Re: Disabling temporary addresses by default?

[Lorenzo Colitti <[e-mail]>]

On Fri, Jan 31, 2020 at 1:52 AM Gyan Mishra <[e-mail]> wrote:

> Lorenzo Colitti wrote on 29/01/2020 11:13:
>> > But don't enterprises care about not leaking the habits of their
>> employees?
>>
>> This is only a problem in SLAAC environments where privacy addresses are
>> turned off.  In DHCP environments, the network operator can change
>> endpoint addresses by policy if this is what they want to do.
>>
>
>    Gyan> Enterprises fall into a totally different camp altogether as far
> as “employee” privacy as that is non existent as all traffic is monitored
> to be business related traffic to the extent of web content blocking which
> most all companies implement.   The use of temporary addresses does not
> make sense for enterprises to employ as operations stability and 99.99999%
> available and MTTR( mean time to recovery) is of utmost importance.  By
> disabling the temporary address - simplified the enterprise network
> troubleshooting tremendously as only a single “stable” random address
> exists at all times.  As far as temporary address and “long lived”
> connections for enterprise business critical applications that can all be
> solved by disabling the temporary address..
>

I'm not talking about surveillance by the company. I'm talking about
surveillance externally. Think: it's not that hard to an employee's IP
address (e.g., send them an image in an email, call them using a p2p
application like skype, etc. etc.) If that IP address lives forever then
anyone who has that IP address could see if that employee went to their
website, would know what their browsing habits are, could serve them
tailored content, could attempt to mount attacks on that IP address, etc.
etc. If I were a corp IT admin I wouldn't want to be in a situation where
someone can publish all the IP addresses permanently used by my employees,
including the CEO, the CIO, all the VPs, etc.