0

Given that commands like ifconfig or ip address don't require root privileges, apps can access information about ip address. If you use ipv4, you are normally behind NAT and apps would get an address in the 192.168... range, which is not very valuable.

But one of the points about ipv6 is the absence of NAT. I imagine that when browsing the web, web applications don't have access to your file system, except the portions used by the browser.

But what if you run a non web application, it would still be able to get your real ipv6 address since it runs on your system.

Is this the case? And if so, how to protect against leaking?

Edit: I already run untrusted apps in a VM to sandbox, spoof strings etc. But IPv6 address still gives me away.

If I use NAT for IPv6 in a VM, it still allows for fingerprinting as not many people use NAT for IPv6.

One option is to disable it. I'm asking this question exactly to find out if it can be used safely. The IPv6 adoption rate is through the roof and we've already run out of Ipv4 addresses. Sure there's still ways to get it, but I imagine that in a few years there may be only IPv6 addresses available at your ISP. So yeah it's gonna be a ubiquitous technology that I'd like to use with VPN.

Edit 2: Okay, NAT6 is not much of a fingerprint since apps have much better ways to tag you. On a private network where you will use VPN, using NAT6 makes sense even though you lose the benefits of not using NAT.

17
  • This is basically asking, "can a binary gather local info about a system and send it somewhere?" and the answer is "of course". And many actually do. But that's no longer a "leak".
    – schroeder
    Jul 2 at 21:29
  • @schroeder Yes, you are right. The point I was making is that you can normally configure tunneling of the entire traffic on your system through a VPN, and the apps that run on your system as non root are unaware of that. But if you configure tunneling for ipv6, non root apps will still be able to get the real ip address.
    – lolz
    Jul 2 at 23:18
  • @schroeder Any ideas how to counteract it?
    – lolz
    Jul 2 at 23:54
  • @lolz: If you let untrusted code run without further separation (like a browser offers) this is exactly what you get. And getting access to the IP address is likely the smallest problem then - because you trust the program to do arbitrary code execution on your system. If you want to protect against this you have to somehow sandbox the code, like running it inside a virtual machine which then can also NAT IPv6 or simply disable it. Jul 3 at 2:09
  • 1
    I'm not sure what you are trying to prevent. First you asked about leaking the IPv6 - with no context given why do you care about this (not even an appropriate tag). Then you asked about fingerprinting the device due to using NAT with IPv6. If this question is about privacy then a) please say so b) set the appropriate tags and c) have a look at IPv6 privacy extensions. These are enabled by default in many OS and cause a regular change of the IPv6 used, i.e. they are explicitly designed to protect against long term fingerprinting of a device based on IP. Jul 3 at 13:46

1 Answer 1

0

That's the case. You have these options

  • Don't run applications locally
  • Run them in a virtual machine
  • Disable IPv6 completely
1
  • Thanks for your answer. I already run them in a VM so that untrusted apps can't finger print real hardware etc. But yeah ipv6 stays real. I'll try NAT for ipv6 which feels a bit retarded, and it also leaves a big finger fingerprint as not many people use NAT for it... So yeah maybe the best option is disabling it completely...
    – lolz
    Jul 3 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.