• 0 Posts
  • 32 Comments
Joined 2 years ago
cake
Cake day: June 4th, 2023

help-circle
  • I check youtube for replacement videos for battery and screen

    You already lost me there. My times of looking up video guides on how to repair my phone are over, I can replace the battery with my hands and the screen is mounted with 8 screws. OEM parts can be ordered directly from Fairphone and arrive within 2 days.

    all replacements done with chinese parts, ultra-cheap and locally available.

    It is incredibly difficult to get OEM parts for many phones, you never know if it is a good part until you actually have it in your hand. In some cases it doesn’t matter but I have never seen a cheap third party screen which comes close to the original.

    I figure I’m doing everyone a service by repurposing a discarded 5 year old phone.

    You are, the best phone for the environment is an old phone.


  • what’s your use case that you need that kind of a phone?

    I repair my phones when they break and the easy repair of a Fairphone is in no way comparable to the absolute pain it is to remove the display on a phone released in the last 5 years.

    Especially considering they provide a 5 year warranty, source fair materials, 8 years of security updates and many more years to come with full access to replacement parts.











  • There is this notion that IPv6 exposes any host directly to the internet, which is not correct. When the client IP is attacked “directly” the attacker still talks to the router responsible for your network first and foremost.

    While a misconfiguration on the router is possible, the same is possible on IPv4. In fact, it’s even a “feature” in many consumer routers called “DMZ host”, which exposes all ports to a single host. Which is obviously a security nightmare in both IPv4 and IPv6.

    Just as CGNAT is a thing on IPv4, you can have as many firewalls behind one another as you want. Just because the target IP always is the same does not mean it suddenly is less secure than if the IP gets “NATted” 4 times between routers. It actually makes errors more likely because diagnosing and configuring is much harder in that environment.

    Unless you’re aggressively rotating through your v6 address space, you’ve now given advertisers and data brokers a pretty accurate unique identifier of you. A much more prevalent “attack” vector.

    That is what the privacy extension was created for, with it enabled it rotates IP addresses pretty regularily, there are much better ways to keep track of users than their IP addresses. Many implementations of the privacy extension still have lots of issues with times that are too long or with it not even enabled by default.

    Hopefully that will get better when IPv6 becomes the default after the heat death of the universe.


  • Will take a look at the talk once I get time, thanks. If you can find the original one you were talking about, please link.

    For servers, there is some truth that the address space does not provide much benefit since the addressing of them is predictable most of the time.

    However, it is a huge win in security for private internet. Thanks to the privacy extension, those IPs are not just generated completely random, they also rotate regularily.

    It should not be the sole source of security but it definitely adds to it if done right.


  • With NAT on IPv4 I set up port forwarding at my router. Where would I set up the IPv6 equivalent?

    The same thing, except for the router translating 123.123.123.123 to 192.168.0.250 it will directly route abcd:abcd::beef to abcd:abcd::beef.

    Assuming you have multiple hosts in your IPv6 network you can simply add “port forwardings” for each of them. Which is another advantage for IPv6, you can port forward the same port multiple times for each of your hosts.

    I guess assumptions I have at the moment are that my router is a designated appliance for networking concerns and doing all the config there makes sense, and secondly any client device to be possibly misconfigured. Or worse, it was properly configured by me but then the OS vendor pushed an update and now it’s misconfigured again.

    That still holds true, the router/firewall has absolute control over what goes in and out of the network on which ports and for which hosts. I would never expose a client directly to the internet, doesn’t matter if IPv4 or IPv6. Even servers are not directly exposed, they still go through firewalls.


  • Anything connected to an untrusted network should have a firewall, doesn’t matter if it’s IPv4 or IPv6.

    There’s functionally no difference between NAT on IPv4 or directly allowing ports on IPv6, they both are deny by default and require explicit forwarding. Subnetting is also still a thing on IPv6.

    If anything, IPv6 is more secure because it’s impossible to do a full network scan. My ISP assigned 4,722,366,482,869,645,213,696 addresses just to me. Good luck finding the used ones.

    With IPv4 if you spin up a new service on a common port it usually gets detected within 24h nowadays.