Re: [v6ops] IPv6 new access from Windows to Google: display of a critical security alert

[Alexandre Petrescu <[e-mail]>]

Le 31/10/2019 à 15:32, Owen DeLong a écrit :
>
>
>> On Oct 31, 2019, at 3:25 AM, Alexandre Petrescu 
>> <[e-mail] <mailto:[e-mail]>> 
>> wrote:
>>
>> Google alerted me a few days ago during my DHCPv6 experiments, when I 
>> browsed it with a Windows computer using IPv6 first time, although 
>> many times previously with IPv4.
>>
>>
> Since I don’t speak French, it’s hard to interpret the error message 
> and I can’t paste the contents of an image into google translate.
>
>> Incidentally, the address my Windows used was an address delivered by 
>> DHCPv6. Being DHCPv6 is visible in its format: in the hextet 
>> representation, the '::' appears before the last two hextets 
>> (X::b4cc:8eb9) as opposed to a SLAAC address where the double colon 
>> appears quasi always before the last _four_ hextets.
>>
>>
> Google can’t tell how you got the address. The position of the :: is 
> irrelevant. This is simply an artifact of the UI in question. Any 
> address which contains contiguous hextets of all zeroes (e.g. 0:0:0) 
> may abbreviate one such group of hextets to ::.
>
> Example: 2001:d8b:0:0:53a2:0:0:1 can be written as:
> 2001:db8::53a2:0:0:1
> 2001:db8:0:0:53a2::1
>
> All three of the above expressions represent the same exact 128-bit 
> address.


Well I never seen an IPv6 address that is SLAAC'ed and has so many 
leftmost 0s.

But I agree with the principle you say.


>> I am trying to understand why Google complained wiht such a critical 
>> security alert.
>>
> Hard to say. Is the security alert about your address or is it about 
> the site you were trying to visit?


It popped up when I tried to visit ipv6.google.com with firefox most 
recent.  But I guess it tried first to sign in on my Google account, or 
something like that.  They should know what they tried to do with my 
connection.  What I know is that it did not deserve such a security alert.

> If you can provide an English translation of the message, it might be 
> possible to provide better advice.

Manual translation is hard.  See automated translation below. The 
original html (so one can copy paste), and the result of a button click 
on 'Info' button on that page, are attached.


> Access to your account by a suspicious application has been blocked
> [e-mail]
> Google has prevented anyone from signing in to your account using an 
> app that does not belong to Google. If it was not you, it means that 
> someone else knows your password. We advise you to modify it immediately.
> 
> Unrecognized device
> 
> 17 minutes ago
> 
> Near "City, France"
> 2a01: X: Y: ce10 :: b4cc: 8eb9 (IP address)
> Have you recently been unable to sign in to your Google Account?

>
>> - is it because the address was a DHCP address rather than SLAAC?
>>
> No. Google can’t tell how the address was assigned. It’s just another 
> 128 bit number from Google’s perspective.
>
>> - it is because I connect from an address they have never seen before?
>>
> Without being able to decipher the error message, it’s hard to say.
>>
>> - is it because it is the first time I connect to them by IPv6 on 
>> this computer?
>>
> Not likely.
>>
>> - is it because when I connect with IPv6 to them I keep changing the 
>> IPv6 address (as opposed to IPv4 is always the same because behind NAT)?
>>
> Not likely.


Is it because https on IPv6 might not work as well as on IPv4?

Alex