IPv6 Can Be Safe to Use If You Understand...Or a Direct Access to your Device

Summary

The video examines the privacy and security implications of IPv6, particularly on networks such as Starlink and mobile services that may use both IPv4 and IPv6 (“dual stack”).

IPv4, VPNs, and dual-stack connections

The presenter says that an ordinary IPv4 connection can expose a household’s public IP address. A VPN can mask that address from websites by routing traffic through a shared VPN server.

However, a device may use IPv4 for some destinations and IPv6 for others. The presenter warns that a VPN or privacy setup covering only IPv4 might not cover IPv6 traffic, potentially revealing a device’s IPv6 address to IPv6-enabled services such as Google or Facebook.

IPv6 addresses and device visibility

The video describes devices receiving multiple IPv6 addresses, including local-use and globally routable addresses. The presenter argues that globally routable addresses could allow services to associate activity with individual devices. By comparing address prefixes, services might also associate multiple devices with the same household.

Carrier-grade NAT

The presenter explains that cellular providers and Starlink may use carrier-grade network address translation (CGNAT) to share an IPv4 address among many customers. In the video’s account, this can make users less individually visible to ordinary websites, although a provider or government with access to the provider’s network may have greater visibility.

Security concerns

IPv6 allows direct addressing between devices and internet services. The presenter warns that this may increase exposure if a device or network is misconfigured, while noting that routers generally block incoming connections with a firewall.

Practical guidance offered

1. Use a VPN for ordinary browsing, and check that it covers IPv6 traffic rather than assuming that it does.
2. Use an IPv4-only Wi-Fi router behind the Starlink router, as the presenter does, to avoid giving devices direct IPv6 connectivity.
3. Alternatively, disable IPv6 in each device’s network settings. The presenter notes that this must be done individually and may be easier to forget.
4. Treat these approaches as ways to reduce exposure, not as substitutes for other security measures.

The technical explanations are simplified, and some details in the subtitles appear inaccurate. For example, FC00::/7 refers to IPv6 unique-local addresses, not multicast addresses; IPv6 multicast uses a different range. IPv6 exposure also depends on device, router, provider, and VPN configuration.

Main speaker/source: Rob Braxman, presenter on the Rob Braxman Tech Deep Dive channel.