I don't know enough about IPv6 but could it put you at risk posting a link in a public forum to a shot showing your IP?

In reply to a post by GonePostal:

I don't know enough about IPv6 but could it put you at risk posting a link in a public forum to a shot showing your IP?

Ideally you wouldn't show publicly your IPv6 address but if you did it isn't a major issue and depends which one you show. Remember you don't just have one IPv6 address (unlike IPv4), you usually have trillions and trillions!

For security most operating systems assign a temporary IPv6 address for use on the web, after a day or so the computer gets a new temporary IPv6 address, for the old one to likely never be used again in a billion years. Anyone with that old IPv6 address isn't going to get very fair with it. Even if they saw the IPv6 address whilst it was still live and tried to hack in then the firewall would block it and they'd not know if it was a live IPv6 address or not.

Also IPv6 gets attacked much less often if at all, because there are so many IPv6 addresses you can't possibly scan them all looking for open ports.

Of course turning on IPv6 doesn't make your network more secure as IPv4 is still the weaker link.

@E300

Thanks for the explanation.

Two things adding to what E300 said, The IP address that was shown was of course that of the device asking the question. Not the router. The same (misunderstanding) occurs when asking "What is my IP" from the thnkbroadband Main Site, or when setting up an IPv6 BQM.

The (static?) WAN IPv6 address of the router has to be established and substituted into the BQM field. In the case of AAISP it isn't even the same /48 as the one assigned to the punter.

Also one would hope that the router has a firewall which at the very least will block inbound connections and unsolicited packets.

IPv6 is slightly less secure than IPv4 in one respect because without NAT an attacker does at least have an IP address to aim for but any half-way decent firewall will see random attacks off so it's a very minor vulnerability and probably more than offset by other aspects of IPv6 such as the use of temporary addresses.

In Windows unless you disable the option your public ipv6 address (each computer on your network) changes every 24 hours. As pointed out it is pretty useless if hacked. I would take great delight when confronting one of the phone spammers who says 'your IP address has been compromised' of asking him which of my ipv6 addresses that was...

So if you run IPv6 on all you home devices how do you make contact with devices that keep changing their addresses?

I ask, although it does appear that most network devices I have at home can't run IPv6!

Because they have a fixed one as well, that is not broadcast. Plus an ipv6 LAN address on the equivalent to IPv4 192.168 ..... That starts with fe80:

Edit: Typo/brain-slip corrected.

Edited by RobertoS (Sat 05-Dec-20 09:47:09)

In reply to a post by RobertoS:

Plus an ipv6 LAN address on the equivalent to IPv4 192.168 ..... That starts with fe04:

IPv6 addresses beginning fe04: are not valid.

Every interface on a device has one link-local address, only valid and unique on that single link (comparable to the auto-configuration addresses 169.254.0.0/16 of IPv4), these have a fe80::/10 prefix.

It is possible to have unique local addresses (ULAs) which are intended for local communication only (comparable to IPv4 private addresses 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, but not intended to be used for NAT), these have a fc00::/7 prefix.

Typically one or more global unicast addresses (GUAs) which are intended for general communication (comparable to IPv4 public addresses), these have a 2000::/3 prefix.

In reply to a post by tdw42:

IPv6 addresses beginning fe04: are not valid.

The BQM checker agrees with you.

I have the address beginning with fe80::
and it is throwing up stating it's not a valid IP address so will not let me create a BQM over IPv6