Re:IPv6 Adoption
by zubspace on Wednesday July 26, 2017 @06:39AM
(#14855057)
Does someone know how to ban single users based on IPv6? Is this even possible? What is the alternative?
[ Parent
| on HN ]
It's not possible on IPv4 either, your IP is one of the easiest thing for you to change...
Browser/device finger printing is probably the best option at the moment, but you'll get plenty of false positives amongst privacy aware users who block fingerprinting.
I think the rough IPv6 equivalent of a single IPv4 ban would be to ban a /64 subnet. This bans all users in that subnet which is the same as banning an IPv4 subnet hiding behind a single NAT address.
This would be the case, except home users can often get a /56 or /48.
I'd say the same way you ban them with IPv4. IP bans are trivial to circumvent, so those who won't bother to/can't circumvent them with IPv4, also won't with IPv6.
It's the same as in IPv4.
If the user has a static IP address, in IPv4 you ban a /32 (i.e., one address, his own). In IPv6 you'd have to ban the entire range allocated to the user, usually a /64. (edited)
If the user has a dynamic IP address, well, you're on your own. :D
A /32 in IPv6 often is an entire provider, so that's not a good idea. A /64 is the closest to a single IPv4 address, (although some providers give each customer a /56 or so, for creating subnets).
With CG-NAT on IPv4, banning a v6 /64 is no worse than banning an v4 /32.
The alternative is to let them post and just hide their stuff from other people; see https://blog.codinghorror.com/suspension-ban-or-hellban/ for example.
HN has a system like that, but it fails because some people can still see the 'hidden' / dead posts, and for some reason they then go and point out "your comment shows up as [dead]", which defeats the purpose.
Just ban people without letting them know.