0

Given that commands like ifconfig or ip address don't require root privileges, apps can access information about ip address. If you use ipv4, you are normally behind NAT and apps would get an address in the 192.168... range, which is not very valuable.

But one of the points about ipv6 is the absence of NAT. I imagine that when browsing the web, web applications don't have access to your file system, except the portions used by the browser.

But what if you run a non web application, it would still be able to get your real ipv6 address since it runs on your system.

Is this the case? And if so, how to protect against leaking?

Edit: I already run untrusted apps in a VM to sandbox, spoof strings etc. But IPv6 address still gives me away.

If I use NAT for IPv6 in a VM, it still allows for fingerprinting as not many people use NAT for IPv6.

One option is to disable it. I'm asking this question exactly to find out if it can be used safely. The IPv6 adoption rate is through the roof and we've already run out of Ipv4 addresses. Sure there's still ways to get it, but I imagine that in a few years there may be only IPv6 addresses available at your ISP. So yeah it's gonna be a ubiquitous technology that I'd like to use with VPN.

Edit 2: Okay, NAT6 is not much of a fingerprint since apps have much better ways to tag you. On a private network where you will use VPN, using NAT6 makes sense even though you lose the benefits of not using NAT.

17
  • 1
    This is basically asking, "can a binary gather local info about a system and send it somewhere?" and the answer is "of course". And many actually do. But that's no longer a "leak".
    – schroeder
    Jul 2, 2022 at 21:29
  • @schroeder Yes, you are right. The point I was making is that you can normally configure tunneling of the entire traffic on your system through a VPN, and the apps that run on your system as non root are unaware of that. But if you configure tunneling for ipv6, non root apps will still be able to get the real ip address.
    – lolz
    Jul 2, 2022 at 23:18
  • @schroeder Any ideas how to counteract it?
    – lolz
    Jul 2, 2022 at 23:54
  • 1
    I'm not sure what your threat model is here or what you want to prevent or hide your IP from. If you run a non-web application, it can get your IPv6 address as well as a ton of other identifying info from your machine. If you don't want that, then you run it in a sandbox or virtual bubble.
    – schroeder
    Jul 3, 2022 at 7:34
  • 1
    I'm not sure what you are trying to prevent. First you asked about leaking the IPv6 - with no context given why do you care about this (not even an appropriate tag). Then you asked about fingerprinting the device due to using NAT with IPv6. If this question is about privacy then a) please say so b) set the appropriate tags and c) have a look at IPv6 privacy extensions. These are enabled by default in many OS and cause a regular change of the IPv6 used, i.e. they are explicitly designed to protect against long term fingerprinting of a device based on IP. Jul 3, 2022 at 13:46

1 Answer 1

0

That's the case. You have these options

  • Don't run applications locally
  • Run them in a virtual machine
  • Disable IPv6 completely
1
  • Thanks for your answer. I already run them in a VM so that untrusted apps can't finger print real hardware etc. But yeah ipv6 stays real. I'll try NAT for ipv6 which feels a bit retarded, and it also leaves a big finger fingerprint as not many people use NAT for it... So yeah maybe the best option is disabling it completely...
    – lolz
    Jul 3, 2022 at 12:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .