7 ms·
I hear there's a dirty secret that more and more companies are doing this to make things like Netflix that block VPNs "just work" though their services. Not sur
by ehPReth 4y ago
I hear there's a dirty secret that more and more companies are doing this to make things like Netflix that block VPNs "just work" though their services. Not sure how true this is or how widespread, though.
- edgyquant 4y agoThis has been brought up before, Netflix does not work with a VPN on. It knows you’re using a VPN and blocks you (asks you to disable it.) Yes this is true even with NordVPN, which I bought specifically to be able to watch Netflix on when expressVPN didn’t work.
- tenacious_tuna 4y agoThat is an exceptionally broad statement. I think it's probable that Netflix doesn't work with large-scale VPN providers because it's broadly easy to identify the traffic source. However, using a wireguard tunnel from my ipad back to my house, netflix works fine.
- causi 4y agoHe obviously didn't mean to include people who are just tunneling back to their residential IP.
- mynameisvlad 4y agoThere’s many ways Netflix could detect VPN use, especially on mobile devices. It’s not obvious at all. Netflix could be doing something as simple as checking the IPs or could be actually checking the use of VPN at a system level. Both are equally valid readings of the GP comment.
- medo-bear 4y agoseems like torrenting is still easier (and safer) than using netflix and co
- LeeroyWasHere 4y agoI was suspended by Disney+ for accidentally turning on my VPN to a location they didn't like...I instantly cancelled my subscription. I couldn't believe the suspension message, banned a paying user... Never again.
- lxgr 4y agoWhat location was that, out of curiosity, and what was the reason given?
- _joel 4y agoespecially if you're on arm linux, it seems
- babypuncher 4y agoI find this "easier" argument amusing. Any solution that requires me to reach behind my TV and plug in my laptop is already not easy. With Netflix you just punch your password into your smart TV and you're watching content.
- medo-bear 4y agoi can stream torrents from my phone to tv without hassle
- lillecarl 4y agoYou don't have to, I can use my Android TV to stream torrents in a Netflix-like GUI using public torrents. My father uses it and he's not very "techy". It even syncs progress across devices, works on all my devices (doesn't work in the Apple ecosystem).
- 4y ago
- buggeryorkshire 4y agoiirc they also use the TTL of the request to see if it differs from others on the same IP. This was a while ago however.
- lxgr 4y agoWhat about a VPN that tunnels relevant traffic (i.e. usually the one to their backend API and/or DRM key/licensing server, not to their CDN) through residential connections in the same geography as the VPN relay?
- wlesieutre 4y agoIf Netflix can see that your traffic is coming out of an AWS datacenter, then yeah they'll block it. If Nord VPN is really bouncing your traffic out of some other residential customer's connection, that would be a lot harder to detect. And a lot more ethically questionable if the other user doesn't realize they're doing it.
- spookthesunset 4y agoBut if the VPN provider really was routing other customers traffic through your internet… you’d know it. You’d see requests and traffic that you didn’t make going across your router. Since you’d be the endpoint for the other dudes VPN you could probably even see what IPs they are connecting to and get an idea about the nature of their requests. I dunno if SSL encrypts the entire HTTP payload or not but could you even figure out the URL’s being requested using a tool like wireshark?
- lxgr 4y agoFull URLs: Definitely not. Path and query parameters are part of the HTTP payload, i.e. encrypted within HTTPS. Host names: Very likely, unless you're using SNI.
- None4U 4y agoYou mean eSNI, SNI is the field containing the hostname and eSNI stands for "encrypted SNI"
- lxgr 4y agoRight, thanks! I keep thinking the "e" is for "enhanced" encryption, i.e. "eSNI 2.0", but what I'm thinking of is actually called ECH (for "encrypted client hello"): https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/
- wlesieutre 4y agoIf such a feature exists (and I have no idea if it does) I assume they would only route traffic to known streaming services through it. Otherwise you're making random customers into exit nodes for potentially criminal traffic, which could go very badly.
- 4ggr0 4y agoNo? I've used Netflix with NordVPN like 2 years ago and since then switched to ProtonVPN, which works as well... Using VPNs for Streaming is selling point #1 for tons of people.
- r3trohack3r 4y agoIt fully depends on whether the IP address associated with your VPN tunnel has tripped their automated detection systems or managed to land on a public blacklist like Project Honeypot. But they do actively track and block VPN traffic.
- 4ggr0 4y agoAh, that's probably the case, true. Never had it happen to me but that's very anecdotal.
- r3trohack3r 4y agoWhile working at Netflix this was a real bummer. I had whole home VPN configured and I couldn't access NFLX streaming content from the house. Getting Netflix traffic to bypass the VPN is incredibly difficult without hacking the client side code to have it update the bypass rules on-demand in response to the client side JSON payloads - or hook into DNS resolution and do VPN bypassing there based on a regeular expression of the origin and the returned records. The way NFLX works under the hood, from the client's perspective, is that it makes an initial request to a service hosted in AWS. That service stitches together the list-of-lists on the home page. Then you select a film to watch, it again reaches out to a service hosted in AWS to ask to stream the content. This is really straightforward to get working with whole home VPN, you just bypass the VPN for those origins (using DNS queries to get the IP blocks) and you are golden. A little cron job could keep that IP bypass list fresh and it worked well enough to get through the UI. But then the AWS service responds with a list of streams you are licensed to watch and URLs that point to their location. Those URLs point to Netflix's OpenConnect CDN hosts. Nearly every time I went to stream, I'd pull a different origin for the content and that would route back through the VPN. The list wasn't stable, so I couldn't compile a comprehensive list of origins to route around the VPN with. So NFLX blocks VPNs to protect their licenses, which I understand. But their architecture made it impossible for me to allow their service to bypass my VPN. So any device I wanted/needed to use NFLX on had to have a direct connection to the internet.
- netfortius 4y agoNetflix works just fine through VPN - it just limits the offerings. If I disable VPN I additionally get local-to-the-country offerings, on top of the "through VPN" ones.
- jamiek88 4y agoNetflix does however work with a smart dns spoofer.
- bennysonething 4y agoCan you give an example please? I'd like to do this.
- jamiek88 4y agoI use https://www.smartdnsproxy.com/services/netflix/ https://www.smartdnsproxy.com/services/netflix/ Never had an issue, been signed up for years. It’s possible to set up your own solution I believe but I don’t have the time for that currently. Not affiliated or anything and I’d do your own research on them but I much prefer this as they only see that traffic from me.
- bandrami 4y agoI mean, it works just fine; you can watch all Netflix-owned content on NordVPN. You just can't watch any of the stuff they license for local distribution.
- makingstuffs 4y agoNetflix definitely works with NordVPN. My partner and I regularly use it to enable us to stream content which isn’t available in the UK but is elsewhere in the world. Specifically to watch The Walking Dead if I am honest.
- abofh 4y agoNetflix can be a bit sneaky - there's some content that it won't even show you if you're on VPN, even if the source and destination regions can see it; I use a VPN regularly for other streamers, but netflix I sometimes end up having to turn off my VPN to even find particular shows.
- bleep_bloop 4y agoUsed NordVPN for 3 or so years and I have been sharing my Nord and Netflix account with several different people on and off over the years, none of us have ever had an issue streaming Netflix. Amazon Prime and some other streaming services, yes, but oddly not Netflix. However my current gf often will get interrupted in the middle of streaming while using ExpressVPN so she just switches over to Nord and issue solved.
- duxup 4y agoI ran into a situation where I left a VPN on my phone on and the Target app (US store Target) would pop up an alert "true". I assume someone was detecting if you were using a VPN and testing and it somehow made it into production. I emailed them and never heard back. Granted ... I get why a retailer with financial activity going on might want to know if a VPN was used to possibly apply extra scrutiny to the purchase.
- spookthesunset 4y agoOr used by competitors to see if the prices change depending on network location. I used to work for a company that explicitly changed the prices on the site if the request traffic came from a competitor IP address. Of course this was a hundred years ago in a land far away. I don’t know how much success you’d have even finding your competitors IP’s these days.
- wyldberry 4y agoTarget now also has a world class incident response and forensics team setup after their big breach and being nearly every security vendors topic du jour for years. It's entirely reasonable they do this to add to malicious detection signal, or fraud.
- bennysonething 4y agoThat is terrifying! So someone could access illegal content through my home internet connection (while I have a VPN running)?
- lxgr 4y agoYep! "Exit node" users and VPN customers don't need to be in the same set, though: It's entirely possible that the VPN operator buys residential IP forwarding volume and includes access to it as part of their product offering. That doesn't make things much better for unwitting users sharing their internet connectivity with insufficient or no education, though...