4 ms·

I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to us

I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to use a VPN.

user5994461 6y ago
>>> accessing your bank is the one time you would really want to use a VPN. what makes you possibly think that? using a VPN is the equivalent of walking into a bank with a motorcycle helmet or a bataclava, don't be surprised of the unwarm welcome. I've worked in bank and fintech around fraud. Blocked quite a few VPN/hosting at the network level so they couldn't even reach our network at all.
- zxcvbn4038 6y ago
  CitiBank? Is that really you? You may be an undigested bit of beef, a blot of mustard, a crumb of cheese, a fragment of underdone potato. There’s more of gravy than of grave about you, whatever you are!
viraptor 6y ago
> accessing your bank is the one time you would really want to use a VPN Why do you think so? Do you want your ISP to not know who you bank with? Do you not trust TLS? Is your network operator an active, advanced threat actor? What problems would you like to solve with VPN in this case?
- bradknowles 6y ago
  Major US carriers are known to use deep packet inspection techniques to change out the advertisements you see on your webpages. If they’re doing that with DPI for purely profit driven reasons, then they are totally untrustworthy when it comes to more criminal activities. They’re also known to use traffic shaping to websites they don’t like, and which they they should pay them more money to get to your eyeballs. Netflix and YouTube are popular examples here. When I can get much higher throughput to Netflix and YouTube when on VPN versus when I’m not using VPN, something is very wrong. So, no. I don’t trust my ISP. Not at all. Not as far as I can bodily throw their HQ building. They also fuck with your VPN connections. Which is why I have accounts with multiple VPN providers.
  - viraptor 6y ago
    Sure, there are some reasons for a web proxy. But I asked about the bank case specifically and none of those apply.
  - ficklepickle 6y ago
    I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store. Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.
    - joveian 6y ago
      Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.
  - joveian 6y ago
    The other thing you can do for that issue is find some more trustworthy ISP somewhere (hopefully not too far away) that allows personal traffic (many do not) and always connect through them. This does not provide anonymity (likely requires ID to sign up) but does provide an encrypted channel through the extra shady ISPs that provide the actual network connection (even worse if you ever use free wifi). I've been doing this with RamNode for a few years with their $15/year OpenVZ mostly via SOCKS with DNS passthrough (the main disadvantage of this is that it doesn't allow direct DNS resolution and some adblock techniques require being able to do that). This includes a fixed dedicated IP address. Presumably they will eventually support wireguard and then everything should work without fuss (you could setup OpenVPN if you are so inclined and I think would need to if you want to additionally use anonymity providing VPNs on top of that). There are still a few issues with various sites but it sounds like it is quite a bit less annoying than anonymous VPNs, at least once Google and Cloudflare figure out what you are doing. The 500GB bandwidth is per month and generously accounted so I've only once reached it (it would be $4/month for an additional TB). I'd guess there are a number of low priced ISPs that would work. Most software I've used seems to respect ALL_PROXY=socks5h://... these days although not all.

I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to use a VPN.

user5994461 6y ago

>>> accessing your bank is the one time you would really want to use a VPN. what makes you possibly think that? using a VPN is the equivalent of walking into a bank with a motorcycle helmet or a bataclava, don't be surprised of the unwarm welcome. I've worked in bank and fintech around fraud. Blocked quite a few VPN/hosting at the network level so they couldn't even reach our network at all.

zxcvbn4038 6y ago
CitiBank? Is that really you? You may be an undigested bit of beef, a blot of mustard, a crumb of cheese, a fragment of underdone potato. There’s more of gravy than of grave about you, whatever you are!

viraptor 6y ago

> accessing your bank is the one time you would really want to use a VPN Why do you think so? Do you want your ISP to not know who you bank with? Do you not trust TLS? Is your network operator an active, advanced threat actor? What problems would you like to solve with VPN in this case?

bradknowles 6y ago
Major US carriers are known to use deep packet inspection techniques to change out the advertisements you see on your webpages. If they’re doing that with DPI for purely profit driven reasons, then they are totally untrustworthy when it comes to more criminal activities. They’re also known to use traffic shaping to websites they don’t like, and which they they should pay them more money to get to your eyeballs. Netflix and YouTube are popular examples here. When I can get much higher throughput to Netflix and YouTube when on VPN versus when I’m not using VPN, something is very wrong. So, no. I don’t trust my ISP. Not at all. Not as far as I can bodily throw their HQ building. They also fuck with your VPN connections. Which is why I have accounts with multiple VPN providers.
- viraptor 6y ago
  Sure, there are some reasons for a web proxy. But I asked about the bank case specifically and none of those apply.
- ficklepickle 6y ago
  I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store. Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.
  - joveian 6y ago
    Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.
- joveian 6y ago
  The other thing you can do for that issue is find some more trustworthy ISP somewhere (hopefully not too far away) that allows personal traffic (many do not) and always connect through them. This does not provide anonymity (likely requires ID to sign up) but does provide an encrypted channel through the extra shady ISPs that provide the actual network connection (even worse if you ever use free wifi). I've been doing this with RamNode for a few years with their $15/year OpenVZ mostly via SOCKS with DNS passthrough (the main disadvantage of this is that it doesn't allow direct DNS resolution and some adblock techniques require being able to do that). This includes a fixed dedicated IP address. Presumably they will eventually support wireguard and then everything should work without fuss (you could setup OpenVPN if you are so inclined and I think would need to if you want to additionally use anonymity providing VPNs on top of that). There are still a few issues with various sites but it sounds like it is quite a bit less annoying than anonymous VPNs, at least once Google and Cloudflare figure out what you are doing. The 500GB bandwidth is per month and generously accounted so I've only once reached it (it would be $4/month for an additional TB). I'd guess there are a number of low priced ISPs that would work. Most software I've used seems to respect ALL_PROXY=socks5h://... these days although not all.