27 ms·

I have been (and still am) a long term supporter and subscriber of Mullvad services. I don't forsee that changing. One concern though, is the blanket blockade

by gzer0 4y ago

I have been (and still am) a long term supporter and subscriber of Mullvad services. I don't forsee that changing. One concern though, is the blanket blockade of their IP addresses accross multiple services; I'm not talking about the avalanche of captcha's one must deal with, but for example: I wasn't even able to update a fresh install of ubuntu via sudo apt-get update && sudo apt-get upgrade... it refused to connect to mullvad IPs. I've been running into this problem more and more, first it was linux distro issues, then, my gaming client, and perhaps the worst, Github itself. I'm not sure what the solution is here, since Mullvad provides unparalleled respect of privacy; but the IP's they use are almost always associated with the highest levels of fraud. Perhaps, this is the price I am willing to pay for privacy done right. Props to Mullvad, for being the best in that regard.

marginalia_nu 4y ago
This is arguably one of the big problems with the Internet today. On the one hand, browser automation is extremely effective and nearly indistinguishable from human traffic, and bot traffic often eclipses that of human visitors, depending on what you're serving, consuming an enormous amount of resources. On the other hand, using IP-reputation to decide who gets a captcha is one of the few methods that undeniably works. It's really unfair and I wish it didn't have to be that way, but at least for my websites, I can't serve traffic to human visitors if I don't discriminate against these IP blocks with captchas and whatever. I just don't have the hardware. The bot traffic I get is something like 50x that of sitting at #1 on the HN front page.
- humanistbot 4y ago
  > On the other hand, using IP-reputation to decide who gets a captcha is one of the few methods that undeniably works For a particular definition of "works." Giving everyone a captcha would also "work", but with different tradeoffs.
  - marginalia_nu 4y ago
    Well of course, shutting down the server works too, I mean works in the context of reducing false positives while very effectively blocking most bots.
- 3np 4y ago
  I've been thinking a bit abut trying out something different here. What I have in mind would be an alternative method that the user can opt for instead of the captcha (if flagged). It would be for those privacy people on Tor or Mullvad or what have you and will not compromise on privacy but may be a bit more techy/involve some form of crypto (no investments or new coins etc tho). So you'd still have the CAPTCHA of today but with an alternative. Assuming it's something that would seem to be a usable and smoother solution for those people you are today locking out or providing a hassle for without significant increase of malicious bots (maybe you'll even get less if it works all right and it means you can tune up the aggressiveness in the rest of the system), about how much willing would you be to try something out? (I'm aware of PrivacyPass but IME while I did have it work at times, most of the time it works extremely poorly to the point of being unusable on both Cloudflare and hCapctcha, while maintenance and support seem on the backburner)
drcongo 4y ago
I have Mullvad switched on 24/7 and I've not come across this. I wonder if there's a difference across regions.
OJFord 4y ago
Ironically it's Amazon (just the e-commerce site, not AWS) that gives me most grief!
CommieBobDole 4y ago
Almost every site I've seen blocked on Mullvad seems to show a Cloudflare 'access denied' page. Since most sites using Cloudflare still work, I assume there's an option for site owners to block known VPN addresses.
Cthulhu_ 4y ago
> since Mullvad provides unparalleled respect of privacy This is both their selling point and their main problem; privacy means criminal abuse. This is true for all kinds of anonymity, hiding your tracks, hiding your payments, etc; TOR, cryptocurrencies, encrypted chat, they all suffer reputation damage due to criminal abuse. And there is no obvious solution that does not impede users' privacy, as far as I know.
- Geonode 4y ago
  There will always be crime. Trying to prevent crime leads to reducing freedom, and not crime.
  - rightbyte 4y ago
    I like the trade off of locking my door over the freedom of not needing a key. I would not be so fatalistic about impossibility of policies that respect privacy.
bbertelsen 4y ago
You will get less captchas if you use their socks proxy. https://mullvad.net/en/help/socks5-proxy/ https://mullvad.net/en/help/socks5-proxy/
jsheard 4y ago
I've found that M247 IPs are the most problematic, every single one of their IPs seems to be blocked by Imgur for example Thankfully Mullvads client lets you filter servers by provider so it's easy to take M247 out of rotation
- ntauthority 4y ago
  Anecdotal point of data: M247 seems to run a lot of bad-faith traffic as well - while a service I run tries to keep block lists minimal even for frequently abused endpoints (eg credential stuffing) their ASNs are a mainstay in there.
  - ev1 4y ago
    Same - I get an absolutely comedic amount of abuse from M247.

by gzer0 4y ago

marginalia_nu 4y ago

This is arguably one of the big problems with the Internet today. On the one hand, browser automation is extremely effective and nearly indistinguishable from human traffic, and bot traffic often eclipses that of human visitors, depending on what you're serving, consuming an enormous amount of resources. On the other hand, using IP-reputation to decide who gets a captcha is one of the few methods that undeniably works. It's really unfair and I wish it didn't have to be that way, but at least for my websites, I can't serve traffic to human visitors if I don't discriminate against these IP blocks with captchas and whatever. I just don't have the hardware. The bot traffic I get is something like 50x that of sitting at #1 on the HN front page.

humanistbot 4y ago
> On the other hand, using IP-reputation to decide who gets a captcha is one of the few methods that undeniably works For a particular definition of "works." Giving everyone a captcha would also "work", but with different tradeoffs.
- marginalia_nu 4y ago
  Well of course, shutting down the server works too, I mean works in the context of reducing false positives while very effectively blocking most bots.
3np 4y ago
I've been thinking a bit abut trying out something different here. What I have in mind would be an alternative method that the user can opt for instead of the captcha (if flagged). It would be for those privacy people on Tor or Mullvad or what have you and will not compromise on privacy but may be a bit more techy/involve some form of crypto (no investments or new coins etc tho). So you'd still have the CAPTCHA of today but with an alternative. Assuming it's something that would seem to be a usable and smoother solution for those people you are today locking out or providing a hassle for without significant increase of malicious bots (maybe you'll even get less if it works all right and it means you can tune up the aggressiveness in the rest of the system), about how much willing would you be to try something out? (I'm aware of PrivacyPass but IME while I did have it work at times, most of the time it works extremely poorly to the point of being unusable on both Cloudflare and hCapctcha, while maintenance and support seem on the backburner)

drcongo 4y ago

I have Mullvad switched on 24/7 and I've not come across this. I wonder if there's a difference across regions.

OJFord 4y ago

Ironically it's Amazon (just the e-commerce site, not AWS) that gives me most grief!

CommieBobDole 4y ago

Almost every site I've seen blocked on Mullvad seems to show a Cloudflare 'access denied' page. Since most sites using Cloudflare still work, I assume there's an option for site owners to block known VPN addresses.

Cthulhu_ 4y ago

> since Mullvad provides unparalleled respect of privacy This is both their selling point and their main problem; privacy means criminal abuse. This is true for all kinds of anonymity, hiding your tracks, hiding your payments, etc; TOR, cryptocurrencies, encrypted chat, they all suffer reputation damage due to criminal abuse. And there is no obvious solution that does not impede users' privacy, as far as I know.

Geonode 4y ago
There will always be crime. Trying to prevent crime leads to reducing freedom, and not crime.
- rightbyte 4y ago
  I like the trade off of locking my door over the freedom of not needing a key. I would not be so fatalistic about impossibility of policies that respect privacy.

bbertelsen 4y ago

You will get less captchas if you use their socks proxy. https://mullvad.net/en/help/socks5-proxy/ https://mullvad.net/en/help/socks5-proxy/

jsheard 4y ago

I've found that M247 IPs are the most problematic, every single one of their IPs seems to be blocked by Imgur for example Thankfully Mullvads client lets you filter servers by provider so it's easy to take M247 out of rotation

ntauthority 4y ago
Anecdotal point of data: M247 seems to run a lot of bad-faith traffic as well - while a service I run tries to keep block lists minimal even for frequently abused endpoints (eg credential stuffing) their ASNs are a mainstay in there.
- ev1 4y ago
  Same - I get an absolutely comedic amount of abuse from M247.