5 ms·

While I would never use a VPN service fronted by a data thieving company, I really hope that VPN usage goes more mainstream so that companies can't have "no acc

While I would never use a VPN service fronted by a data thieving company, I really hope that VPN usage goes more mainstream so that companies can't have "no access from VPN" as a security strategy. Ally bank recently did this and many others have intermittent issues due to flagging, etc.

hibikir 4y ago
Security teams don't block certain VPN traffic for fun.When a certain IP block has been running credential stuffing attacks all month long, It's very reasonable to see any request from said block with a lot of suspicion. In many cases, 99.9% of login attempts from certain IP blocks are just fraudulent, and there might be more requests from one of said blocks than legitimate requests from the rest of the world combined. Completely blocking a VPN is often too blunt an instrument, but even the best alternatives are unfriendly to legitimate traffic. The most user-friendly thing you can do is to rely on bonus security controls, like asking for two factor authentication for everything. No, you will not be able to log into anything from a new device, even, without the two factor. A very understandable tradeoff for a bank, but we'll end up seeing that for any account protecting anything of relatively low value. If your second factor is tied to, say, a phone, it's not going to be fun to wait to replace it if it's lost. But in a world where most traffic is coming from a VPN, there aren't many good alternatives.
- egberts1 4y ago
  For my home gateway, all HTTPS, VPN, SSTP, SMTP, PPTP, IPSec, UDP, DNS, and proxy are blocked. All JavaScript scripts are blanked by Squid ICAP clients. WireGuard to a VPS for DNS resolver/nameserver. Run a mean transparent Squid proxy, Snort/Zeek/Suricata and whitelist bastion dns forwarder. No problem. No spam. No headache.
VoodooJuJu 4y ago
I can see this evolving into something worse. >try to connect to ally >vpn not allowed - try connecting through on of our authorized vpn partners: microsoft, nordvpn!, etc.
ascar 4y ago
Is Cloudflare known as a data thieving company? I didn't have that association with them yet. They're not really in the data selling business, are they?
- hansel_der 4y ago
  they are in the business of collecting data and selling insights. cdn is just a means to an end
  - scrollaway 4y ago
    Oh stop, already. Cloudflare isn't in the "business of selling insights". They make their money from enterprise sales of their various network products. They're in the business of competing with AWS and are pretty damn good at it, too.
- wintermutestwin 4y ago
  I said "a VPN service fronted by a data thieving company" and I misspoke - I should have said "backed" instead of "fronted." AFAIK Cloudflare isn't a data thief (yet). If (when) they decide to be, they will have access to quite a lot at the rate they are going. At this point, how can we trust that any public company won't eventually monetize user data?

hibikir 4y ago

Security teams don't block certain VPN traffic for fun.When a certain IP block has been running credential stuffing attacks all month long, It's very reasonable to see any request from said block with a lot of suspicion. In many cases, 99.9% of login attempts from certain IP blocks are just fraudulent, and there might be more requests from one of said blocks than legitimate requests from the rest of the world combined. Completely blocking a VPN is often too blunt an instrument, but even the best alternatives are unfriendly to legitimate traffic. The most user-friendly thing you can do is to rely on bonus security controls, like asking for two factor authentication for everything. No, you will not be able to log into anything from a new device, even, without the two factor. A very understandable tradeoff for a bank, but we'll end up seeing that for any account protecting anything of relatively low value. If your second factor is tied to, say, a phone, it's not going to be fun to wait to replace it if it's lost. But in a world where most traffic is coming from a VPN, there aren't many good alternatives.

egberts1 4y ago
For my home gateway, all HTTPS, VPN, SSTP, SMTP, PPTP, IPSec, UDP, DNS, and proxy are blocked. All JavaScript scripts are blanked by Squid ICAP clients. WireGuard to a VPS for DNS resolver/nameserver. Run a mean transparent Squid proxy, Snort/Zeek/Suricata and whitelist bastion dns forwarder. No problem. No spam. No headache.

VoodooJuJu 4y ago

I can see this evolving into something worse. >try to connect to ally >vpn not allowed - try connecting through on of our authorized vpn partners: microsoft, nordvpn!, etc.

ascar 4y ago

Is Cloudflare known as a data thieving company? I didn't have that association with them yet. They're not really in the data selling business, are they?

hansel_der 4y ago
they are in the business of collecting data and selling insights. cdn is just a means to an end
- scrollaway 4y ago
  Oh stop, already. Cloudflare isn't in the "business of selling insights". They make their money from enterprise sales of their various network products. They're in the business of competing with AWS and are pretty damn good at it, too.
wintermutestwin 4y ago
I said "a VPN service fronted by a data thieving company" and I misspoke - I should have said "backed" instead of "fronted." AFAIK Cloudflare isn't a data thief (yet). If (when) they decide to be, they will have access to quite a lot at the rate they are going. At this point, how can we trust that any public company won't eventually monetize user data?