>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing. Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).
All the big corps I ever worked for had their devices configured to go through the central VPN and proxy even for browsing. But I guess blocking $$$ corporate visitors should be fine by you as well.
It is extremely easy to differentiate between the two with a commercial VPN detection product rather than just someone's hobby proof of concept.
saying things like "failed to detect mine!" allows them to go through their logs and see what they missed. This entire post is potentially a great honeypot.
I see that they already have the TCP MSS info but not sure it's part of the score, low MSS is a pretty obvious indicator. (Without VPN 1452, with Wireguard 1240)
ok but how is all this implemented? is it a machine learning algorithm that classifies latencies with some pre-trained model? or did the library creator set some manual threshold like latency < 200ms = no VPN else VPN?
No. It works in a very simple way. The visitor's IP address is pinged by the server running the test. At the same time, the client establishes a websocket connection to the server, exchanges a few messages, and latency is measured this way, too. The detector exploits the fact that most for-privacy VPNs have a NAT, and therefore the TCP/IP ping test would measure the latency to the VPN server, while the websocket test…
The false positive rate is going to be insane. You mentioned roaming, but there are so many other scenarios where this could trigger - so, the user sits down at a starbucks and suddenly can't access the client's webpage, with some very confusing error about VPNs. Guess what, they are not going to fix their network, they are going to give up on going to that website. Without a plan how to measure/fix false positives, there's no way this would last more than a week in a real e-commerce environment, unless there's already a dramatic problem with VPNs (like at Etsy).
Another horrible idea akin to anti adblock detection. VPNs are there for a reason and historically originate from corporate LANs needing to extend to executives' company devices. They're now mainstream and many millions of corporate devices will have all egress traffic routed through corp data centres that are by definition VPN endpoints, or cloud solutions like Palo Alto GlobalProtect. Have extreme caution using something like this.
Ethically: Bad actors use a lot of things; that's a poor excuse for harming the innocent. Practically: The economics probably check out, but bear in mind that it's not one-sided; this will cost you legitimate users.
If the cost of fraud this stops is more than the lost cost of legitimate users..
By that logic all kinds of authoritarian measures can be viewed as fair. For example abolishing anonymous payments such as cash. TOR nodes should also be blocked, like in China.
Death by a thousand anti-fraud cuts. In the end it's a perfect dystopia.
> This website can detect if your connection is using a Proxy or VPN. Empirically not. > You can add Proxy and VPN detection to your own Website or App. Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing.
“Everyone who doesn’t use their SSN as their account name is literally STEALING from me because I can’t sell that information I’m entitled to for profit! If I can’t sue them for their theft then they should at least be banned from the internet!”
“I make my users have an account to view my content I automatically scrape from paid sites by scanning for changes 10 times per second. I have unfiltered ads in every unused pixel to optimize efficiency. I also like the ads that look real because they get more clicks and pay more. But my users are using Adblock! They’re literally STEALING from me! When I added a paid content as a service plan to combat this theft, my daily active users dropped by 99%! That must be because they were all fraudulent bot accounts just racking up my bandwidth costs! And the others now just don’t want to pay me for my work! Literally STEALING!”
> This website can detect if your connection is using a Proxy or VPN. Empirically not. > You can add Proxy and VPN detection to your own Website or App. Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing.
>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing. Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).
Bad actors use windows computers. We should ban all windows users from the internet. And android. I don’t want these poor people racking up my bandwidth costs when they’re not profitable data cows I can exploit or at least compel to buy something.
>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing. Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).
All the big corps I ever worked for had their devices configured to go through the central VPN and proxy even for browsing. But I guess blocking $$$ corporate visitors should be fine by you as well.
The problem with VPNs is the exit node and not the act of using a VPN in itself. You will also be fine if you VPN to a clean IP, which is why corporate VPNs aren't generally affected. The problem is that for better or worse, public VPN exit nodes have a history of abusive activity and are blocked as a result.
> This website can detect if your connection is using a Proxy or VPN. Empirically not. > You can add Proxy and VPN detection to your own Website or App. Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing.
>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing. Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).
Do we still not have a foolproof fraud solution? Why not just force 3D-Secure (offloads liability to the bank) or ask additional questions/verification if needed?
It seems like the problem isn't payment fraud or nefarious activity but "fraud" in the form of people not sharing as much personal data as spyware operators would like.