4 ms·

If there was a list of commercial VPN provider IP ranges, we’d block that too. A key property of people who aren’t willing to relinquish their anonymity for ev

by derefr 4y ago

If there was a list of commercial VPN provider IP ranges, we’d block that too. A key property of people who aren’t willing to relinquish their anonymity for even a moment in registering for your service, is that they’ll never be able to pay money for your service, either, because doing so would reveal their identity through their credit card. (Yes, they can use Bitcoin or whatever, but then you’re basically signing up to be a dark web business, having to deal with being a money-laundering sink for stolen funds.) So, if your goal in getting users to sign up, is to feed them through a funnel that eventually ends up with them paying you money, then you can take “signs up using a VPN” (or an email anonymization service, or…) as an immediate self-disqualification. Of course, most such failed attempts are innocent first-time “I didn’t realize you cared” attempts; so we just throw a clear error message, telling them to try again with their real email+IP+etc. But when a user responds to that error by just trying more and more email proxy domains, or repeatedly rotating their VPN country… well, that’s someone who’ll never be a customer. May as well just block them and be done with it.

leshenka 4y ago
Have you ever considered that some people use vpn in order to be able access your service not because they want to hide from you?
- derefr 4y ago
  Yes. Despite wanting to, those people will also be unable to ever pay for our service, because — amongst other reasons — our service is hosted on Google Cloud; and Google has decided to block people in countries which the US trade-embargoes, from interacting with any Google servers — including Google Cloud customer servers. It's a whole thing. We'd have to go multi-cloud to get around it. (AWS solved this by building an AWS China region that's actually owned-and-operated by Chinese companies without Amazon leadership.)
  - viraptor 4y ago
    That's a big assumption that they won't be able to pay you. It may be economically true enough that you don't care, but "unable to ever pay for our service" is not a given. My physical location or current internet connection does not determine where my payment method exists. This is similar to for example Vodafone not listing their mobile app in countries they don't operate in so I can't install it to recharge a sim I'm going to use in a week... in one of those countries. Or ANZ bank making it hard to get their app from abroad.
    - derefr 4y ago
      If it was practical to do so (maybe involving a clever splitting of customer dashboard pages onto different domains in different Cloudflare zones?), we would only shut off free-tier access for these people, while still allowing sign-ups that skip the promotion and take (and place a hold on) a card straight from the start. Sort of like how some people can't qualify for a post-paid cellphone plan, but anyone can get a prepaid cellphone plan. As it is, though, we can't block VPNs even if we wanted to; VPN companies are currently winning the arms race against VPN detection. (You can tell who's currently on the winning side this week by whether you see YouTube ads that make the claim that you can use a VPN to enable geo-shifting for Netflix. Netflix is legally obligated by its IP licence-agreements to do what it can to shut that down; and whenever they manage it, the VPN services stop making that claim for a while, until they figure out how to make it happen again. Currently, they're making it.)
      - novok 4y ago
        They make it work via renting people's bandwidth at homes, so their connections source from residential ISP IPs. https://arstechnica.com/gadgets/2021/08/netflix-is-adding-residential-ip-addresses-to-its-vpn-blocklists/ https://arstechnica.com/gadgets/2021/08/netflix-is-adding-re...
      - alam2000 4y ago
  - dannyw 4y ago
    Russians can access Google Cloud fine.
    - derefr 4y ago
      Tangent, but the US sanctions against Russia consist of a series of specific sanctions (https://www.trade.gov/country-commercial-guides/russia-sanctions-framework https://www.trade.gov/country-commercial-guides/russia-sanct...) rather than a general embargo on trade. Mostly they're an import ban (because Russia relies on global exports to acquire USD), plus a very narrow "luxury goods" export ban (which I believe is intended to annoy Russian oligarchs while not impacting most Russian citizens.) There's no current US sanction against export of technology or services to Russia; and so Google isn't legally obligated to do anything about Russian traffic.
      - leosarev 4y ago
        That's actually incorrect. I can't pay in Google play by any means. It's problematic to buy Windows license. Our company was banned from using Office 365 and our sharepoints shares was *wiped* up. Latter was happened, because we are connected to oil industry, and happened despite that we are buying office 365 using non-russia-based company.
    - leosarev 4y ago
      Yes, but we can't pay using russia-issued Visa or Mastercard for foreign services.
kortilla 4y ago
> A key property of people who aren’t willing to relinquish their anonymity for even a moment in registering for your service, is that they’ll never be able to pay money for your service Wow, you just keep swinging and missing with such confidence! I use VPNs because I don’t trust rando open WiFi hotspots or the ISPs that serve them. I frequently still buy things over the VPN and stay logged in with accounts attached to me. You seem like the type of business owner that would remove the handicap accessible entrance because it’s easier to break into.
- derefr 4y ago
  > I use VPNs because I don’t trust rando open WiFi hotspots or the ISPs that serve them. I frequently still buy things over the VPN and stay logged in with accounts attached to me. So what? If our service gave you that clear error message that we don't accept VPNs — well, you would have the perfectly-viable option of just waiting until you get home to register. It's not the sort of service you register for "in anger" with any kind of urgency. It's a B2B data-analysis API, only relevant for companies and professionals; and it's one that you need to spend hours exploring and reading the docs of to get real use out of, because "real use" almost always consists of calling multiple endpoints, graph-walk-wise, to explore data relationships. Also, as it happens, we don't consider "invited by a team member" to be a registration; coming in through an invite link doesn't go through any of the checks. (This is because we've yet to actually see a promotion-fraud attacker who has ever taken advantage of the teams system. Probably they assume all accounts in a team will be rate-limited together at the team level, even though we've never said anything to that effect.) So if you're working for a company that has chosen to use our API, and you're not the one person in your company who was tasked with initially evaluating our API, but rather are just someone who needs to actually use it — then you'll do that by receiving an email, clicking on the magic link, and filling out your details; and all of that will work just fine over your VPN on the rando open WiFi hotspot. Because "clicking on an invite link" is distinguishable from promotion fraud. It's only if your traffic is indistinguishable from promotion fraud — if it fits the signature of promotion fraud — that we'll block it. And that signature, right now, for us, is: 1. sends traffic from a colo, VPN, or Tor exit-node IP address; 2. uses an email address where the domain is either: 2a. from a "temporary inbox service"; 2b. from one of a few common mail services which do not themselves speed-limit registrations (Microsoft / outlook.com is bad for this; Rambler.ru is another. Perhaps surprisingly to any cypherpunks in the audience, ProtonMail isn't in this set — so they're fingerprinting you somehow to enable that!): 2c. freshly-created (<2d old); 2d. has an MX record whose zone's NS record indicates that their MTA is hosted on a cheap colo (you'd think this would generate false positives, but it's very unlikely on the modern web, as an MTA on such a box would have too low a reputation to send mail, so nobody would bother unless the MTA is only for receiving, i.e. is a one-off temporary email proxy-host); 3. uses an email address where the username is either: 3a. "gibberish" — indistinguishable from keyboard-mashing (see https://pypi.org/project/gibberish-detector/); https://pypi.org/project/gibberish-detector/); 3b. generated by combining census-data-list names with 4+-digit number suffixes, with the former to make the address look real, and the latter to ensure a low change of collision at time of address registration; 4. specifies a user name, organization name, and/or API-key label (all free-text fields) as either gibberish, or mail-merged repetitions of the name in the address. (Real people who don't want to fill these out say something petulant here, rather than keyboard-mashing.) 5. matches the browser fingerprint of a previously-detected multiple-incident attack. (We do client-side browser fingerprinting, only for the registration page, to catch people who use e.g. Puppeteer + Zyte Smart Proxy Manager to automate registrations; but who don't realize that the Puppeteer Stealth plugin exists. Which is, surprisingly, a lot of people.) These are all just factors in your registration "credit score"; you have to trigger multiple of them to get denied by our accounts backend. We only start putting IPs into blocklists (thus making it into, in a sense, a single-factor denial) once we've actually seen attacks coming from these IPs. But we do investigate each such attack; and if the offending IPs all came from some "dedicated-bare-metal unmetered-bandwidth machine host" that nobody's ever heard of + exists as its own ASN + has no claim on its website to be policing its customers for abusive behavior (or worse, doesn't even have a website!)... then it's time to block that entire netblock, and every other netblock owned by the ASN, and every other ASN owned by the company. Every time we haven't before, the attacks just come back.

by derefr 4y ago

leshenka 4y ago

Have you ever considered that some people use vpn in order to be able access your service not because they want to hide from you?

derefr 4y ago
Yes. Despite wanting to, those people will also be unable to ever pay for our service, because — amongst other reasons — our service is hosted on Google Cloud; and Google has decided to block people in countries which the US trade-embargoes, from interacting with any Google servers — including Google Cloud customer servers. It's a whole thing. We'd have to go multi-cloud to get around it. (AWS solved this by building an AWS China region that's actually owned-and-operated by Chinese companies without Amazon leadership.)
- viraptor 4y ago
  That's a big assumption that they won't be able to pay you. It may be economically true enough that you don't care, but "unable to ever pay for our service" is not a given. My physical location or current internet connection does not determine where my payment method exists. This is similar to for example Vodafone not listing their mobile app in countries they don't operate in so I can't install it to recharge a sim I'm going to use in a week... in one of those countries. Or ANZ bank making it hard to get their app from abroad.
  - derefr 4y ago
    If it was practical to do so (maybe involving a clever splitting of customer dashboard pages onto different domains in different Cloudflare zones?), we would only shut off free-tier access for these people, while still allowing sign-ups that skip the promotion and take (and place a hold on) a card straight from the start. Sort of like how some people can't qualify for a post-paid cellphone plan, but anyone can get a prepaid cellphone plan. As it is, though, we can't block VPNs even if we wanted to; VPN companies are currently winning the arms race against VPN detection. (You can tell who's currently on the winning side this week by whether you see YouTube ads that make the claim that you can use a VPN to enable geo-shifting for Netflix. Netflix is legally obligated by its IP licence-agreements to do what it can to shut that down; and whenever they manage it, the VPN services stop making that claim for a while, until they figure out how to make it happen again. Currently, they're making it.)
    - novok 4y ago
      They make it work via renting people's bandwidth at homes, so their connections source from residential ISP IPs. https://arstechnica.com/gadgets/2021/08/netflix-is-adding-residential-ip-addresses-to-its-vpn-blocklists/ https://arstechnica.com/gadgets/2021/08/netflix-is-adding-re...
    - alam2000 4y ago
- dannyw 4y ago
  Russians can access Google Cloud fine.
  - derefr 4y ago
    Tangent, but the US sanctions against Russia consist of a series of specific sanctions (https://www.trade.gov/country-commercial-guides/russia-sanctions-framework https://www.trade.gov/country-commercial-guides/russia-sanct...) rather than a general embargo on trade. Mostly they're an import ban (because Russia relies on global exports to acquire USD), plus a very narrow "luxury goods" export ban (which I believe is intended to annoy Russian oligarchs while not impacting most Russian citizens.) There's no current US sanction against export of technology or services to Russia; and so Google isn't legally obligated to do anything about Russian traffic.
    - leosarev 4y ago
      That's actually incorrect. I can't pay in Google play by any means. It's problematic to buy Windows license. Our company was banned from using Office 365 and our sharepoints shares was *wiped* up. Latter was happened, because we are connected to oil industry, and happened despite that we are buying office 365 using non-russia-based company.
  - leosarev 4y ago
    Yes, but we can't pay using russia-issued Visa or Mastercard for foreign services.

kortilla 4y ago

> A key property of people who aren’t willing to relinquish their anonymity for even a moment in registering for your service, is that they’ll never be able to pay money for your service Wow, you just keep swinging and missing with such confidence! I use VPNs because I don’t trust rando open WiFi hotspots or the ISPs that serve them. I frequently still buy things over the VPN and stay logged in with accounts attached to me. You seem like the type of business owner that would remove the handicap accessible entrance because it’s easier to break into.

derefr 4y ago
> I use VPNs because I don’t trust rando open WiFi hotspots or the ISPs that serve them. I frequently still buy things over the VPN and stay logged in with accounts attached to me. So what? If our service gave you that clear error message that we don't accept VPNs — well, you would have the perfectly-viable option of just waiting until you get home to register. It's not the sort of service you register for "in anger" with any kind of urgency. It's a B2B data-analysis API, only relevant for companies and professionals; and it's one that you need to spend hours exploring and reading the docs of to get real use out of, because "real use" almost always consists of calling multiple endpoints, graph-walk-wise, to explore data relationships. Also, as it happens, we don't consider "invited by a team member" to be a registration; coming in through an invite link doesn't go through any of the checks. (This is because we've yet to actually see a promotion-fraud attacker who has ever taken advantage of the teams system. Probably they assume all accounts in a team will be rate-limited together at the team level, even though we've never said anything to that effect.) So if you're working for a company that has chosen to use our API, and you're not the one person in your company who was tasked with initially evaluating our API, but rather are just someone who needs to actually use it — then you'll do that by receiving an email, clicking on the magic link, and filling out your details; and all of that will work just fine over your VPN on the rando open WiFi hotspot. Because "clicking on an invite link" is distinguishable from promotion fraud. It's only if your traffic is indistinguishable from promotion fraud — if it fits the signature of promotion fraud — that we'll block it. And that signature, right now, for us, is: 1. sends traffic from a colo, VPN, or Tor exit-node IP address; 2. uses an email address where the domain is either: 2a. from a "temporary inbox service"; 2b. from one of a few common mail services which do not themselves speed-limit registrations (Microsoft / outlook.com is bad for this; Rambler.ru is another. Perhaps surprisingly to any cypherpunks in the audience, ProtonMail isn't in this set — so they're fingerprinting you somehow to enable that!): 2c. freshly-created (<2d old); 2d. has an MX record whose zone's NS record indicates that their MTA is hosted on a cheap colo (you'd think this would generate false positives, but it's very unlikely on the modern web, as an MTA on such a box would have too low a reputation to send mail, so nobody would bother unless the MTA is only for receiving, i.e. is a one-off temporary email proxy-host); 3. uses an email address where the username is either: 3a. "gibberish" — indistinguishable from keyboard-mashing (see https://pypi.org/project/gibberish-detector/); https://pypi.org/project/gibberish-detector/); 3b. generated by combining census-data-list names with 4+-digit number suffixes, with the former to make the address look real, and the latter to ensure a low change of collision at time of address registration; 4. specifies a user name, organization name, and/or API-key label (all free-text fields) as either gibberish, or mail-merged repetitions of the name in the address. (Real people who don't want to fill these out say something petulant here, rather than keyboard-mashing.) 5. matches the browser fingerprint of a previously-detected multiple-incident attack. (We do client-side browser fingerprinting, only for the registration page, to catch people who use e.g. Puppeteer + Zyte Smart Proxy Manager to automate registrations; but who don't realize that the Puppeteer Stealth plugin exists. Which is, surprisingly, a lot of people.) These are all just factors in your registration "credit score"; you have to trigger multiple of them to get denied by our accounts backend. We only start putting IPs into blocklists (thus making it into, in a sense, a single-factor denial) once we've actually seen attacks coming from these IPs. But we do investigate each such attack; and if the offending IPs all came from some "dedicated-bare-metal unmetered-bandwidth machine host" that nobody's ever heard of + exists as its own ASN + has no claim on its website to be policing its customers for abusive behavior (or worse, doesn't even have a website!)... then it's time to block that entire netblock, and every other netblock owned by the ASN, and every other ASN owned by the company. Every time we haven't before, the attacks just come back.