Re:IPv6 Adoption
by michaelmior on Wednesday July 26, 2017 @06:55AM
(#14855119)
Cloudflare has pseudo IPv4 for exactly this purpose
https://support.cloudflare.com/hc/en-us/articles/202494830-P...
It doesn't sound to me like those pseudo IPv4 addresses would be useful for geolocation.
Re:IPv6 Adoption
by michaelmior on Wednesday July 26, 2017 @11:37PM
(#14862518)
Good point, probably not. Although it does partially solve the problem.
Does someone know how to ban single users based on IPv6? Is this even possible? What is the alternative?
It's not possible on IPv4 either, your IP is one of the easiest thing for you to change...
Browser/device finger printing is probably the best option at the moment, but you'll get plenty of false positives amongst privacy aware users who block fingerprinting.
I think the rough IPv6 equivalent of a single IPv4 ban would be to ban a /64 subnet. This bans all users in that subnet which is the same as banning an IPv4 subnet hiding behind a single NAT address.
This would be the case, except home users can often get a /56 or /48.
I'd say the same way you ban them with IPv4. IP bans are trivial to circumvent, so those who won't bother to/can't circumvent them with IPv4, also won't with IPv6.
It's the same as in IPv4.
If the user has a static IP address, in IPv4 you ban a /32 (i.e., one address, his own). In IPv6 you'd have to ban the entire range allocated to the user, usually a /64. (edited)
If the user has a dynamic IP address, well, you're on your own. :D
A /32 in IPv6 often is an entire provider, so that's not a good idea. A /64 is the closest to a single IPv4 address, (although some providers give each customer a /56 or so, for creating subnets).
With CG-NAT on IPv4, banning a v6 /64 is no worse than banning an v4 /32.
The alternative is to let them post and just hide their stuff from other people; see https://blog.codinghorror.com/suspension-ban-or-hellban/ for example.
HN has a system like that, but it fails because some people can still see the 'hidden' / dead posts, and for some reason they then go and point out "your comment shows up as [dead]", which defeats the purpose.
Just ban people without letting them know.
Unfortunately I can't find a link - I think they closed the issue tracker. Perhaps dang can comment? I'm typing from memory so it might be remembering incorrectly.