Re: Giving up security & privacy when manually configuring addresses - rfc4291bis text (Re: draft-bourbaki-6man-classless-ipv6-00)

[Simon Hobson <[e-mail]>]

Lorenzo Colitti <[e-mail]> wrote:

> But they could. If the server had a /64 prefix, then it could store useful information in the 64 bits. For example, SNI (which sends information in the clear) might not be necessary any more.

I don't think that's much of a security feature !

Whether you use SNI or distinct addresses, it's clear what site the packets are going to. If anything, it's easier with distinct addresses as you only need to see the destination address field rather than inspect the contents of the packet to get the SNI element. The sort of people who are going to be looking into packets to get the SNI will have no trouble building a table of addresses-sites to map destination addresses to site just using destination address.


Mark Smith <[e-mail]> wrote:

> If you choose to specifically lower device security against discovery
> by putting routers in DNS, or allowing routers to respond to
> traceroutes, you consciously know you're lowering it for the specific
> device and can be vigilant when taking other measures to raise it
> again (ACLs etc.)

Firstly, I think you are over-estimating the skills of the "typical" network admin. In my experience, only a small minority would realise the tradeoffs and take any sensible measures - hence the figures given for the number of known Cisco devices with the front doors open. It was interesting when I pointed NetDisco at the campus network I used to admin and saw how many of the customers' routers it was able to interrogate just by following CDP neighbour information from my Cisco switches (which were locked down with non-standard SNMP community strings). These were mostly engineering firms in an industry where you'd expect security to be "somewhat better" !

But then we come to the other aspects. One of my pet peeves is people who disable pings (and/or traceroute) "for security" - and thus making network troubleshooting far more of a problem than it should be.

But if you are going to use well randomised addresses for network devices - you will have to put them in DNS if you want to be able to access them in a convenient manner. Once you put them in DNS, then you've lost half the benefit of random addresses anyway. Well you could randomise the DNS names - but then you shift the problem to knowing the DNS name !