3 ms·
If a VPN is over port 443 and using TCP, there really wouldn't be any way to know whether it was HTTPS or VPN.
by esaym 9y ago
If a VPN is over port 443 and using TCP, there really wouldn't be any way to know whether it was HTTPS or VPN.
- lowbloodsugar 9y ago"Well, sir, if you look in our terms of service, it says quite clearly that if most of your traffic goes to a set of services that we have determined are most likely VPNs because we control most of the end-traffic on the internet, well then we can disconnect you. I know, sir, machine learning is wonderful as I'm sure you've read on Hacker News that you visit regularly. What's that? You swear it isn't VPN traffic? Ok, can you provide any evidence to that effect? You can't? Ok, well, you have been disconnected sir, and if you like, you can pay a $300 fee to get reconnected and rejoin our new VPN plan at $150 per month. If you want to use our VPN plan that will be $30 per month on top of all the other services you will need to select"
- cmurf 9y agoI suspect Google, Apple, Microsoft, Facebook soon thereafter jump into the always on VPN market in some form or another.
- aaomidi 9y agoDepends on the VPN. Https handshakes are very different than say openvpn. But you can definitely hide your vpn behind the https protocol.
- zaphar 9y agoThey don't have to inspect the traffic for this scenario. They can do it purely based on the routing requested.
- ajr0 9y agomost modern NGFW's identify traffic by the layer 7 application. many (but not all) are identified by the time a tcp handshake completes.
- nl 9y agoVPN handshake detection is pretty easy for modern packet-inspection hardware. Yes, you can beat this, but it is inaccurate to characterize it as being completely unstoppable.
- cjhanks 9y agoI suspect you can. You can certainly analyze the timing and lifetime's to identify VPN's vs HTTPS (at the expense of a few websocket false positives). And I suspect you could even characterize entropy.
- drvdevd 9y agoIt’s a game of cat and mouse for sure. See Tor plugable transports for some more circumvention ideas. I believe it is a game ISPs acting in bad faith will ultimately lose.
- digitalsushi 9y agoEven if this were true, it would be very easy for an ISP to insist that their own certificates be trusted as part of the terms of usage. This would give the ISP data access.