Hacker News Reader

Comment by fouric | Hacker News Reader

If I were a major, anticompetitive ISP, the minute I found out about this tool, I would figure out how to fingerprint it, and then artificially inflate results by giving priority and bonus bandwidth to its tests.

What is this app doing to prevent that? I don't see any mention of any awareness that ISPs have historically gamed speed tests and what countermeasures FCC has taken.

Idea: would it be possible to built an app that measured the speed of connections for other apps by using the platforms' VPN APIs to create a dummy VPN service that just measured bandwidth/latency?

View on HN

I guess the benefit of google’s speed test is that if ISPs try to artificially speed it up, they run a good chance of accidentally increasing the bandwidth of youtube.

I believe Netflix does this with their fast.com speed test

Heh, sure, but that already happens with various bandwidth sites.

I've tried to replicate various bandwidth tests and failed miserably. Then tried a bandwidth test over VPN (to hide it from the ISP) and then got numbers matching my real world tests.

It works the opposite way as well, when Comcast was blackmailing Netflix you'd get terrible bandwidth, unless you used a VPN to hide your traffic.

>It works the opposite way as well, when Comcast was blackmailing Netflix you'd get terrible bandwidth, unless you used a VPN to hide your traffic.

This bit here is the real smoking gun. Without it, the fact that you got worse bandwidth test results when using a VPN is wholly unconvincing—who's to say that it wasn't due to your VPN's own limitations?

I think you might have misread -- it's saying that the bandwidth was awful UNLESS using a VPN, i.e. no VPN was the slower option.

Google has a speed test built in now, which is difficult for ISPs to carve out. Just google for ‘speed test’ and it shows up as a card at the top of the page.

Fingerprinting something like this would be trivial, they've probably already done it. Using the ja3 library [1] you can make pretty good deterministic TLS connection fingerprints, and that works fine for traffic that you can't decrypt. IDS/IPS software has used similar methods to identify and block encrypted traffic for some time now.

[1] https://github.com/salesforce/ja3

Likely the ISPs that are doing the worst job are limited on the edge, not centrally. Much harder to game the numbers when the connection to a house is awful.

> If I were a major, anticompetitive ISP, the minute I found out about this tool, I would figure out how to fingerprint it, and then artificially inflate results by giving priority and bonus bandwidth to its tests.

AKA the Volkswagen strategy.

Reply on news.ycombinator.com