5 ms·

> Simply making it illegal will detour most people. Don't mean to be pedantic but I think you mean "deter". "Detour" = reroute, like "we're taking a detour to

> Simply making it illegal will detour most people. Don't mean to be pedantic but I think you mean "deter". "Detour" = reroute, like "we're taking a detour to get some gas". "Deter" = Discourage, like "making something illegal deters law abiding citizens from doing it". > I don't understand why VPN crackdown is thought to be impossible. Because it's hard to distinguish VPN traffic from legitimate traffic and false positives will be extremely bad for the ISP. > Open connection to a DNS port? sending large amounts of data? its encrypted? No one has accessed that digital ocean IP before on this network! In order: Many VPNs will use standard HTTPs ports rather than DNS. There are numerous reasons to send large amounts of data, like backups. Encryption is quickly becoming the default, major video sites like YouTube and Netflix are encrypted for instance. Software developers are likely to access DigitalOcean IP addresses. I do believe that at ISP scale it's possible to identify VPNs though and the things you've mentioned could contribute to a heuristic algorithm. Some other things to add are the geographical diversity of the users accessing a server (legitimate video services will have PoPs near a user, so few will cross the country), the distribution of response times and sizes (a pure web server will have lots of small, ~100ms responses, a video server will have lots of infrequent very high bandwidth transfers) and if you can access it, the outgoing connections of the servers themselves (e.g. Cogent can tell that a server is generating user traffic rather than business traffic).

codedokode 9y ago
> Because it's hard to distinguish VPN traffic from legitimate traffic I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. > and false positives will be extremely bad for the ISP. How exactly?
- Veratyr 9y ago
  > I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. > How exactly? In countries other than China, where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace, which will lead to the person implementing the policy losing power or at the very least, a degree of support.
  - PhasmaFelis 9y ago
    > China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. It doesn't matter who owns the ISPs if the government has the power and will to force all of them to comply.
    - CommanderData 9y ago
      Worth mentioning the UK has blocked access to all major torrent websites and it is very effective on all ISPs. It was implemented in a matter of months and has improved over time from a simple DNS redirect to now blocking IP ranges and DPI. Internet Censorship and ISP wide blocking to us westerners is a new thing and I think people here are speaking during a time where we have it pretty good. There is no ISP proactive battle against VPNs. Yes, you may be able to get through your companies firewall but is that the same? VPN use in China is difficult and becoming more so. UK ISPs are now logging DNS requests from order of the government. In the beginning the ISPs complained and said it was technologically difficult. I wouldn't be surprised if that was just a call to access some gov funds and hey presto both parties win.
      - codedokode 9y ago
        > There is no ISP proactive battle against VPNs. That is until some government official learns about them.
  - codedokode 9y ago
    > all major ISPs are state owned That is not important. In Russia even private ISP are required to install a firewall to block access to sites that are spreading illegal information (and they are also required to install a device that is monitoring whether the blocking policies are followed). There is also a law that will oblige ISPs record and keep customers' traffic in the future. > When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. A user of VPN typically has a single outgoing connection to a data center IP and that is easy to detect for an ISP. There is no need to see the VPN server's connections if you see the user's ones. > where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace In those countries there will be no censorship and no need for a VPN. Also, most people don't use tools like VPNs and use Internet mostly for sites like social networks. Even if there are 1% of annoyed customers that cannot use VPN or SSH, the rest 99% won't notice that.

codedokode 9y ago

> Because it's hard to distinguish VPN traffic from legitimate traffic I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. > and false positives will be extremely bad for the ISP. How exactly?

Veratyr 9y ago
> I don't think so. Chinese firewall can block VPN. For example, the easiest way to see if the user is using a VPN is to count a number of IP addresses they connect to. China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. > How exactly? In countries other than China, where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace, which will lead to the person implementing the policy losing power or at the very least, a degree of support.
- PhasmaFelis 9y ago
  > China is a special case as unlike most other countries, all major ISPs are state owned. When you own every internet connection in the country, it's much easier to spot VPNs. It doesn't matter who owns the ISPs if the government has the power and will to force all of them to comply.
  - CommanderData 9y ago
    Worth mentioning the UK has blocked access to all major torrent websites and it is very effective on all ISPs. It was implemented in a matter of months and has improved over time from a simple DNS redirect to now blocking IP ranges and DPI. Internet Censorship and ISP wide blocking to us westerners is a new thing and I think people here are speaking during a time where we have it pretty good. There is no ISP proactive battle against VPNs. Yes, you may be able to get through your companies firewall but is that the same? VPN use in China is difficult and becoming more so. UK ISPs are now logging DNS requests from order of the government. In the beginning the ISPs complained and said it was technologically difficult. I wouldn't be surprised if that was just a call to access some gov funds and hey presto both parties win.
    - codedokode 9y ago
      > There is no ISP proactive battle against VPNs. That is until some government official learns about them.
- codedokode 9y ago
  > all major ISPs are state owned That is not important. In Russia even private ISP are required to install a firewall to block access to sites that are spreading illegal information (and they are also required to install a device that is monitoring whether the blocking policies are followed). There is also a law that will oblige ISPs record and keep customers' traffic in the future. > When you're say Comcast, you only see the connections your customers make and accept, you can't see what VPN servers are doing. A user of VPN typically has a single outgoing connection to a data center IP and that is easy to detect for an ISP. There is no need to see the VPN server's connections if you see the user's ones. > where government control is less prevalent and the government is overtly democratic, false positives will result in anger in the populace In those countries there will be no censorship and no need for a VPN. Also, most people don't use tools like VPNs and use Internet mostly for sites like social networks. Even if there are 1% of annoyed customers that cannot use VPN or SSH, the rest 99% won't notice that.