Hacker News new | ask | show | jobs
by littlestymaar 1302 days ago
Being behind a NAT poses constraints for p2p technologies (you need some well-known servers to do the hole-punching and act as a relay, but that's not too different from the well-know IPs that are needed for bootstraping a regular p2p system anyway, except of course, not every NAT are friendly to hole punching, and that's a problem as well…) but that also has a significant security and privacy advantage: since you aren't openly connected to the internet, you don't casually leak your computer's IP to the random strangers you're interacting with (at least when we're talking about a NAT you share with other people, not just your ISP box's NAT) and the amount of harm they can actually do to you is significantly lower.

In the end I think the internet would actually be a significantly better place security-wise for p2p if IPs weren't directly routable by default, and NAT with all its limitations gives you mostly that.
1 comments
dinosaurdynasty 1302 days ago
NAT punching definitely tells other peers your NAT's IP address (and often your local address too, but that's less important).

Unless you're behind CGNAT, your NAT IP can often be used to find your neighborhood with public information. With private information (a legal challenge for example) you can find the exact subscriber/house.

link
littlestymaar 1302 days ago
> NAT punching definitely tells other peers your NAT's IP address

Yes, and that's all you share, so when the NAT is shared with other people (like other students on a campus for instance, or other customers of your phone mobile phone carrier) the amount of info that can be collected is much lower than if you have a public IP address for your computer.

> Unless you're behind CGNAT

Did you read what I wrote above, when I said: “at least when we're talking about a NAT you share with other people, not just your ISP box's NAT”.

> (and often your local address too, but that's less important).

Here you're mixing up the hole-punching part with the signaling protocol (ICE, which have had this issue in the past, before browsers switched to mDNS[1] instead of private IP addresses in ICE candidates).

[1]: https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU?pli...

link
dinosaurdynasty 1302 days ago
You need a signaling protocol to do hole punching.
link
littlestymaar 1301 days ago
The two are working together to establish a p2p connection behind a NAT but that doesn't make them equivalent. It's like saying “UDP sometimes leaks your local IP address”, that's factually inaccurate.
link