Hacker News Reader

Comment by Crazyontap | Hacker News Reader

My biggest problem with using a VPN is the overtly hostile treatment by Google and Cloudflare.

Everytime I try to browse with a VPN (currently using Windscribe) I just see those nasty captchas everywhere. Google won't even let me do a simple search without letting me tag zebra crossings and school buses. Same with Cloudflare which also adds CAPTCHA before showing me a site which is basically most of the internet now.

Really don't understand why they do this to VPN users. Anyway, Anybody know how to fix this?

View on HN

Unfortunately criminal/fraudulent/unsocial activity also occurs almost elusively behind a VPN, you might not be doing such things, but websites can't tell if you're not one of those people.

Unfortunately criminal/fraudulent/unsocial activity also occurs almost exclusively in certain neighborhoods. You might not be doing such things, but no one can tell if you're not one of those people.

This is one of the reasons why insurance premiums vary by zip code.

I'm not sure what you're trying to add to the conversation. Companies and network providers implement regional and country blocking all the time. My company doesn't do business with anyone in China, so they block IP addresses associated with China. It's not insinuating racism or profiling of the people, but it's well-known that certain areas of the world have bad actors.

If you're trying to somehow set an example of where it's OK in one context and not OK in another, that's really not a fair comparison.

While ZIP correlates with race and other federally protected classes, using a VPN is not an immutable feature.

ZIP isn't an immutable feature either, it's used as a proxy for many features, some immutable.

In the real world, we solve this issue with “protected classes”. Maybe we should have an internet equivalent?

(Inb4: yes, the philosophy and circumstances behind protected classes are different. However, it's relevant prior art.)

This would require identification of rogue "protected" users, to kick them out, thus ruling out using any sort of blind verification and ruining online privacy for those using it. And naturally, it's marginally more convenient while being extremely detrimental to privacy, thus it'll be popular, thus services will eventually block non-"protected" users, thus ruining the internet even more.

No, I mean like “you're not allowed to consider whether a user is behind a VPN when making decisions”.

Ohhhh I see. My mistake!

Cloudflare works with Privacy Pass, a browser extension through which you can solve CAPTCHAs in advance to accumulate tokens that let you bypass CAPTCHAs served by participating services (including Cloudflare, but not Google) as you browse the web. One pre-solved CAPTCHA gives you 30 tokens for ReCAPTCHA or 5 tokens for hCaptcha:

https://privacypass.github.io

I didn't encounter any serious CAPTCHA issues when I tried out Mullvad and Mozilla VPN. Windscribe is probably worse for CAPTCHAs because of its free tier and the lifetime membership that it previously sold for a low price. VPNs that require ongoing paid subscriptions tend to have higher-quality traffic.

Extensions like this make users more fingerprintable so that kind of defeats half the stated purpose of using a commercial VPN. They also weaken the browser's security model, which is part of the reason why Tor users are told to never install addons.

PrivacyPass is not your average extension. It's got a strong basis in applied cryptographic research and was designed to solve the captcha problem in a safe way for tor. It's now later been adopted by both cloudflare and google, so I'm pretty sure it's well vetted.

None of this changes the fact that using it makes users fingerprintable.

What stops people from just botting the captcha tokens? More captcha's?

The Privacy Pass server uses key rotation to make the tokens expire after a certain period of time. The documentation also hints at other measures including rate limiting and using a web application firewall:

https://github.com/privacypass/challenge-bypass-extension/bl...

Gcaptcha hates VPN users, and Firefox users [1, 2]. You can ameliorate this by being logged in in a google account (!). The cynic in me mutters something here about advertising.

Cloudfare, on the other hand, sometimes just decides that the website said "nope" and blocks you. It's such a giant PITA. I spend a lot of time in two countries because of my job and family -- and one restaurant near my home in one of them has decided to block all IPv4 (but not ipv6...) connections to it with cloudfare. I used to look at their menu online, often on the days that I flew back (in the 'before times'). I have to use a VPN to get around that (their food is good!). Cloudfare recently started introducing obnoxious captcha requirements and occasionally outright blocking.

The more people who use VPNs -- and I am sure they are on the rise -- the more it becomes normalised hopefully the more that this goes away. To be honest, it's a price worth paying for privacy at any rate.

[1] https://grumpy.website/post/0RzW4elEN [2] https://news.ycombinator.com/item?id=20147015

It's the website operator who chooses the severity of the Cloudflare interstitial page. I don't recall the default value off the top of my head but I think the captcha page had to be explicitly enabled, and the confidence level could be adjusted by the operator.

The web is still a Wild West in many ways. If stores suffered meatspace equivalents of DDOS, rampant fraud, spam, and harassment they’d also use heavy handed countermeasures.

Because like 90% of the traffic is malicious. VPNs and proxies obviously change your exit IP, and people rotate through these as they do things like spam, make accounts, credential stuff, etc. This means they're burning through the IP ranges and getting them flagged.

If you're on a VPN with a fresh ASN and IP range you won't have any issues (until people start using it for other reasons).

If you wanted to "fix it" the dirty method, there's extensions for chrome/firefox/etc that will automatically submit your captcha to a captcha solving service and it costs some tiny amount.

tldr; Mischievous basically has to go through VPNs, and they rotate through IPs getting them flagged. You can join the dark side with a captcha solving service and extension, and there's some "solutions" like privacy pass you can try.

You're exaggerating. I use mullvad on 3 systems and definitely see captcha here and there but it's not very often. I can't imagine that mozilla's vpn is much different since the backen is the same.

I see those as inconvenient MFA. Can you explain why you consider it hostile?

Despite "renting" my IP address from Linode for over 10 years, occasionally the IP block I'm in ends up on Google's bad side. When I'm using my VPN server, I have to _constantly_ enter captchas to do any search, and often times it's just completely blocked. I'd say it's hostile because they don't just do a captcha and mark you as a a human for the next 24 hours, it can happen with every search. MFA isn't an accurate characterization of what they're doing.

That's very annoying. I guess they don't prioritize your user path; I'm sure they would fix that, if there were 100 million users just like you. Sorry to hear that.

I get locked out of gmail using NordVPN with increasing frequency. I was locked out of my account this week for one night.

Those two are the biggest barriers to privacy so it would make sense.

Reply on news.ycombinator.com