undefined | Better HN

0 pointsjusteleblanc3y ago0 comments

Your machines could change their IPs for every second of every day and you wouldn't come close to exhausting your /64 subnet for the next billion years.

0 comments

waych3y ago

The limit of changing addresses once every N seconds as N approaches 0 is equal to offline.

With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.

justeleblancOP3y ago

What kind of observer is 1. able to listen to the entirety of your network's outside communications, 2. interested at all in it, 3. harm you only on the condition that they "map out" your internal infrastructure? This isn't a novel, the goal is not to solve intricate security non-problems.

Spivak3y ago

Your ISP, "mapping your network" means being able to take data that was previously an amalgam of a household and reliably split it into the individual members and devices for better targeting.

2 more replies

waych3y ago

"The network is secure" is a common fallacy.

1 more reply

ianburrell3y ago

Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface.

More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.

waych3y ago

This looks like NAT pushed down to the endpoint itself.

You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

What are valid values in the scenario you are proposing? The defaults are 1 week / 1 day, so 7X. If you chose to rotate each second, and say allowed addresses to only be valid for say 20 minutes, this still appears to be a ~1200X blowup in routing overheads.

1 more reply

j / k navigate · click thread line to collapse

0 comments

waych3y ago

The limit of changing addresses once every N seconds as N approaches 0 is equal to offline.

With any usable N, a clever observer would still easily work out what you were doing and still map out your infrastructure.

justeleblancOP3y ago

Spivak3y ago

Your ISP, "mapping your network" means being able to take data that was previously an amalgam of a household and reliably split it into the individual members and devices for better targeting.

2 more replies

waych3y ago

"The network is secure" is a common fallacy.

1 more reply

ianburrell3y ago

Why would changing N seconds break network? It would presumably keep active addresses until connections finish. IPv6 requires supporting multiple addresses per interface.

More reasonable is to use new address for each connection. Then nobody can tell if 10 addresses and 10 connections are one device or ten.

waych3y ago

This looks like NAT pushed down to the endpoint itself.

You've saved the translation in the router, but now routing lookups and ARP caches have grown by TEMP_VALID_LIFETIME / TEMP_PREFERRED_LIFETIME.

1 more reply

j / k navigate · click thread line to collapse