Re: Disabling temporary addresses by default?

[Gyan Mishra <[e-mail]>]

On Wed, Jan 29, 2020 at 6:13 AM Lorenzo Colitti <[e-mail]> wrote:

> On Wed, Jan 29, 2020 at 2:46 AM Gyan Mishra <[e-mail]> wrote:
>
>>    The main reason this topic comes has up is due to possible impact of
>> usage of the temporary address when it gets deprecated with long lived
>> session.  That’s the crux of why this topic is critical and has severe
>> operational impact. When the address changes for long lived connections
>> from the deprecated temporary address to the new preferred address, the
>> session would terminate and have to re-establish, which is impacts the user.
>>
>
> If there is a permanent address as well, then an application that is not
> able to deal with session resets (like SSH) can use
> the IPV6_PREFER_SRC_PUBLIC socket options to use the permanent address
> instead.
>

    See section 5.  A lot more needs to be done as far as API development -
https://tools.ietf.org/html/draft-gont-6man-address-usage-recommendations-04#section-5



>
>> This would allow us to maintain privacy extension temporary address
>> enabled by default change to benefit privacy advocates and also eliminate
>> impact for enterprise users where availability and stability is utmost
>> importance.
>>
>
> But don't enterprises care about not leaking the habits of their
> employees? If I was on an enterprise security team, I would be pretty
> concerned about the levels of leakage and cross-site tracking that are
> enabled by never changing the IPv6 addresses of a host. This doesn't happen
> in IPv4 because we use NAT, but it will definitely happen in IPv6.
>

   From an enterprise IT perspective network access is all monitored at the
application layer with content filtering blocking URI access.  So the
anonymity or privacy concerns for an individual at home connected to the
internet at home is an IETF objective to maintain per RFC 7258 pervasive
monitoring.  That same objective does not exist for enterprise IT hosts.
In most if not all cases, the endpoint host is owned by the company and has
monitoring software loaded to maintain IT security, and ensue security
patches levels are up to date on endpoints, as well as web content
filtering and restricted access to install or remove software.  For BAU
IPv4 connections on a corporate intranet the IPv4 address is stable and not
changing.  With IPv4 Nat is only used for “hide Nat” to hide internal space
and use of web proxy.  For internal communications within a corporate
intranet Nat is used when address overlap exists. Even with IPv6 6to6 Nat
and is employed within the DMZ for “hide Nat” to eliminate attack vector
from any external entity extranet or internet.  As well as 6to6 web proxy
for internet web access.  From an IT operations perspective, as far as
IPv6, limiting the number of addresses on the endpoint for MTTR ( mean time
to recovery) for availability is the primary objective for an enterprise.
Stable random IPv6 address works best to meet the objective of an
enterprise.

> --

Gyan  Mishra

Network Engineering & Technology

Verizon

Silver Spring, MD 20904

Phone: [phone]

Email: [e-mail]