HIP draft – PoC Witness IP Check

[H-Baguette]

An attempt at solving Helium's spoofing problem. A discussion with Digerati on Discord allowed me to better understand why the simple solution to invalidate all witnesses sharing the same IP as either the beacon or another witness is not ideal.

Ed: rendered view https://github.com/helium/HIP/blob/defd2f4233650967b548e4115e4f5e4a062030ed/0061-poc-witness-ip-check.md

[edakturk14]

hey @H-Baguette! would you like to present the draft on the community call thats tomorrow?

[H-Baguette]

Sure, I'd be glad to ! Le mar. 24 mai 2022 à 19:49, eda ***@***.***> a écrit :

…

hey @H-Baguette <https://github.com/H-Baguette>! would you like to present the draft on the community call thats tomorrow? — Reply to this email directly, view it on GitHub <#414 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AZJ54TVWT4IETRFFS27PZCDVLUJBNANCNFSM5WZRRP5Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[edakturk14]

awesome! call details & agenda is here: https://bit.ly/38HQ9Mm
We generally have 15 min for new HIPs how does that sound? We chat from Discord if you're on there to schedule for tomorrow

[snip]

Looks to be a very good start thanks @H-Baguette!
Even if it is a good step forward it seems this proposal will not stop cheaters using VPN and unique IP to go outside.
But it is difficult to cover everything. So for sure small steps are better than doing nothing!

[softlion]

You could also check that IPs are residential and exclude all other types (ie: datacenter IPs).
Explanations here: https://multilogin.com/how-to-hide-ip-address-your-complete-guide/

[snip]

You could also check that IPs are residential and exclude all other types (ie: datacenter IPs).

Unfortunately lot of current hotspot owners moved to VPN for their hotspot to have possibility to forward port 44158 to their hotspot. So they will need to update their setup to remove the VPN.
But yes this can be a target solution. Not yet applicable i think.

[ifeign]

You could also check that IPs are residential and exclude all other types (ie: datacenter IPs).

Unfortunately lot of current hotspot owners moved to VPN for their hotspot to have possibility to forward port 44158 to their hotspot. So they will need to update their setup to remove the VPN. But yes this can be a target solution. Not yet applicable i think.

People also use VPNs for remote management

[softlion]

You could also check that IPs are residential and exclude all other types (ie: datacenter IPs).

Unfortunately lot of current hotspot owners moved to VPN for their hotspot to have possibility to forward port 44158 to their hotspot. So they will need to update their setup to remove the VPN. But yes this can be a target solution. Not yet applicable i think.

People also use VPNs for remote management

For management they use a secondary network on vpn, which does not get all 'normal' traffic from hotspots.

[pilotdeveloper]

as the owner of virtualprivatepi.com, I can assure you that people use VPN providers for remote management - tailscale is too far beyond them for most cases.

This is also going to significantly impact CGNat devices in a negative way. All hotspots deployed on LTE / 5G hotspots are currently sharing the same public IP - this filter would screw them over.

[H-Baguette]

Keep in mind that CGNAT devices would only be affected if they share the same IP, are in the same beaconing event (witnessing each other or witnessing the same beacon), and are isolated from any other valid hotspots. This proposal does not automatically invalidate all witnessing sharing the same IP all over the network, but only those sharing an IP locally and under specific conditions.

[ifeign]

I understand the gist of things, but I have access to some acreage where I could deploy miners 300m apart but I’d probably use the same public IP. If this HIP were to be passed would I be screwed? Would I need a VPN for each miner so it has a unique IP?

…

On Thu, Jun 2, 2022 at 12:56 PM H-Baguette ***@***.***> wrote: Keep in mind that CGNAT devices would only be affected if they share the same IP, are in the same beaconing event (witnessing each other or witnessing the same beacon), and are isolated from any other valid hotspots. This proposal does not automatically invalidate all witnessing sharing the same IP all over the network, but only those sharing an IP locally and under specific conditions. — Reply to this email directly, view it on GitHub <#414 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHWLHYCMHINYIDCFOF7T4CTVNDRVFANCNFSM5WZRRP5Q> . You are receiving this because you commented.Message ID: ***@***.***>

[hiptron]

This HIP draft has been numbered and merged for discussion as HIP 62.

Please direct future questions & comments to the new tracking issue: #422

If you are one of the named authors, please include #422 in future pull requests to have them automatically merged.