Subject: [v6ops] IPv6 new access from Windows to Google: display of a critical security alert

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 31 Oct 2019 11:25:50 +0100

Google alerted me a few days ago during my DHCPv6 experiments, when I 
browsed it with a Windows computer using IPv6 first time, although many 
times previously with IPv4.

Incidentally, the address my Windows used was an address delivered by 
DHCPv6. Being DHCPv6 is visible in its format: in the hextet 
representation, the '::' appears before the last two hextets 
(X::b4cc:8eb9) as opposed to a SLAAC address where the double colon 
appears quasi always before the last _four_ hextets.

I am trying to understand why Google complained wiht such a critical 
security alert.

- is it because the address was a DHCP address rather than SLAAC?

- it is because I connect from an address they have never seen before?

- is it because it is the first time I connect to them by IPv6 on this 
computer?

- is it because when I connect  with IPv6 to them I keep changing the 
IPv6 address (as opposed to IPv4 is always the same because behind NAT)?

The messages they displayed are not helpful to understand what's 
happening, because they talk about 'application security', 'wrong 
device', etc.  Neither is the case: I have a running anti-virus so my 
apps are healthy and the device is always the same Windows device I use 
to connect to Google.

---

From: Owen DeLong <[email-masked]>
Date: Thu, 31 Oct 2019 07:32:45 -0700

> On Oct 31, 2019, at 3:25 AM, Alexandre Petrescu <[email-masked]> wrote:
> 
> Google alerted me a few days ago during my DHCPv6 experiments, when I browsed it with a Windows computer using IPv6 first time, although many times previously with IPv4.
> 
> 
Since I don’t speak French, it’s hard to interpret the error message and I can’t paste the contents of an image into google translate.

> Incidentally, the address my Windows used was an address delivered by DHCPv6.  Being DHCPv6 is visible in its format: in the hextet representation, the '::' appears before the last two hextets (X::b4cc:8eb9) as opposed to a SLAAC address where the double colon appears quasi always before the last _four_ hextets.
> 
> 
Google can’t tell how you got the address. The position of the :: is irrelevant. This is simply an artifact of the UI in question. Any address which contains contiguous hextets of all zeroes (e.g. 0:0:0) may abbreviate one such group of hextets to ::.

Example: 2001:d8b:0:0:53a2:0:0:1 can be written as:
	2001:db8::53a2:0:0:1
	2001:db8:0:0:53a2::1

All three of the above expressions represent the same exact 128-bit address.
> I am trying to understand why Google complained wiht such a critical security alert.
> 
Hard to say. Is the security alert about your address or is it about the site you were trying to visit?
If you can provide an English translation of the message, it might be possible to provide better advice.

> - is it because the address was a DHCP address rather than SLAAC?
No. Google can’t tell how the address was assigned. It’s just another 128 bit number from Google’s perspective.

> - it is because I connect from an address they have never seen before?
Without being able to decipher the error message, it’s hard to say.
> - is it because it is the first time I connect to them by IPv6 on this computer?
> 
Not likely.
> - is it because when I connect  with IPv6 to them I keep changing the IPv6 address (as opposed to IPv4 is always the same because behind NAT)?
> 
Not likely.
> The messages they displayed are not helpful to understand what's happening, because they talk about 'application security', 'wrong device', etc.  Neither is the case: I have a running anti-virus so my apps are healthy and the device is always the same Windows device I use to connect to Google.
> 
Again, without a translation of the full error message, there is not enough information to answer your questions. No guarantee that a translation of the full error message would provide enough information, but probably worth a try.

Owen

> 
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops

---

From: Alexandre Petrescu <[email-masked]>
Date: Thu, 31 Oct 2019 16:03:49 +0100

Le 31/10/2019 à 15:32, Owen DeLong a écrit :
>
>
>> On Oct 31, 2019, at 3:25 AM, Alexandre Petrescu 
>> <[email-masked] <mailto:[email-masked]>> 
>> wrote:
>>
>> browsed it with a Windows computer using IPv6 first time, although 
>> many times previously with IPv4.
>>
>>
> Since I don’t speak French, it’s hard to interpret the error message 
> and I can’t paste the contents of an image into google translate.
>
> Google can’t tell how you got the address. The position of the :: is 
> irrelevant. This is simply an artifact of the UI in question. Any 
> address which contains contiguous hextets of all zeroes (e.g. 0:0:0) 
> may abbreviate one such group of hextets to ::.
>

Well I never seen an IPv6 address that is SLAAC'ed and has so many 
leftmost 0s.

But I agree with the principle you say.

> the site you were trying to visit?

It popped up when I tried to visit ipv6.google.com with firefox most 
recent.  But I guess it tried first to sign in on my Google account, or 
something like that.  They should know what they tried to do with my 
connection.  What I know is that it did not deserve such a security alert.

> possible to provide better advice.

Manual translation is hard.  See automated translation below. The 
original html (so one can copy paste), and the result of a button click 
on 'Info' button on that page, are attached.

> Access to your account by a suspicious application has been blocked
> [email-masked]
> Google has prevented anyone from signing in to your account using an 
> app that does not belong to Google. If it was not you, it means that 
> someone else knows your password. We advise you to modify it immediately.
> 
> Unrecognized device
> 
> 17 minutes ago
> 
> Near "City, France"
> 2a01: X: Y: ce10 :: b4cc: 8eb9 (IP address)
> Have you recently been unable to sign in to your Google Account?

> No. Google can’t tell how the address was assigned. It’s just another 
> 128 bit number from Google’s perspective.
>

Is it because https on IPv6 might not work as well as on IPv4?

Alex