• frezik
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    If privacy is what you want, then NAT is forcing a bunch of decisions that make things less private.

    Consider a VoIP service like Skype or Vonage. In a world without NAT, you can directly dial the device. It’s easy to encrypt it end to end. You can have several such devices on a single network. Just need to open the port(s) on the firewall to that device.

    In a world with NAT, end users would need to forward those ports. That alone might be reasonable for the average customer to do, but having more than one device behind the gateway becomes hairy.

    So what a lot of these companies did was build a datacenter that serves connections. Your VoIP device or software initiates a connection to that server from its side, so you don’t have to configure anything. Another device dialing you connects to that server, looks up your connection, and pipes through everything.

    Now it’s a bit harder to implement end to end encryption. You could still do it, but it’s more complicated, and that complication means it’s easier to get wrong. Out of either laziness or malice, maybe the company doesn’t bother. Now its datacenter becomes a central point for snooping on conversations. Oh, and the whole service is more expensive because the cost of this datacenter has to be paid off.

    NAT is not for security or privacy. It’s harming both. The benefit of obscuring addresses on your network is far outweighed by other problems.