Hacker News Reader

Comment by RomanPushkin | Hacker News Reader

And the reason why NordVPN IP was blocked is that NordVPN is often used for scam/hack purposes.

This is why when I need to proxy traffic I do it through an AWS instance in whatever region I need. Many services not only don't suspect AWS IPs as malicious, they might even have whitelists on their firewalls for AWS IPs.

I have that same problem with VPNs, all of the big banks lock your account if you use a VPN, and accessing your bank is the one time you would really want to use a VPN.

>>> accessing your bank is the one time you would really want to use a VPN.

what makes you possibly think that?

using a VPN is the equivalent of walking into a bank with a motorcycle helmet or a bataclava, don't be surprised of the unwarm welcome.

I've worked in bank and fintech around fraud. Blocked quite a few VPN/hosting at the network level so they couldn't even reach our network at all.

CitiBank? Is that really you? You may be an undigested bit of beef, a blot of mustard, a crumb of cheese, a fragment of underdone potato. There’s more of gravy than of grave about you, whatever you are!

> accessing your bank is the one time you would really want to use a VPN

Why do you think so? Do you want your ISP to not know who you bank with? Do you not trust TLS? Is your network operator an active, advanced threat actor? What problems would you like to solve with VPN in this case?

Major US carriers are known to use deep packet inspection techniques to change out the advertisements you see on your webpages. If they’re doing that with DPI for purely profit driven reasons, then they are totally untrustworthy when it comes to more criminal activities.

They’re also known to use traffic shaping to websites they don’t like, and which they they should pay them more money to get to your eyeballs. Netflix and YouTube are popular examples here. When I can get much higher throughput to Netflix and YouTube when on VPN versus when I’m not using VPN, something is very wrong.

So, no. I don’t trust my ISP. Not at all. Not as far as I can bodily throw their HQ building.

They also fuck with your VPN connections. Which is why I have accounts with multiple VPN providers.

Sure, there are some reasons for a web proxy. But I asked about the bank case specifically and none of those apply.

I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store.

Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.

Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.

The other thing you can do for that issue is find some more trustworthy ISP somewhere (hopefully not too far away) that allows personal traffic (many do not) and always connect through them. This does not provide anonymity (likely requires ID to sign up) but does provide an encrypted channel through the extra shady ISPs that provide the actual network connection (even worse if you ever use free wifi).

I've been doing this with RamNode for a few years with their $15/year OpenVZ mostly via SOCKS with DNS passthrough (the main disadvantage of this is that it doesn't allow direct DNS resolution and some adblock techniques require being able to do that). This includes a fixed dedicated IP address. Presumably they will eventually support wireguard and then everything should work without fuss (you could setup OpenVPN if you are so inclined and I think would need to if you want to additionally use anonymity providing VPNs on top of that). There are still a few issues with various sites but it sounds like it is quite a bit less annoying than anonymous VPNs, at least once Google and Cloudflare figure out what you are doing. The 500GB bandwidth is per month and generously accounted so I've only once reached it (it would be $4/month for an additional TB). I'd guess there are a number of low priced ISPs that would work. Most software I've used seems to respect ALL_PROXY=socks5h://... these days although not all.

exactly, had a lot of attack attempts from nordvpn/expressvpn, no wonder someone might got ban because of same IP.

Reply on news.ycombinator.com