5 ms·

My biggest problem with using a VPN is the overtly hostile treatment by Google and Cloudflare. Everytime I try to browse with a VPN (currently using Windscribe

My biggest problem with using a VPN is the overtly hostile treatment by Google and Cloudflare. Everytime I try to browse with a VPN (currently using Windscribe) I just see those nasty captchas everywhere. Google won't even let me do a simple search without letting me tag zebra crossings and school buses. Same with Cloudflare which also adds CAPTCHA before showing me a site which is basically most of the internet now. Really don't understand why they do this to VPN users. Anyway, Anybody know how to fix this?

slivanes 5y ago
Unfortunately criminal/fraudulent/unsocial activity also occurs almost elusively behind a VPN, you might not be doing such things, but websites can't tell if you're not one of those people.
- gunapologist99 5y ago
  Unfortunately criminal/fraudulent/unsocial activity also occurs almost exclusively in certain neighborhoods. You might not be doing such things, but no one can tell if you're not one of those people.
  - jl6 5y ago
    This is one of the reasons why insurance premiums vary by zip code.
  - treesknees 5y ago
    I'm not sure what you're trying to add to the conversation. Companies and network providers implement regional and country blocking all the time. My company doesn't do business with anyone in China, so they block IP addresses associated with China. It's not insinuating racism or profiling of the people, but it's well-known that certain areas of the world have bad actors. If you're trying to somehow set an example of where it's OK in one context and not OK in another, that's really not a fair comparison.
  - supertrope 5y ago
    While ZIP correlates with race and other federally protected classes, using a VPN is not an immutable feature.
    - will4274 5y ago
      ZIP isn't an immutable feature either, it's used as a proxy for many features, some immutable.
- wizzwizz4 5y ago
  In the real world, we solve this issue with “protected classes”. Maybe we should have an internet equivalent? (Inb4: yes, the philosophy and circumstances behind protected classes are different. However, it's relevant prior art.)
  - sodality2 5y ago
    This would require identification of rogue "protected" users, to kick them out, thus ruling out using any sort of blind verification and ruining online privacy for those using it. And naturally, it's marginally more convenient while being extremely detrimental to privacy, thus it'll be popular, thus services will eventually block non-"protected" users, thus ruining the internet even more.
    - wizzwizz4 5y ago
      No, I mean like “you're not allowed to consider whether a user is behind a VPN when making decisions”.
      - sodality2 5y ago
        Ohhhh I see. My mistake!
commoner 5y ago
Cloudflare works with Privacy Pass, a browser extension through which you can solve CAPTCHAs in advance to accumulate tokens that let you bypass CAPTCHAs served by participating services (including Cloudflare, but not Google) as you browse the web. One pre-solved CAPTCHA gives you 30 tokens for ReCAPTCHA or 5 tokens for hCaptcha: https://privacypass.github.io https://privacypass.github.io I didn't encounter any serious CAPTCHA issues when I tried out Mullvad and Mozilla VPN. Windscribe is probably worse for CAPTCHAs because of its free tier and the lifetime membership that it previously sold for a low price. VPNs that require ongoing paid subscriptions tend to have higher-quality traffic.
- mandarax8 5y ago
  What stops people from just botting the captcha tokens? More captcha's?
  - commoner 5y ago
    The Privacy Pass server uses key rotation to make the tokens expire after a certain period of time. The documentation also hints at other measures including rate limiting and using a web application firewall: https://github.com/privacypass/challenge-bypass-extension/blob/master/docs/PROTOCOL.md#stockpiling-of-passes https://github.com/privacypass/challenge-bypass-extension/bl...
- Seirdy 5y ago
  Extensions like this make users more fingerprintable so that kind of defeats half the stated purpose of using a commercial VPN. They also weaken the browser's security model, which is part of the reason why Tor users are told to never install addons.
  - jzelinskie 5y ago
    PrivacyPass is not your average extension. It's got a strong basis in applied cryptographic research and was designed to solve the captcha problem in a safe way for tor. It's now later been adopted by both cloudflare and google, so I'm pretty sure it's well vetted.
relaunched 5y ago
I see those as inconvenient MFA. Can you explain why you consider it hostile?
- treesknees 5y ago
  Despite "renting" my IP address from Linode for over 10 years, occasionally the IP block I'm in ends up on Google's bad side. When I'm using my VPN server, I have to _constantly_ enter captchas to do any search, and often times it's just completely blocked. I'd say it's hostile because they don't just do a captcha and mark you as a a human for the next 24 hours, it can happen with every search. MFA isn't an accurate characterization of what they're doing.
  - relaunched 5y ago
    That's very annoying. I guess they don't prioritize your user path; I'm sure they would fix that, if there were 100 million users just like you. Sorry to hear that.
azalemeth 5y ago
Gcaptcha hates VPN users, and Firefox users [1, 2]. You can ameliorate this by being logged in in a google account (!). The cynic in me mutters something here about advertising. Cloudfare, on the other hand, sometimes just decides that the website said "nope" and blocks you. It's such a giant PITA. I spend a lot of time in two countries because of my job and family -- and one restaurant near my home in one of them has decided to block all IPv4 (but not ipv6...) connections to it with cloudfare. I used to look at their menu online, often on the days that I flew back (in the 'before times'). I have to use a VPN to get around that (their food is good!). Cloudfare recently started introducing obnoxious captcha requirements and occasionally outright blocking. The more people who use VPNs -- and I am sure they are on the rise -- the more it becomes normalised hopefully the more that this goes away. To be honest, it's a price worth paying for privacy at any rate. [1] https://grumpy.website/post/0RzW4elEN https://grumpy.website/post/0RzW4elEN [2] https://news.ycombinator.com/item?id=20147015 https://news.ycombinator.com/item?id=20147015
- supertrope 5y ago
  The web is still a Wild West in many ways. If stores suffered meatspace equivalents of DDOS, rampant fraud, spam, and harassment they’d also use heavy handed countermeasures.
- pilsetnieks 5y ago
  It's the website operator who chooses the severity of the Cloudflare interstitial page. I don't recall the default value off the top of my head but I think the captcha page had to be explicitly enabled, and the confidence level could be adjusted by the operator.
penagwin 5y ago
Because like 90% of the traffic is malicious. VPNs and proxies obviously change your exit IP, and people rotate through these as they do things like spam, make accounts, credential stuff, etc. This means they're burning through the IP ranges and getting them flagged. If you're on a VPN with a fresh ASN and IP range you won't have any issues (until people start using it for other reasons). If you wanted to "fix it" the dirty method, there's extensions for chrome/firefox/etc that will automatically submit your captcha to a captcha solving service and it costs some tiny amount. tldr; Mischievous basically has to go through VPNs, and they rotate through IPs getting them flagged. You can join the dark side with a captcha solving service and extension, and there's some "solutions" like privacy pass you can try.
stjohnswarts 5y ago
You're exaggerating. I use mullvad on 3 systems and definitely see captcha here and there but it's not very often. I can't imagine that mozilla's vpn is much different since the backen is the same.
ipaddr 5y ago
Those two are the biggest barriers to privacy so it would make sense.
lilsoso 5y ago
I get locked out of gmail using NordVPN with increasing frequency. I was locked out of my account this week for one night.

slivanes 5y ago

Unfortunately criminal/fraudulent/unsocial activity also occurs almost elusively behind a VPN, you might not be doing such things, but websites can't tell if you're not one of those people.

gunapologist99 5y ago
Unfortunately criminal/fraudulent/unsocial activity also occurs almost exclusively in certain neighborhoods. You might not be doing such things, but no one can tell if you're not one of those people.
- jl6 5y ago
  This is one of the reasons why insurance premiums vary by zip code.
- treesknees 5y ago
  I'm not sure what you're trying to add to the conversation. Companies and network providers implement regional and country blocking all the time. My company doesn't do business with anyone in China, so they block IP addresses associated with China. It's not insinuating racism or profiling of the people, but it's well-known that certain areas of the world have bad actors. If you're trying to somehow set an example of where it's OK in one context and not OK in another, that's really not a fair comparison.
- supertrope 5y ago
  While ZIP correlates with race and other federally protected classes, using a VPN is not an immutable feature.
  - will4274 5y ago
    ZIP isn't an immutable feature either, it's used as a proxy for many features, some immutable.
wizzwizz4 5y ago
In the real world, we solve this issue with “protected classes”. Maybe we should have an internet equivalent? (Inb4: yes, the philosophy and circumstances behind protected classes are different. However, it's relevant prior art.)
- sodality2 5y ago
  This would require identification of rogue "protected" users, to kick them out, thus ruling out using any sort of blind verification and ruining online privacy for those using it. And naturally, it's marginally more convenient while being extremely detrimental to privacy, thus it'll be popular, thus services will eventually block non-"protected" users, thus ruining the internet even more.
  - wizzwizz4 5y ago
    No, I mean like “you're not allowed to consider whether a user is behind a VPN when making decisions”.
    - sodality2 5y ago
      Ohhhh I see. My mistake!

commoner 5y ago

Cloudflare works with Privacy Pass, a browser extension through which you can solve CAPTCHAs in advance to accumulate tokens that let you bypass CAPTCHAs served by participating services (including Cloudflare, but not Google) as you browse the web. One pre-solved CAPTCHA gives you 30 tokens for ReCAPTCHA or 5 tokens for hCaptcha: https://privacypass.github.io https://privacypass.github.io I didn't encounter any serious CAPTCHA issues when I tried out Mullvad and Mozilla VPN. Windscribe is probably worse for CAPTCHAs because of its free tier and the lifetime membership that it previously sold for a low price. VPNs that require ongoing paid subscriptions tend to have higher-quality traffic.

mandarax8 5y ago
What stops people from just botting the captcha tokens? More captcha's?
- commoner 5y ago
  The Privacy Pass server uses key rotation to make the tokens expire after a certain period of time. The documentation also hints at other measures including rate limiting and using a web application firewall: https://github.com/privacypass/challenge-bypass-extension/blob/master/docs/PROTOCOL.md#stockpiling-of-passes https://github.com/privacypass/challenge-bypass-extension/bl...
Seirdy 5y ago
Extensions like this make users more fingerprintable so that kind of defeats half the stated purpose of using a commercial VPN. They also weaken the browser's security model, which is part of the reason why Tor users are told to never install addons.
- jzelinskie 5y ago
  PrivacyPass is not your average extension. It's got a strong basis in applied cryptographic research and was designed to solve the captcha problem in a safe way for tor. It's now later been adopted by both cloudflare and google, so I'm pretty sure it's well vetted.

relaunched 5y ago

I see those as inconvenient MFA. Can you explain why you consider it hostile?

treesknees 5y ago
Despite "renting" my IP address from Linode for over 10 years, occasionally the IP block I'm in ends up on Google's bad side. When I'm using my VPN server, I have to _constantly_ enter captchas to do any search, and often times it's just completely blocked. I'd say it's hostile because they don't just do a captcha and mark you as a a human for the next 24 hours, it can happen with every search. MFA isn't an accurate characterization of what they're doing.
- relaunched 5y ago
  That's very annoying. I guess they don't prioritize your user path; I'm sure they would fix that, if there were 100 million users just like you. Sorry to hear that.

azalemeth 5y ago

Gcaptcha hates VPN users, and Firefox users [1, 2]. You can ameliorate this by being logged in in a google account (!). The cynic in me mutters something here about advertising. Cloudfare, on the other hand, sometimes just decides that the website said "nope" and blocks you. It's such a giant PITA. I spend a lot of time in two countries because of my job and family -- and one restaurant near my home in one of them has decided to block all IPv4 (but not ipv6...) connections to it with cloudfare. I used to look at their menu online, often on the days that I flew back (in the 'before times'). I have to use a VPN to get around that (their food is good!). Cloudfare recently started introducing obnoxious captcha requirements and occasionally outright blocking. The more people who use VPNs -- and I am sure they are on the rise -- the more it becomes normalised hopefully the more that this goes away. To be honest, it's a price worth paying for privacy at any rate. [1] https://grumpy.website/post/0RzW4elEN https://grumpy.website/post/0RzW4elEN [2] https://news.ycombinator.com/item?id=20147015 https://news.ycombinator.com/item?id=20147015

supertrope 5y ago
The web is still a Wild West in many ways. If stores suffered meatspace equivalents of DDOS, rampant fraud, spam, and harassment they’d also use heavy handed countermeasures.
pilsetnieks 5y ago
It's the website operator who chooses the severity of the Cloudflare interstitial page. I don't recall the default value off the top of my head but I think the captcha page had to be explicitly enabled, and the confidence level could be adjusted by the operator.

penagwin 5y ago

Because like 90% of the traffic is malicious. VPNs and proxies obviously change your exit IP, and people rotate through these as they do things like spam, make accounts, credential stuff, etc. This means they're burning through the IP ranges and getting them flagged. If you're on a VPN with a fresh ASN and IP range you won't have any issues (until people start using it for other reasons). If you wanted to "fix it" the dirty method, there's extensions for chrome/firefox/etc that will automatically submit your captcha to a captcha solving service and it costs some tiny amount. tldr; Mischievous basically has to go through VPNs, and they rotate through IPs getting them flagged. You can join the dark side with a captcha solving service and extension, and there's some "solutions" like privacy pass you can try.

stjohnswarts 5y ago

You're exaggerating. I use mullvad on 3 systems and definitely see captcha here and there but it's not very often. I can't imagine that mozilla's vpn is much different since the backen is the same.

ipaddr 5y ago

Those two are the biggest barriers to privacy so it would make sense.

lilsoso 5y ago

I get locked out of gmail using NordVPN with increasing frequency. I was locked out of my account this week for one night.