NAT might have been what started it all, but PKI and DNS are the problem now I think.
Nobody wants to self host an insecure thing, but security t
requires self signed certs(A hassle, often not even supported well, nobody else can see it unless they go through the cert installing hassle either), or a domain name and let's encrypt(Manual work that costs money).
What I suspect we should have done is just collapsed TLS and IP into the same protocol, and put the certs hash right onto the IP, so that as long as DNS gives you the right address, you're secure.
Then all you have to do is make DNS run over that same secured IP, and DNS will never give you a bad IP, and as soon as you buy a domain, you get security without having to think about it at all on the application side, besides giving yourself a new key in your IP periodically or when it gets compromised.
Yggdrasil has it right, but they have to use almost the whole 128 bits, and rely on mesh routing, there's not really a way to fit traditional IPv6 routing AND good security in just 16 bytes.
Also, routers with bad UPnP implementations did not help. Now you can't rely on all non-technical users having it enabled because people don't trust it.
Nobody wants to self host an insecure thing, but security t requires self signed certs(A hassle, often not even supported well, nobody else can see it unless they go through the cert installing hassle either), or a domain name and let's encrypt(Manual work that costs money).
What I suspect we should have done is just collapsed TLS and IP into the same protocol, and put the certs hash right onto the IP, so that as long as DNS gives you the right address, you're secure.
Then all you have to do is make DNS run over that same secured IP, and DNS will never give you a bad IP, and as soon as you buy a domain, you get security without having to think about it at all on the application side, besides giving yourself a new key in your IP periodically or when it gets compromised.
Yggdrasil has it right, but they have to use almost the whole 128 bits, and rely on mesh routing, there's not really a way to fit traditional IPv6 routing AND good security in just 16 bytes.
Also, routers with bad UPnP implementations did not help. Now you can't rely on all non-technical users having it enabled because people don't trust it.