7 ms·
Within the last month, I've found that I can no longer access my bank's website over my VPN, and Netflix has started blocking access while use a VPN as well. I
by chimeracoder 11y ago
Within the last month, I've found that I can no longer access my bank's website over my VPN, and Netflix has started blocking access while use a VPN as well.
I can somewhat understand the bank's motivation, but offering two-factor authentication would be a much better way of boosting security than blocking VPN traffic.
As for Netflix, it's totally short-sighted. Netflix is literally unusable from my home connection without a VPN (thanks, Time Warner!). Now that they seem to be consistently blocking my ability to use the service, I'm planning on canceling.
- dave2000 11y agoHow can sites tell you are using a VPN?
- necrodome 11y agoA list of well-known IPs? The pool is not that large.
- y4mi 11y agocouldnt you just provision a server in a random datacenter and create your own for ~5 $ / month?
- dogma1138 11y agoIt will be on the same list, if you are filtering VPN's and other "anonymizers" you usually end up blocking all IP's that are not assigned to commercial/residential ISP's. IP blocks which belong to data center's, cloud providers, VPN providers etc. are quite well known and easily identifiable with a simple lookup. So you can easily find some no-name VPS provider or get a VPS on AWS/DigitalOcean/Azure/Racksapce but if the site is actively restricting access from VPN's/Proxies it won't help you much in most cases.
- deleted 11y ago[deleted]
- fencepost 11y agoPossibly, but I suspect that the address pools for many of the major players (Amazon, Rackspace, DigitalOcean, etc.) are also known and not getting smaller. There might be options related to IPv6, but since Netflix has been supporting that for streaming since 2012 I suspect those are also covered.
- breakingcups 11y agoCurrently doing that through a big PAAS, we'll see how long it lasts.
- dave2000 11y agoWhat if I connect to your PC using a vpn so it looks like it's just you watching it? I tried connecting to the UK national lottery from abroad via a VPN to my home PC and they could tell.
- cft 11y agoThey have a list of ISPs
- tshtf 11y agoI doubt they're using this, but it's possible: https://medium.com/@ValdikSS/detecting-vpn-and-its-configuration-and-proxy-users-on-the-server-side-1bcc59742413#.wdelq8jvq https://medium.com/@ValdikSS/detecting-vpn-and-its-configura...
- merb 11y agothis works well with windows machines, however beyond that it could be really really flaky. especially freebsd/mac/linux are mostly inaccurate. PTR's are set on client machines aswell or in some newer IPv6 based networks you mostly get a PTR aswell. fingerprinting the tcp implementation can't work on network fragmentation and when you drop some packages through a firewall, yes this is mostly not in home networks and most home users won't use linux at all however since netflix and other streaming providers opened for linux aswell, they will actually just allow linux users to use a vpn since they can't detect it safely without false postives like they could on windows. And MTU differs extremly between US and Europe (Thanks to PPPoE and PPPoA) PTR is wrong. My Server is a home user and I'm a server?! Also this guy has a better database since he can detect linux 3.11 however on my home network I'm behind a proxy, thats something he didn't detected. Edit: Oh and on IPv6 only networks with DNS64 and NAT64 you will get really aweful results if you operate on a ipv4 based service (i'm looking at you netflix)
- aroch 11y agoYou use MaxMind's IP database which tells you the origin type (residential, commercial, proxy, etc)
- vonklaus 11y agook this is what I was really wondering. So Netflix can tell that you are using a commercial connection to access the service? Can they also tell that you are forwarding in the case of a proxy or something? That is what I don't get, because if I spin up a digital ocean server in London and put openVPN on it, they can probably tell the IP block belongs to a cloud services company. However, they can't just be running ips against a list right? So what is the work around?
- aroch 11y agoAny given IP is "owned" by an Autonomous System[1], so if you see a user whose IP is from AS14061[2], you know they're coming from DigitalOcean and you can say, "No content for you". They are basically checking your IP against a big list and seeing where you're coming from. In some cases it is more ambiguous, say the IP belongs to Verizon but it happens to one of the blocks Verizon provisions in the EU or as part of their PPI infrastructure. You only know this because someone has annotated this metadata (eg MaxMind). Or if its a Comcast Business account IP, do you call that commercial and block it? It could be someone at home who forked out for the business class service. This is again where IP-surveillance companies come into play. In even more ambiguous cases, the IP belongs to AS####A (A hosting company) but is announced by AS####B (A residential ISP), such that traffic from to or from the IPs belonging to AS####A looks for all the world that it is really AS####B's traffic. Do you treat those users a residential because ISP-B is potentially renting that IP space or do you call it commercial? [1] https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%29 https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%... [2] http://bgp.he.net/AS14061 http://bgp.he.net/AS14061
- josho 11y agoHow is Netflix unusable from your home connection, but not through a VPN? Eg. Either way you need to sustain 2mbit stream.
- pmx 11y agoISP Packet shaping. They do it even though they say the don't. When you go via VPN they don't know your connecting to Netflix and don't mess with your traffic.
- op00to 11y agoNope. Your ISP just let their handoffs with whatever transit provider Netflix get overloaded which kills throughput. When Netflix pays the ransom to upgrade the links, your videos will stream nice again. Netflix paid ransom to the ISP I use, so my Netflix works well. It has nothing to do with active throttling.
- lafay 11y agoI don't think there is any explicit shaping / throttling happening on US wireline networks these days. There was a huge blowback against Comcast for trying that ~10 years ago, using Sandvine gear to throttle bittorrent traffic at peak times. There is still plenty of implicit throttling going on though, with broadband providers refusing to provision enough capacity between their networks and the content source networks. The existing links then become congested at peak times and performance is degraded for the customers trying to access that content. VPNs may improve performance in this situation not because they are hiding or disguising the content, but simply because the traffic is "re-routed" around the congested links. Assuming that the links from content network -> VPN host and VPN host -> end user are not also congested.
- chillwaves 11y agoThis is correct. Sometimes the VPN connection will be bad, and I just change which host I connect to, the traffic is routed a different way and then it works fine.
- 11y ago
- thirdsun 11y agoIn all fairness, that's probably not Netflix' decision, but a requirement of the content publishers and licensing deals. Concerning the Time Warner issue - I can't say that I ever noticed being the victim of traffic shaping and throttling in similar fashion, but that's just outrageous; How can that be legal?
- mikeash 11y agoISPs typically don't outright throttle Netflix traffic. Instead, they simply neglect to build out capacity to wherever Netflix traffic comes from. I recall one case where it was just a matter of running some more cables between two pieces of equipment in the same cabinet. And of course they'd be happy to build out that capacity if Netflix will foot the enormously inflated bill. I don't watch Netflix, but I often have extremely poor speeds for YouTube videos at peak times on my FiOS connection. Of course Verizon says it's Google's fault for not paying for infrastructure upgrades, clearly not Verizon's responsibility to ensure I can actually get the 300Mbps they advertise.
- pyvpx 11y agoare you suggesting it is Verizon's responsibility to ensure 300Mbps to every destination on the internet? if not, then why some over others?
- amazon_not 11y agoIt is Verizon's responsibility to make a reasonable effort to provide that 300 Mbps to the Internet that the customer paid for, especially as content providers are bending over backwards to give Verizon that capacity for free.
- michaelt 11y agoI think it's my ISP's job to provide the advertised bandwidth between me and exchange points which offer access on fair, reasonable and nondiscriminatory terms. My nearest exchange point is probably London Internet Exchange. If an ISP advertises X Mbps, and Netflix can deliver X Mbps of data for me to the exchange point, it's my ISP's job to get that X Mbps of data to me.
- unethical_ban 11y agoWhy would you need anonymity when accessing your bank account?
- dewey 11y agoIt's not about hiding your identity from the bank, it's about obfuscating your traffic from whoever is watching your connection.