6 ms·

And the reason why NordVPN IP was blocked is that NordVPN is often used for scam/hack purposes.

aPoCoMiLogin 6y ago
exactly, had a lot of attack attempts from nordvpn/expressvpn, no wonder someone might got ban because of same IP.
zxcvbn4038 6y ago
I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to use a VPN.
- user5994461 6y ago
  >>> accessing your bank is the one time you would really want to use a VPN. what makes you possibly think that? using a VPN is the equivalent of walking into a bank with a motorcycle helmet or a bataclava, don't be surprised of the unwarm welcome. I've worked in bank and fintech around fraud. Blocked quite a few VPN/hosting at the network level so they couldn't even reach our network at all.
  - zxcvbn4038 6y ago
    CitiBank? Is that really you? You may be an undigested bit of beef, a blot of mustard, a crumb of cheese, a fragment of underdone potato. There’s more of gravy than of grave about you, whatever you are!
- viraptor 6y ago
  > accessing your bank is the one time you would really want to use a VPN Why do you think so? Do you want your ISP to not know who you bank with? Do you not trust TLS? Is your network operator an active, advanced threat actor? What problems would you like to solve with VPN in this case?
  - bradknowles 6y ago
    Major US carriers are known to use deep packet inspection techniques to change out the advertisements you see on your webpages. If they’re doing that with DPI for purely profit driven reasons, then they are totally untrustworthy when it comes to more criminal activities. They’re also known to use traffic shaping to websites they don’t like, and which they they should pay them more money to get to your eyeballs. Netflix and YouTube are popular examples here. When I can get much higher throughput to Netflix and YouTube when on VPN versus when I’m not using VPN, something is very wrong. So, no. I don’t trust my ISP. Not at all. Not as far as I can bodily throw their HQ building. They also fuck with your VPN connections. Which is why I have accounts with multiple VPN providers.
    - viraptor 6y ago
      Sure, there are some reasons for a web proxy. But I asked about the bank case specifically and none of those apply.
    - ficklepickle 6y ago
      I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store. Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.
      - joveian 6y ago
        Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.
shiado 6y ago
This is why when I need to proxy traffic I do it through an AWS instance in whatever region I need. Many services not only don't suspect AWS IPs as malicious, they might even have whitelists on their firewalls for AWS IPs.

exactly, had a lot of attack attempts from nordvpn/expressvpn, no wonder someone might got ban because of same IP.

I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to use a VPN.

user5994461 6y ago
>>> accessing your bank is the one time you would really want to use a VPN. what makes you possibly think that? using a VPN is the equivalent of walking into a bank with a motorcycle helmet or a bataclava, don't be surprised of the unwarm welcome. I've worked in bank and fintech around fraud. Blocked quite a few VPN/hosting at the network level so they couldn't even reach our network at all.
- zxcvbn4038 6y ago
  CitiBank? Is that really you? You may be an undigested bit of beef, a blot of mustard, a crumb of cheese, a fragment of underdone potato. There’s more of gravy than of grave about you, whatever you are!
viraptor 6y ago
> accessing your bank is the one time you would really want to use a VPN Why do you think so? Do you want your ISP to not know who you bank with? Do you not trust TLS? Is your network operator an active, advanced threat actor? What problems would you like to solve with VPN in this case?
- bradknowles 6y ago
  Major US carriers are known to use deep packet inspection techniques to change out the advertisements you see on your webpages. If they’re doing that with DPI for purely profit driven reasons, then they are totally untrustworthy when it comes to more criminal activities. They’re also known to use traffic shaping to websites they don’t like, and which they they should pay them more money to get to your eyeballs. Netflix and YouTube are popular examples here. When I can get much higher throughput to Netflix and YouTube when on VPN versus when I’m not using VPN, something is very wrong. So, no. I don’t trust my ISP. Not at all. Not as far as I can bodily throw their HQ building. They also fuck with your VPN connections. Which is why I have accounts with multiple VPN providers.
  - viraptor 6y ago
    Sure, there are some reasons for a web proxy. But I asked about the bank case specifically and none of those apply.
  - ficklepickle 6y ago
    I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store. Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.
    - joveian 6y ago
      Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.

shiado 6y ago

This is why when I need to proxy traffic I do it through an AWS instance in whatever region I need. Many services not only don't suspect AWS IPs as malicious, they might even have whitelists on their firewalls for AWS IPs.