5 ms·

My favorite is business upgrade. Start dropping VPN every 5 min or so, force you to buy business class service for remote work etc.

chx 8y ago
This is very near impossible to implement, isn't it?
- aerotwelve 8y ago
  Not at all, they are your ISP! I absolutely expect VPNs to be the first to go; it's hard to do application-level throttling if everyone has access to a VPN. This is a goldmine for ISPs. Over the last five-ish years they decided to think of themselves as "advertising" companies. FCC repealed the internet privacy rule last April, and what are they doing now? They're functioning as data brokers. We should expect this trend to continue and assume that ISPs will take advantage of Pai's NN repeal as soon as possible.
  - _jal 8y ago
    This is the next shoe to drop. Comcast currently extracts almost $100 a month from me, in addition to the ~$10 I pay for a VPN exit node to hide traffic from their surveillance machine. Why wouldn't they want another $10 or so to "allow" VPNs, given regulators who are loudly, publicly giddy about screwing consumers?
- jjoonathan 8y ago
  No, it is not very near impossible to implement.
  - dzek69 8y ago
    Sorry, but you are wrong. It's a 15 minutes task for good admin to start dropping VPN connections (not to block, but to interrupt every 5 minutes, but blocking is even easier). One important info: - ISP can't see your VPN traffic. But they can see that you are connecting to specific IP (VPN service's IP) at specific port. Once you're connected to VPN you probably pass ALL the connection through it. So ISP can see only single connection to single point. That is more than enough. So how can they block VPNs: 1) Most VPNs uses standard VPN ports. Just dropping connections to that port is a good start. 2) Dropping connections to a servers when this is your (almost) only, long standing connection. This is a good moment to store that IP as VPN service IP. 3) Reverse DNS on IPs you're connecting to. A lot of services will reveal that they belongs to VPN services. 4) Public list of VPN IPs. Some provides them. Some are already noted somewhere on the internet. ISPs can even share their databases with each other to be better at VPN dropping. This is very easy thing to do. It would be REALLY hard to hide your connection to a VPN service. One thing that came to my mind, to hide your VPN servers you would have to: - use VPN services at random ports - change VPN IP every few minutes at random factor, so dropped connections will occur anyway - in the background you should keep direct (un-VPNed) connections to random servers at random ports, passing random data around (it will look encrypted just like VPN connection) This would require huge infrastructure though. Really huge. But still - if ISP notice behavior like that - it means you're probably trying to do something shady, like walk around their VPN dropping rules - so they could just throttle your connections even more, just in case :) So in general - you're fu^Hat very bad situation. I'm from Europe. I'm "safe" now, but we are also going to have bad law for net neutrality soon.
    - jjoonathan 8y ago
      I think you misread my post and argued the same point. So, uh, thanks?
- erric 8y ago
  No. Businesses and Governments do it all the time.
- simias 8y ago
  Why would you think that? It's pretty trivial to do. You could try to obfuscate your traffic but that's just playing cat and mouse (and the ISP could just decide to start dropping anything that it doesn't recognize and seems to consume a significant amount of bandwidth). I think the most efficient way to hide your service would be to tunnel it over HTTPS given that it's not really realistic to drop that when you're an ISP. Still, a relatively simple traffic analysis tool won't have too much difficulty differentiating between proper web browsing and something fishy over HTTPS even it it just looks at the shape of the traffic.
applecrazy 8y ago
How would ISPs differentiate between VPNs over something like HTTP traffic?
- Someone1234 8y ago
  Deep packet inspection.
  - sigjuice 8y ago
    How about over HTTPS traffic?
    - briffle 8y ago
      You mean your single stream of HTTPS traffic to a known destination 24x7?
      - frankzinger 8y ago
        What if you only use the HTTPS VPN when necessary, e.g. for streaming Netflix (seeing that they've been a target before), but for regular browsing, email, DNS, etc. you don't?
    - nnforall 8y ago
      Lack of DNS queries for one small example.
    - dordoka 8y ago
      There are enough differences between HTTPS and VPN protocols to be able to distinguish them using DPI. IDS/IPS vendors even show this as a feature usually.
      - dkudriavtsev 8y ago
        There's protocols like stunnel that hide your arbitrary TCP traffic in a TLS tunnel that looks like web traffic.
nnforall 8y ago
I work for an ISP and often encounter the exact opposite of this. From time to time we get a customer who calls up to order a connection specifically for a VPN. They know exactly what they need. They won't listen. I try to steer them to a less expensive package that is perfectly adequate for a VPN. They'll have none of it. They want a bunch of special add-ons because they have done this all before with other ISPs and they know the ropes. They have no idea how a VPN even works, and they've never even heard of our company before, but they know exactly what they want. I try to politely point out that I could help them save money and still guarnantee it will work without problems. But I won't argue with the customer. If they want to pay 5x for a bunch of custom stuff they don't need, I can do that. In the end, they are very happy. They have outsmarted the greedy, conniving ISP, and got themselves a rock-solid service. I make a mental note to try to find a local contact for them with whom we can build a relationship of trust and perhaps persuade down the road that they could actually pay less without compromising their service.
- SteveNuts 8y ago
  What types of custom things are you talking about? I'm not familiar with that type of internet connection (I've only ordered residential service.
  - nnforall 8y ago
    One small, typical example: most of our VPN customers are setting up some satellite that needs to connect to the home office. The connection is initiated from our network to the home office. So the IP address of the satellite doesn't really matter. This is not always the case, but it is the most common case. So when a customer demands a dedicated static IP address, I wonder if they really need that. We charge extra for that because we have a limited pool of public IPv4 addresses. We can do it, but it is usually unnecessary, and better to avoid unless you really need it.
    - SteveNuts 8y ago
      Okay that makes sense, thanks.
kabdib 8y ago
I pay for Comcast business class, because (a) I do work from home, and am on call, (b) the SLA says they need to roll a truck within four hours (we've had trouble in our city with line cards going bad and them not being fixed for months), and (c) when I call their tech support, I get someone who is technically competent, or at least wayyyy more effective than the script-reading drones you get on a consumer account. It's twice the money for half the bandwidth, but I have enough bandwidth and I sleep better at night. Shouldn't be necessary, but . . .

chx 8y ago

This is very near impossible to implement, isn't it?

aerotwelve 8y ago
Not at all, they are your ISP! I absolutely expect VPNs to be the first to go; it's hard to do application-level throttling if everyone has access to a VPN. This is a goldmine for ISPs. Over the last five-ish years they decided to think of themselves as "advertising" companies. FCC repealed the internet privacy rule last April, and what are they doing now? They're functioning as data brokers. We should expect this trend to continue and assume that ISPs will take advantage of Pai's NN repeal as soon as possible.
- _jal 8y ago
  This is the next shoe to drop. Comcast currently extracts almost $100 a month from me, in addition to the ~$10 I pay for a VPN exit node to hide traffic from their surveillance machine. Why wouldn't they want another $10 or so to "allow" VPNs, given regulators who are loudly, publicly giddy about screwing consumers?
jjoonathan 8y ago
No, it is not very near impossible to implement.
- dzek69 8y ago
  Sorry, but you are wrong. It's a 15 minutes task for good admin to start dropping VPN connections (not to block, but to interrupt every 5 minutes, but blocking is even easier). One important info: - ISP can't see your VPN traffic. But they can see that you are connecting to specific IP (VPN service's IP) at specific port. Once you're connected to VPN you probably pass ALL the connection through it. So ISP can see only single connection to single point. That is more than enough. So how can they block VPNs: 1) Most VPNs uses standard VPN ports. Just dropping connections to that port is a good start. 2) Dropping connections to a servers when this is your (almost) only, long standing connection. This is a good moment to store that IP as VPN service IP. 3) Reverse DNS on IPs you're connecting to. A lot of services will reveal that they belongs to VPN services. 4) Public list of VPN IPs. Some provides them. Some are already noted somewhere on the internet. ISPs can even share their databases with each other to be better at VPN dropping. This is very easy thing to do. It would be REALLY hard to hide your connection to a VPN service. One thing that came to my mind, to hide your VPN servers you would have to: - use VPN services at random ports - change VPN IP every few minutes at random factor, so dropped connections will occur anyway - in the background you should keep direct (un-VPNed) connections to random servers at random ports, passing random data around (it will look encrypted just like VPN connection) This would require huge infrastructure though. Really huge. But still - if ISP notice behavior like that - it means you're probably trying to do something shady, like walk around their VPN dropping rules - so they could just throttle your connections even more, just in case :) So in general - you're fu^Hat very bad situation. I'm from Europe. I'm "safe" now, but we are also going to have bad law for net neutrality soon.
  - jjoonathan 8y ago
    I think you misread my post and argued the same point. So, uh, thanks?
erric 8y ago
No. Businesses and Governments do it all the time.
simias 8y ago
Why would you think that? It's pretty trivial to do. You could try to obfuscate your traffic but that's just playing cat and mouse (and the ISP could just decide to start dropping anything that it doesn't recognize and seems to consume a significant amount of bandwidth). I think the most efficient way to hide your service would be to tunnel it over HTTPS given that it's not really realistic to drop that when you're an ISP. Still, a relatively simple traffic analysis tool won't have too much difficulty differentiating between proper web browsing and something fishy over HTTPS even it it just looks at the shape of the traffic.

applecrazy 8y ago

How would ISPs differentiate between VPNs over something like HTTP traffic?

Someone1234 8y ago
Deep packet inspection.
- sigjuice 8y ago
  How about over HTTPS traffic?
  - briffle 8y ago
    You mean your single stream of HTTPS traffic to a known destination 24x7?
    - frankzinger 8y ago
      What if you only use the HTTPS VPN when necessary, e.g. for streaming Netflix (seeing that they've been a target before), but for regular browsing, email, DNS, etc. you don't?
  - nnforall 8y ago
    Lack of DNS queries for one small example.
  - dordoka 8y ago
    There are enough differences between HTTPS and VPN protocols to be able to distinguish them using DPI. IDS/IPS vendors even show this as a feature usually.
    - dkudriavtsev 8y ago
      There's protocols like stunnel that hide your arbitrary TCP traffic in a TLS tunnel that looks like web traffic.

nnforall 8y ago

I work for an ISP and often encounter the exact opposite of this. From time to time we get a customer who calls up to order a connection specifically for a VPN. They know exactly what they need. They won't listen. I try to steer them to a less expensive package that is perfectly adequate for a VPN. They'll have none of it. They want a bunch of special add-ons because they have done this all before with other ISPs and they know the ropes. They have no idea how a VPN even works, and they've never even heard of our company before, but they know exactly what they want. I try to politely point out that I could help them save money and still guarnantee it will work without problems. But I won't argue with the customer. If they want to pay 5x for a bunch of custom stuff they don't need, I can do that. In the end, they are very happy. They have outsmarted the greedy, conniving ISP, and got themselves a rock-solid service. I make a mental note to try to find a local contact for them with whom we can build a relationship of trust and perhaps persuade down the road that they could actually pay less without compromising their service.

SteveNuts 8y ago
What types of custom things are you talking about? I'm not familiar with that type of internet connection (I've only ordered residential service.
- nnforall 8y ago
  One small, typical example: most of our VPN customers are setting up some satellite that needs to connect to the home office. The connection is initiated from our network to the home office. So the IP address of the satellite doesn't really matter. This is not always the case, but it is the most common case. So when a customer demands a dedicated static IP address, I wonder if they really need that. We charge extra for that because we have a limited pool of public IPv4 addresses. We can do it, but it is usually unnecessary, and better to avoid unless you really need it.
  - SteveNuts 8y ago
    Okay that makes sense, thanks.

kabdib 8y ago

I pay for Comcast business class, because (a) I do work from home, and am on call, (b) the SLA says they need to roll a truck within four hours (we've had trouble in our city with line cards going bad and them not being fixed for months), and (c) when I call their tech support, I get someone who is technically competent, or at least wayyyy more effective than the script-reading drones you get on a consumer account. It's twice the money for half the bandwidth, but I have enough bandwidth and I sleep better at night. Shouldn't be necessary, but . . .