Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Live proxy and VPN detection

proxy.incolumitas.com

Post reply on HN
Print view View original

61–70 of 76 posts

Re: Live proxy and VPN detection

#61

Post by lxgr »

Nextgrid wrote: post #50
gruez wrote: post #15

Earlier quoted context omitted.

>Please don't. Not just because of the false positives and false negatives, but because user privacy is actually a good thing. Like it or not, bad actors use VPNs as well, and for some businesses the adverse selection caused by VPNs basically makes banning VPNs a no-brainer (eg. due to fraud).

Do we still not have a foolproof fraud solution? Why not just force 3D-Secure (offloads liability to the bank) or ask additional questions/verification if needed? It seems like the problem isn't payment fraud or nefarious activity but "fraud" in the form of people not sharing as much personal data as spyware operators would like.

> Why not just force 3D-Secure

And guess what the bank will most likely be doing to mitigate that liability shift. It's heuristics all the way down.

Re: Live proxy and VPN detection

#63

Post by grepfru_it »

bdd8f1df777b wrote: post #52
grepfru_it wrote: post #21

Earlier quoted context omitted.

If the cost of fraud this stops is more than the lost cost of legitimate users..

But what if we can better methods that have lower cost of legitimate users?

We are not discussing that here? Obv your business should maximize profit and as such your comment falls into that function

Re: Live proxy and VPN detection

#65

Post by patrakov »

ivancho wrote: post #44
patrakov wrote: post #29

Earlier quoted context omitted.

No. It works in a very simple way. The visitor's IP address is pinged by the server running the test. At the same time, the client establishes a websocket connection to the server, exchanges a few messages, and latency is measured this way, too. The detector exploits the fact that most for-privacy VPNs have a NAT, and therefore the TCP/IP ping test would measure the latency to the VPN server, while the websocket test…

The false positive rate is going to be insane. You mentioned roaming, but there are so many other scenarios where this could trigger - so, the user sits down at a starbucks and suddenly can't access the client's webpage, with some very confusing error about VPNs. Guess what, they are not going to fix their network, they are going to give up on going to that website. Without a plan how to measure/fix false positives,…

I don't see how Starbucks is going to trigger this. The NAT device is physically in the same building as the laptop, so the segment between the laptop and then NAT (which is what results in the difference in TCP/IP ping vs websocket ping) would be very short and undetectable.

Re: Live proxy and VPN detection

#66

Post by Nextgrid »

lxgr wrote: post #61
Nextgrid wrote: post #50

Earlier quoted context omitted.

Do we still not have a foolproof fraud solution? Why not just force 3D-Secure (offloads liability to the bank) or ask additional questions/verification if needed? It seems like the problem isn't payment fraud or nefarious activity but "fraud" in the form of people not sharing as much personal data as spyware operators would like.

> Why not just force 3D-Secure And guess what the bank will most likely be doing to mitigate that liability shift. It's heuristics all the way down.

True, but at least as a merchant you’re no longer discriminating and being neutral instead. Also, the bank may have access to stronger identifiers and completely ignore your VPN usage.

Re: Live proxy and VPN detection

#67

Post by beeboobaa »

grepfru_it wrote: post #21
yjftsjthsd-h wrote: post #16

Earlier quoted context omitted.

Ethically: Bad actors use a lot of things; that's a poor excuse for harming the innocent. Practically: The economics probably check out, but bear in mind that it's not one-sided; this will cost you legitimate users.

If the cost of fraud this stops is more than the lost cost of legitimate users..

Enacting slavery is a great way to reduce costs and optimize productivity. Good idea?

Re: Live proxy and VPN detection

#68

Post by patrakov »

lxgr wrote: post #60

The timezone test is an interesting one I hadn't really considered until now. It was the only one that detected me as traveling internationally when using my home router's VPN. Interestingly, Google One VPN is also not detected. I suspect that's due to Google intentionally sharing that IP range with Google Fi.

[dead]

Re: Live proxy and VPN detection

#69

Post by threecheese »

elwebmaster wrote: post #19

OP, I am sure you have the best intentions in mind but I hope you can see for the comments that what you are trying to do is a bad idea. You will never get it perfect, you will lose a ton of business for no reason (for example: because the customer was an Apple user, guess what: most paying customers are) and you will gain a false sense of security that you are preventing malicious traffic. Just focus on bot detectio…

On the Apple User subject: I am flagged as a proxy and maybe a VPN simply for using Apple’s Private Relay feature. I’d imagine this knocks out a huge chunk of mobile users.

Re: Live proxy and VPN detection

#70

Post by reincoder »

SushiHippie wrote: post #11

Mullvad VPN location set to Frankfurt germany Using the us east test server: Proxy Score: 10/100 - Very likely not a Proxy VPN Score: 0/55 - Very likely not a VPN Using german test server: Proxy Score: 10/100 - Very likely not a Proxy VPN Score: 30/55 - Very likely a VPN The thing that changed between both tests was the flow latencies vs ping latencies check. Clicking on more info it said: "flow variance too large in…

I work for IPinfo and I am glad to see privacy detection working. Internally, one thing we sometimes discuss is whether we should use "scores" when it comes to IPs.

Personally, I think there is a market for indicating whether an IP is good or bad and giving it a reputation score. However, as a company, we prefer not to do that and there is a good reason for it. There are two core caveats:

1. Ambiguity: Scores can often be ambiguous when determining whether an IP is an "anonymous IP". Having a boolean response for VPN, proxy, or Tor is a simpler solution and we prefer simplicity.

2. Accuracy: We prioritize accuracy and strive for complete coverage. Some "ip reputation" providers essentially just repackage threat feeds. We want to avoid getting involved for now.

Our policy is to be reliable and allow our customers to sell IP reputation and cybersecurity solutions using our data. If they wish to create reputation scores using our data, they are more than welcome to do so.

Post reply on HN