News for hackers. Stuff that matters.

A comment on Why you need IPv6. Parent comment

Re:Why you need IPv6 by kbaker on Thursday May 24, 2018 @12:17AM (#17141050)
Are you sure your router has PCP or NAT-PMP disabled, which _could_ expose ports on your external IPv4 IP without any interaction? Do you expect the average computer user to configure PCP securely on their router?

Various NAT traversal options are already pretty widespread. Having only a firewall keeps things much simpler.

[ Parent | on HN ]
Re:Why you need IPv6 by craftyguy on Thursday May 24, 2018 @01:27AM (#17141325)
> Having only a firewall keeps things much simpler.

Yes, for you and for attackers. Security strategies require layers, since no one layer can be depended upon to stand on its own. Removing NAT is removing a layer of security. Suddenly your firewall has to stand on its own. Good luck!

Edit: Why is my comment bad?

[ Parent | on HN ]
Re:Why you need IPv6 by zAy0LfpBZLC8mAC on Thursday May 24, 2018 @02:13AM (#17141488)
NAT is not a layer of security. At all. A billion layers of no security is still no security.

(And actually, NAT is a negative contribution to security as it hides the lack of a firewall when it isn't there or doesn't work, which would be trivial to detect without NAT.)

[ Parent | on HN ]