4 ms·

I suspect I was banned from Instagram in the same way. No explanation was given. I use ProtonVPN. It wasn't until Spotify stopped working sometime later (403 F

I suspect I was banned from Instagram in the same way. No explanation was given. I use ProtonVPN. It wasn't until Spotify stopped working sometime later (403 Forbidden for all HTTP requests) that I narrowed it down to using VPN. Seems to be a growing thing. Thankfully, Spotify didn't do anything to my account, and it continued to work from regular IPs.

miyuru 5y ago
At work we got a login attack via VPN IPs and we blocked VPNs from login in via AWS WAF and 2 days later a major user was complaining that he cant login. We had to remove the rule. (developers were working on captcha in the meantime) I also used a tunnel when Spotify was not available globally. It did not create any issues. Using a Public VPN is double edged sword. If you really need it its better to setup a wireguard tunnel to a own server as the the Public VPN IPs as monitored by the security companies and also get abused all the time.
- Monotoko 5y ago
  Can't you do a captcha with the WAF? I'm pretty sure that's an option on AWS
  - miyuru 5y ago
    the attack was to an api endpoint. which is queried via xhr on the main app. adding captcha to it would break the app to all users. the developers are now working on adding captcha at the application level and also signing the api endpoints.
  - dragonwriter 5y ago
    > Can't you do a captcha with the WAF? I'm pretty sure that's an option on AWS You can. I know because our information security office did it to all of our web endpoints. Which are mostly API endpoints. Without telling anyone involved with individual apps, before or even, until specific complaints got to them, after doing it.
    - exikyut 5y ago
      *Large rueful sigh* I feel your pain. It's stuff like that that just makes you know, they not only have no idea what they're doing, the level of agency and access they have mean it's just a question of when they finally accidentally something big on fire one day - and whether you'll be able to make it out unscathed with eg just some lost sleep. Would probably make a good story for http://old.reddit.com/r/talesfromtechsupport http://old.reddit.com/r/talesfromtechsupport, as you're probably already aware. If you feel like (and can stand) writing it (heh).
- namibj 5y ago
  The reason OP flipped between VPN exit locations in the first places has been because they wanted a VPN against the local ISP (public wifi, apparently) manipulating/sniffing traffic, without the latency penalty of going from France to the UK or vice-versa. That said, a vps in Amsterdam is quite practical from both locations, especially if mildly-congested wifi is already involved.

miyuru 5y ago

At work we got a login attack via VPN IPs and we blocked VPNs from login in via AWS WAF and 2 days later a major user was complaining that he cant login. We had to remove the rule. (developers were working on captcha in the meantime) I also used a tunnel when Spotify was not available globally. It did not create any issues. Using a Public VPN is double edged sword. If you really need it its better to setup a wireguard tunnel to a own server as the the Public VPN IPs as monitored by the security companies and also get abused all the time.

Monotoko 5y ago
Can't you do a captcha with the WAF? I'm pretty sure that's an option on AWS
- miyuru 5y ago
  the attack was to an api endpoint. which is queried via xhr on the main app. adding captcha to it would break the app to all users. the developers are now working on adding captcha at the application level and also signing the api endpoints.
- dragonwriter 5y ago
  > Can't you do a captcha with the WAF? I'm pretty sure that's an option on AWS You can. I know because our information security office did it to all of our web endpoints. Which are mostly API endpoints. Without telling anyone involved with individual apps, before or even, until specific complaints got to them, after doing it.
  - exikyut 5y ago
    *Large rueful sigh* I feel your pain. It's stuff like that that just makes you know, they not only have no idea what they're doing, the level of agency and access they have mean it's just a question of when they finally accidentally something big on fire one day - and whether you'll be able to make it out unscathed with eg just some lost sleep. Would probably make a good story for http://old.reddit.com/r/talesfromtechsupport http://old.reddit.com/r/talesfromtechsupport, as you're probably already aware. If you feel like (and can stand) writing it (heh).
namibj 5y ago
The reason OP flipped between VPN exit locations in the first places has been because they wanted a VPN against the local ISP (public wifi, apparently) manipulating/sniffing traffic, without the latency penalty of going from France to the UK or vice-versa. That said, a vps in Amsterdam is quite practical from both locations, especially if mildly-congested wifi is already involved.