Hacker News Reader

Comment by msravi | Hacker News Reader

How are they going to do this? I mean, anyone could spin up a machine located in the US within a few minutes - how would they know?

View on HN

Netflix doesn't need to block 100% of proxies - they just need blocking that's good enough that people licensing content to them won't sue or withdraw their content.

Figuring out the IP addresses used by free and commercial proxies shouldn't be too hard - they just need to create some test accounts, sign up for the proxy services, then check what IP addresses their test accounts appeared to connect from. That'll block anyone who isn't technical enough to set up their own server.

If they're feeling enthusiastic enough, they could go further - for example blocking IP ranges used by big hosting providers and seedbox providers; and monitor the main forums and subreddits to learn about any new bypasses they need to clamp down on.

Netflix has its own content is increasingly behaving like a member of the MPAA. (Pushing DRM, blocking proxies, etc.)

I can see someone open sourcing their proxy software which anyone can run on a cloud provider or even spin up on demand.

What do you think is running the existing proxy services?

There are many open source proxy tools that can do the job fine, not to mention the even simpler openssh or OpenVPN.

That already exists. You could spin up a VPS on any provider and install OpenVPN. If you're technical enough to spin up a VPS then you can get this up and running in 5 minutes.

https://hub.docker.com/r/kylemanna/openvpn/

Knock yourself out :)

What I want (and would pay for) in a proxy service is one that would use a different address each time, preferably from "normal" ip ranges for subscribers in that country.

Hola Unblocker already does that (for free). It's P2P though, so you should consider running that in a VM/under a separate account.

They don't need to know. They can show you the content that corresponds to the country matching your billing information, regardless of your IP address. It doesn't say they're going to block proxies, only that you won't be able to use proxies to watch content not available in your country.

I don't believe the content distribution rights operate that way. I think what you can see depends on where you are physically located. Not where you are from.

The iTunes store currently works based on your billing information.

Spotify is also based on billing address

They could just only play video when the IP address location and billing country match. You wouldn't catch every proxy user, but it would prevent the widespread usage.

Are accounts transferrable? What if if I travel to the US and use my account there? Would I still be discriminated against, on the basis of my billing country?

That would be better; then I could just get a US netflix account using US billing information (easy to get) and then watch all the US content I want.

How will you literally pay? That's the hard part.

I've done what you're describing here, entering a made up address is easy, it is getting payment to them without triggering fraud systems that is hard.

Many years ago US iTunes added PayPal but didn't verify that the address on the PayPal account was the same as the address on the iTunes account, so you could pay using your local billing address, but have payment go to a US iTunes fictional address. They have unfortunately closed that loophole.

Some fraud systems (like the ones at Hulu) work by verifying the Zip Code. There are algorithms for transforming foreign postal codes into an American zip code. These algorithms were designed to be used at places like gas stations in the States which often ask you to enter your zip code for verification. So to subscribe to Hulu, I transformed my postal code into a zip code, looked up an address at that zip code and used that as my billing address with my Canadian credit card.

> So to subscribe to Hulu, I transformed my postal code into a zip code, looked up an address at that zip code and used that as my billing address with my Canadian credit card.

I literally don't know what you're talking about with "transferring zip codes." But I was talking about your financial institution blocking the payment, not Hulu/NetFlix/whatever.

They should reject the transaction as soon as it comes in.

For example, the "zip code" for a Canadian Postal Code of K8Q 5T6 is 856XX, where the last two digits can be anything. So make a valid address for zip 85601, enter it into Hulu as the address for your Canadian credit card, and both Hulu and the bank will accept it as valid. (Or at least some banks will, the first card I tried didn't work. The second one did).

The first six digits of your credit card identify the issuing country, which is what sites that care about blocking foreign customers use.

You can look one up here: https://www.bindb.com/bin-database.html

Or see a list here: https://web.archive.org/web/20130827121726/http://en.wikiped...

On an unrelated note, do you know why that page was removed from wikipedia?

In this exact case, I would pay someone I know in the US and have them open the account for me.

This would not work either legally or technically, afaik (IANAL though). You don't get a copyright pass going into another country to use content you could at home, the restrictions are on distribution to you wherever you are.

But even if that weren't true, technically it wouldn't work because people would just share their accounts with people across the border, leading to a different form of the same outcome.

The only way this would work is if you were forbidden from using your netflix account outside your home country. This would piss off a lot of travellers (like me) who consider it literally a feature that their netflix account works in other countries, and are currently using the service in a legitimate way (as we see the local content wherever we are).

If only that's how it worked, I'd be very happy. I'm a US resident and all my billing info is in the US, but I travel frequently.

It's infuriating that I can't continue watching a TV show or movie just because I happened to cross a national border. For now, I use a proxy to always have access to US content, but if Netflix starts blocking that I'm going to cancel my account.

Maxmind offers Proxy Detection based on IPs; presumably they have the entire AWS/Google/Azure netblocks listed in there.

https://www.maxmind.com/en/proxy-detection-service

Still not impossible, just a bit harder when that $5 DO droplet is no longer good enough to proxy Netflix through.

Argh. I have just that, a $5 DO droplet located in New York (I live in Sweden) that runs a Squid3 web proxy. I use this for Squid3 to not be detected as a proxy:

  via off
  forwarded_for off

  request_header_access Allow allow all
  request_header_access Authorization allow all
  request_header_access WWW-Authenticate allow all
  request_header_access Proxy-Authorization allow all
  request_header_access Proxy-Authenticate allow all
  request_header_access Cache-Control allow all
  request_header_access Content-Encoding allow all
  request_header_access Content-Length allow all
  request_header_access Content-Type allow all
  request_header_access Date allow all
  request_header_access Expires allow all
  request_header_access Host allow all
  request_header_access If-Modified-Since allow all
  request_header_access Last-Modified allow all
  request_header_access Location allow all
  request_header_access Pragma allow all
  request_header_access Accept allow all
  request_header_access Accept-Charset allow all
  request_header_access Accept-Encoding allow all
  request_header_access Accept-Language allow all
  request_header_access Content-Language allow all
  request_header_access Mime-Version allow all
  request_header_access Retry-After allow all
  request_header_access Title allow all
  request_header_access Connection allow all
  request_header_access Proxy-Connection allow all
  request_header_access User-Agent allow all
  request_header_access Cookie allow all
  request_header_access All deny all

If the entire DO netblock is in the proxy block list, then your headers aren't going to do much.

They'll block known VPN/Proxy endpoints I guess. I bet spinning up your own proxy/VPN will still work. Although they might block entire networks like EC2 and DigitalOcean too.

Exactly. Blocking down known VPN/Proxy endpoints gets them 99% mileage with minimal effort. I don't think they are looking for 100% coverage here.

Honestly, I doubt they even really care. This is probably just to keep from getting screwed over in some licensing deal. "Look, we really tried hard to stop this, I guess those internet-guys are just too good at getting around the system. Oh well."

The far easier method is with DNS services, I wonder if it will affect those too or this is just an official announcement and they will not do anything drastic.

Well those work by resolving some domains (like netflix.com) to their own tunnel endpoints, which then tunnel to a different country. They can then just block the endpoints' IPs. It's actually not that hard to set up, I did it a couple of years ago to tunnel youtube (which is pretty crippled for music in Germany) and some other services not available outside of the US to a server in the US. The DNS server was in Germany to keep latency low.

Yes I see what you mean, they have their own servers to proxy but then are able to hand off the actual video traffic. So presumably Netflix knows which are the Getflix and other service tunnel endpoints. I wonder if it will escalate with Getflix and other providers attempting to bypass such blocks.

If they are serious, they could tie your account to your country, so when you are in "another country", either virtually or physically, you could only watch things available in both you account's country and your access country.

... and for $40/mo + $5/hour you can watch any movie while traveling with Netflix's special roaming plan!

"How are they going to do this? I mean, anyone could spin up a machine located in the US within a few minutes - how would they know?"

They can't. They can identify commercial proxy providers and the IP blocks they utilize and block them. Maybe they can auto-identify subnets based on their ARIN registration text ... it's still just a wack-a-mole process.

If you own your own IP space in the US that you use for your own purposes, it will presumably work forever.

Or, put another way, if you are truly a peer on the Internet, you can continue to do the things it was meant for. If not, you're just a media consumer.

Reuters may be botching up terminology. Perhaps Netflix closing the door on regional workarounds using DNS redirects. Failing that, Netflix may block service to IP subsets owned by popular Proxy services only. If you set up a proxy using your own machine or a smaller service, it may still work.

Do whois on ip address, there are addresses that belong to data centers, so between that an manually compiling a list of netmasks belonging to various proxy providers you can get something going. Not without failure I guess.

Probably by blocking only most known Ips from most known proxies/vpn first. I think if you're tunnelling from your own server, you'll be fine.

More importantly, how are they to know what country lies on the other end of the tunnel, so that they could determine what is not available locally there?

I think this is a bit of hand-waving to placate certain rights holders. If subscribers who VPN from the U.S. to the U.S.--perhaps for privacy purposes--are affected, and they make enough noise, Netflix will likely back off to "well, at least we tried" intensity.

They don't need to, one of the VPNs i use has been already blocked, I can see the content list just the same, but it just won't play

If they are not providing you with the service that you have paid them to provide, you should contact customer service and request that the problem be fixed, and that you be refunded for the duration of the failure.

IP addresses do not have a fixed physical location or a fixed purpose. They are packet routing instructions, period.

Digitalocean + openVPN = $5/month Netflix proxy. If they discover the IP address, shut it down and spin up another VM.

If I was a tech at Netflix tasked with blocking proxies, the entire set of Digital Ocean IP blocks would rank very high on the list of suspects.

Sites such as Walmart already block my access when using my server at LARGE_VPS_PROVIDER

I'm guessing they are going to use a service that provides a list of proxy ips, and block those. It won't be complete, but it will cover the vast majority.

Someone should build a p2p proxy system specifically for Netflix. It would be pretty hard to block, and the risk for hosts would be low if it was limited to netflix ips only.

This is a legitimate question that many people reading the comments might be wondering. Why is it being downvoted?

Reply on news.ycombinator.com