Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

> This website can detect if your connection is using a Proxy or VPN.

Empirically not.

> You can add Proxy and VPN detection to your own Website or App.

Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing.

View on HN

“Everyone who doesn’t use their SSN as their account name is literally STEALING from me because I can’t sell that information I’m entitled to for profit! If I can’t sue them for their theft then they should at least be banned from the internet!”

“I make my users have an account to view my content I automatically scrape from paid sites by scanning for changes 10 times per second. I have unfiltered ads in every unused pixel to optimize efficiency. I also like the ads that look real because they get more clicks and pay more. But my users are using Adblock! They’re literally STEALING from me! When I added a paid content as a service plan to combat this theft, my daily active users dropped by 99%! That must be because they were all fraudulent bot accounts just racking up my bandwidth costs! And the others now just don’t want to pay me for my work! Literally STEALING!”

>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing.

Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).

Ethically: Bad actors use a lot of things; that's a poor excuse for harming the innocent.

Practically: The economics probably check out, but bear in mind that it's not one-sided; this will cost you legitimate users.

If the cost of fraud this stops is more than the lost cost of legitimate users..

I don't seem this impacting fraud in any meaningful way. The cost advantage would be in reducing bandwidth consumed by bots.

By that logic all kinds of authoritarian measures can be viewed as fair. For example abolishing anonymous payments such as cash. TOR nodes should also be blocked, like in China.

Death by a thousand anti-fraud cuts. In the end it's a perfect dystopia.

But what if we can better methods that have lower cost of legitimate users?

We are not discussing that here? Obv your business should maximize profit and as such your comment falls into that function

Enacting slavery is a great way to reduce costs and optimize productivity. Good idea?

I believe that would be illegal, sir

> Ethically: Bad actors use a lot of things; that's a poor excuse for harming the innocent.

Should I be able to walk around stores wearing balaclavas? Sure, robbers wear balaclavas, but innocent people do too.

The way facial recognition's going, there's a case for it tbh. Or at least the standard hoodie-up-head-down-baseball-cap uniform of today's teenager.

Oh, that gives me a good idea for a new website/slogan: bad actors use Toothpaste; lets ban Toothpaste!

I tried to pay for street parking a few days ago in Miami but the app wouldn't work at all. It turns out that ParkMobile just refuses to operate if your device is using a vpn and won't tell you the reason.

It makes sense to filter out bad actors, but relying on vpn usage as the only signal for untrustworthiness is unwise.

Like it or not bad actors also do not use VPNs, so best to block the internet entirely from your site - There are so many bad actors it will probably be worth blocking the handful of legitimate users don't worry ;)

The optimal amount of fraud is non-zero.

Also in an age of CGNAT, state enforced ISP level tracking and blocking. Blocking at the IP level is just lazy. It's like blocking a person because they come from the same town as someone else.

All the big corps I ever worked for had their devices configured to go through the central VPN and proxy even for browsing.

But I guess blocking $$$ corporate visitors should be fine by you as well.

It is extremely easy to differentiate between the two with a commercial VPN detection product rather than just someone's hobby proof of concept.

The problem with VPNs is the exit node and not the act of using a VPN in itself. You will also be fine if you VPN to a clean IP, which is why corporate VPNs aren't generally affected. The problem is that for better or worse, public VPN exit nodes have a history of abusive activity and are blocked as a result.

Bad actors use windows computers. We should ban all windows users from the internet. And android. I don’t want these poor people racking up my bandwidth costs when they’re not profitable data cows I can exploit or at least compel to buy something.

If you read my previous comment carefully, you'll notice claim isn't "sites ban VPNs because baddies use it", it's "it's sites ban VPNs because enough baddies use it compared to normal users that it outweighs the downsides of banning them wholesale".

That's a bit heavy-handed. Can't we just get people to attach their salaries to HTTP requests? X-Milk-Me maybe. Much more fine-grained.

Do we still not have a foolproof fraud solution? Why not just force 3D-Secure (offloads liability to the bank) or ask additional questions/verification if needed?

It seems like the problem isn't payment fraud or nefarious activity but "fraud" in the form of people not sharing as much personal data as spyware operators would like.

> Why not just force 3D-Secure

And guess what the bank will most likely be doing to mitigate that liability shift. It's heuristics all the way down.

True, but at least as a merchant you’re no longer discriminating and being neutral instead. Also, the bank may have access to stronger identifiers and completely ignore your VPN usage.

Reply on news.ycombinator.com