Hacker News Reader

Comment by chimeracoder | Hacker News Reader

Within the last month, I've found that I can no longer access my bank's website over my VPN, and Netflix has started blocking access while use a VPN as well.

I can somewhat understand the bank's motivation, but offering two-factor authentication would be a much better way of boosting security than blocking VPN traffic.

As for Netflix, it's totally short-sighted. Netflix is literally unusable from my home connection without a VPN (thanks, Time Warner!). Now that they seem to be consistently blocking my ability to use the service, I'm planning on canceling.

View on HN

In all fairness, that's probably not Netflix' decision, but a requirement of the content publishers and licensing deals.

Concerning the Time Warner issue - I can't say that I ever noticed being the victim of traffic shaping and throttling in similar fashion, but that's just outrageous; How can that be legal?

ISPs typically don't outright throttle Netflix traffic. Instead, they simply neglect to build out capacity to wherever Netflix traffic comes from. I recall one case where it was just a matter of running some more cables between two pieces of equipment in the same cabinet. And of course they'd be happy to build out that capacity if Netflix will foot the enormously inflated bill.

I don't watch Netflix, but I often have extremely poor speeds for YouTube videos at peak times on my FiOS connection. Of course Verizon says it's Google's fault for not paying for infrastructure upgrades, clearly not Verizon's responsibility to ensure I can actually get the 300Mbps they advertise.

For youtube on FiOS specifically, you can change your dns servers away from verizon's and it'll start going a lot faster. I can't find the link right now, but using their dns servers points you to cdn/caching nodes hosted by verizon, which are generally massively over saturated. If you switch to google's public dns or another public dns service (or run your own resolver if you're a masochist like me) you usually end up hitting edge nodes that aren't completely saturated and you get far far better speeds.

Thanks for the hint, next time I see poor performance I'll give that a try.

are you suggesting it is Verizon's responsibility to ensure 300Mbps to every destination on the internet? if not, then why some over others?

I think it's my ISP's job to provide the advertised bandwidth between me and exchange points which offer access on fair, reasonable and nondiscriminatory terms.

My nearest exchange point is probably London Internet Exchange. If an ISP advertises X Mbps, and Netflix can deliver X Mbps of data for me to the exchange point, it's my ISP's job to get that X Mbps of data to me.

No, merely to every destination that can support those speeds. I'm pretty sure YouTube qualifies.

And really, I'd be happy with a mere 10Mbps to YouTube, if for some reason full speed is too hard.

It is Verizon's responsibility to make a reasonable effort to provide that 300 Mbps to the Internet that the customer paid for, especially as content providers are bending over backwards to give Verizon that capacity for free.

Yes, this is exactly what the issue is. (I have worked on these types of deals before).

All of these types of media deals stipulate that the licensee has to implement appropriate technologies (often spelled out on the contract) that support the licensing restrictions of the content (usually something like "commercially reasonable efforts" which gives Netflix some wiggle room over what measure are "reasonable")

Time Warner just needs to stop increasing capacity with whichever peer the Netflix traffic goes through. It's a wonderful way for them to avoid net neutrality under the protection of 'network congestion'.

How is Netflix unusable from your home connection, but not through a VPN? Eg. Either way you need to sustain 2mbit stream.

ISP Packet shaping. They do it even though they say the don't. When you go via VPN they don't know your connecting to Netflix and don't mess with your traffic.

I am one of the network engineers for time warner cable and we don't do any throttling or traffic shaping on customer traffic. We have Netflix boxes colocated but they might possibly get overloaded at certain times because people are using Netflix at an increasing rate. Sorry you aren't having a good experience, if you want to tell me which part of the country you live in I will try and have someone look into it.

Nope. Your ISP just let their handoffs with whatever transit provider Netflix get overloaded which kills throughput. When Netflix pays the ransom to upgrade the links, your videos will stream nice again. Netflix paid ransom to the ISP I use, so my Netflix works well. It has nothing to do with active throttling.

I don't think there is any explicit shaping / throttling happening on US wireline networks these days. There was a huge blowback against Comcast for trying that ~10 years ago, using Sandvine gear to throttle bittorrent traffic at peak times.

There is still plenty of implicit throttling going on though, with broadband providers refusing to provision enough capacity between their networks and the content source networks. The existing links then become congested at peak times and performance is degraded for the customers trying to access that content.

VPNs may improve performance in this situation not because they are hiding or disguising the content, but simply because the traffic is "re-routed" around the congested links. Assuming that the links from content network -> VPN host and VPN host -> end user are not also congested.

This is correct. Sometimes the VPN connection will be bad, and I just change which host I connect to, the traffic is routed a different way and then it works fine.

Wrong, they aren't packet shaping. They have bad peering.

They refuse to add an adequate amount of peering to video services like Netflix and YouTube. The result is oversaturated routing during peak hours.

By using a VPN you change the route taken to the video service, bypassing the oversaturated connections.

Some routes are more congested than others. Routes can be faster even though they use more hops, IPv4/6 can also make a difference.

How can sites tell you are using a VPN?

A list of well-known IPs? The pool is not that large.

couldnt you just provision a server in a random datacenter and create your own for ~5 $ / month?

It will be on the same list, if you are filtering VPN's and other "anonymizers" you usually end up blocking all IP's that are not assigned to commercial/residential ISP's. IP blocks which belong to data center's, cloud providers, VPN providers etc. are quite well known and easily identifiable with a simple lookup.

So you can easily find some no-name VPS provider or get a VPS on AWS/DigitalOcean/Azure/Racksapce but if the site is actively restricting access from VPN's/Proxies it won't help you much in most cases.

Possibly, but I suspect that the address pools for many of the major players (Amazon, Rackspace, DigitalOcean, etc.) are also known and not getting smaller.

There might be options related to IPv6, but since Netflix has been supporting that for streaming since 2012 I suspect those are also covered.

Currently doing that through a big PAAS, we'll see how long it lasts.

What if I connect to your PC using a vpn so it looks like it's just you watching it? I tried connecting to the UK national lottery from abroad via a VPN to my home PC and they could tell.

I doubt they're using this, but it's possible:

https://medium.com/@ValdikSS/detecting-vpn-and-its-configura...

this works well with windows machines, however beyond that it could be really really flaky. especially freebsd/mac/linux are mostly inaccurate. PTR's are set on client machines aswell or in some newer IPv6 based networks you mostly get a PTR aswell. fingerprinting the tcp implementation can't work on network fragmentation and when you drop some packages through a firewall, yes this is mostly not in home networks and most home users won't use linux at all however since netflix and other streaming providers opened for linux aswell, they will actually just allow linux users to use a vpn since they can't detect it safely without false postives like they could on windows.

And MTU differs extremly between US and Europe (Thanks to PPPoE and PPPoA)

PTR is wrong. My Server is a home user and I'm a server?! Also this guy has a better database since he can detect linux 3.11 however on my home network I'm behind a proxy, thats something he didn't detected.

Edit: Oh and on IPv6 only networks with DNS64 and NAT64 you will get really aweful results if you operate on a ipv4 based service (i'm looking at you netflix)

You use MaxMind's IP database which tells you the origin type (residential, commercial, proxy, etc)

ok this is what I was really wondering. So Netflix can tell that you are using a commercial connection to access the service? Can they also tell that you are forwarding in the case of a proxy or something?

That is what I don't get, because if I spin up a digital ocean server in London and put openVPN on it, they can probably tell the IP block belongs to a cloud services company. However, they can't just be running ips against a list right? So what is the work around?

Any given IP is "owned" by an Autonomous System[1], so if you see a user whose IP is from AS14061[2], you know they're coming from DigitalOcean and you can say, "No content for you". They are basically checking your IP against a big list and seeing where you're coming from.

In some cases it is more ambiguous, say the IP belongs to Verizon but it happens to one of the blocks Verizon provisions in the EU or as part of their PPI infrastructure. You only know this because someone has annotated this metadata (eg MaxMind). Or if its a Comcast Business account IP, do you call that commercial and block it? It could be someone at home who forked out for the business class service. This is again where IP-surveillance companies come into play.

In even more ambiguous cases, the IP belongs to AS####A (A hosting company) but is announced by AS####B (A residential ISP), such that traffic from to or from the IPs belonging to AS####A looks for all the world that it is really AS####B's traffic. Do you treat those users a residential because ISP-B is potentially renting that IP space or do you call it commercial?

[1] https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%...

[2] http://bgp.he.net/AS14061

They have a list of ISPs

Why would you need anonymity when accessing your bank account?

It's not about hiding your identity from the bank, it's about obfuscating your traffic from whoever is watching your connection.

Reply on news.ycombinator.com