useful.  (In fact: a unique source address per query is wonderful.)
> 
> Different strokes for different folks. I'm fine with fixed addresses
> for the query sources of my recursive resolvers, and have no plans to
> change this. I have no problems with others using a unique source
> address per query.

And it really don't add much in terms of privacy as the /64 would
be the same.  Nor is it needed to combat spoofing of responses.  We
have DNS COOKIES for that.  We are looking at removing port
randomisation when talking with servers that support DNS COOKIES.
Send a query with a cookie then if we don't get a cookie response
resend using a random port.

> Steinar Haug, AS2116
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org

Re: Giving up security & privacy when manually configuring addresses - rfc4291bis text