Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Residential Proxies Are a National Security Threat

jacob.gold

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Residential Proxies Are a National Security Threat

#91

Post by Chu4eeno »

simoneree wrote: post #82
torginus wrote: post #63

My personal opinion is they're not hard to detect at all. Latency is a huge giveaway, If the client can't respond in a time you'd expect a client to be able to based on its geographic location, that's a pretty big tell they're using proxies. In fact, if you did latency sensitive stuff, you'd likely find out whether you wanted to or not.

This is not always the case, although plausible, as residential proxies exit on a real residential IP geographically near the victim/target, so RTT looks normal most times and latency won't reveal them. The actual tells are elsewhere: ASN/IP reputation, TLS (JA3/JA4) fingerprint vs. claimed client, and session-behavior inconsistencies.

But the overall latency will be longer than expected because you add the latency from the proxy connection as well. If you're able to ping back to the connecting IP in combination with some clientside js to help measure total latency I think you should be able to reliably detect proxy users in general?

Re: Residential Proxies Are a National Security Threat

#92

Post by Chu4eeno »

ButlerianJihad wrote: post #87
bsder wrote: post #54

The "solution" is to shoot CGNAT and to finally force the ISPs to adopt IPv6 so everybody can drop the addresses of a detected residential proxy into a ban list. Continuing to allow CGNAT is what allows the residential proxies to hide because it tumbles the IP identity of bad actors with normal people.

Tell us that you don't know how residential proxies work, without telling us that you don't know how residential proxies work.

No, they are correct, residential proxies behind a big ISP's CGNAT is much more valuable for miscreants because you can't block the individual who installed a free android flashlight with a residential proxy SDK embedded.

Re: Residential Proxies Are a National Security Threat

#93

Post by AnthonyMouse »

BLKNSLVR wrote: post #85
AnthonyMouse wrote: post #84

Earlier quoted context omitted.

The reason that works for mail servers is that they first require the IP address to have a valid reverse DNS entry, which is not just compromising a random machine with a random IP address but having administrative control over that IP block, which basically limits you to data centers and business internet providers, and then blocks IP addresses that send spam, i.e. that are owned by providers who give reverse DNS en…

Sounds like a good reason that residential proxies are a bad thing, or at least require better regulation, so as to minimise damage to unwitting end-users. It also feels like a description of the perfect camouflage to facilitate doing bad things: "don't block them because you might block an innocent bystander". Putting innocent bystanders in harms way sounds like someone else is the bad guy, not the person doing the…

> Sounds like a good reason that residential proxies are a bad thing, or at least require better regulation, so as to minimise damage to unwitting end-user

The problem being that attack traffic is disproportionately coming from devices that are compromised, which is already illegal, and you can't fix that by making it harder to use residential proxies for things that are legitimate, like sharing IP addresses between real users so they can't be used as a personal tracking ID.

> It also feels like a description of the perfect camouflage to facilitate doing bad things: "don't block them because you might block an innocent bystander".

Cloudflare promotes putting your site behind Cloudflare to inhibit censorship, because then the censors have to block their entire service (which is half the internet) to block anything. It's not always a bad thing.

> Putting innocent bystanders in harms way sounds like someone else is the bad guy, not the person doing the blocking.

If there is an alleged thief on the subway and you respond by lobbing a grenade into the subway, there is more than one bad guy.

Re: Residential Proxies Are a National Security Threat

#94

Post by 4d4m »

Feels disingenuous to call out proxies when the true issue is a lack of security on the devices running them. Barking at the wrong tree imo. Bad and good actors alike rely on proxies, inclusive of those actors that OP says should be cracking down on these.

Re: Residential Proxies Are a National Security Threat

#95

Post by euroderf »

Terr_ wrote: post #50

If someone with informed consent wants to run a residential proxy, that's their right and unlikely to be a national-security problem. When it comes to involunary proxies, those are really just one of many possible symptoms stemming from a real problem: Shitty security. (Edit: And shitty contract/privacy laws.) Shitty security is tolerated by our markets, is is protected from fixes due to copyright law, and it is even…

Where is my home router that is Lean-validated ?

Re: Residential Proxies Are a National Security Threat

#96

Post by mcfdoesdev »

bharatsuthar wrote: post #56
BLKNSLVR wrote: post #45

From a previous HN discussion, these are known DNS addresses to block in regards to Smart TVs being used a residential proxies: https://news.ycombinator.com/item?id=48422993 Specific Domains: proxyjs.brdtnet.com proxyjs.luminatinet.com proxyjs.bright-sdk.com clientsdk.bright-sdk.com clientsdk.brdtnet.com Wildcard domains: *.brdtnet.com *.luminatinet.com *.luminati.io Source: https://blog.includesecurity.com/2026/06/t…

This is just the largest residential proxy provider BrightData(previously Luminati that used a free VPN to source residential bandwidth) The overall residential proxy market is too large and often undetected by intelligence tools. BrightData is actually much more compliant and malicious actors wouldn't be allowed access. They have an extensive KYC and use-case vetting process.

There are so many residential proxy networks out there that it isn't as simple as just creating a block list.

And as already pointed out... many of the more popular networks actually do have KYC processes in place, in addition to blocking specific targets from being scraped through their network(s).

Re: Residential Proxies Are a National Security Threat

#98

Post by bigbadfeline »

DocTomoe wrote: post #47
userbinator wrote: post #43

No, your paranoia-outage is the true "national security threat" - a threat to freedom. Stop fanning the flames and calling for more government intervention.

After decades of watching people use these three words, I've come to the conclusion that 'national security threat' is a right-wing dog-whistle for 'we have no actual proof, but we dislike it, so let's ban it'. They are basically 'won't someone please think of the children?', but with higher stakes.

> 'national security threat' is a right-wing dog-whistle for 'we have no actual proof, but we dislike it, so let's ban it'.

The abuse of the term "National Security Threat' doesn't mean legitimate threats don't exist. "There are no NSTs" as a left-wing dog whistle would be equally damaging by ignoring legitimate concerns - both approaches lead to the same outcomes, similar to the vast majority of highly popularized left-right wrestling shows.

Hidden, unknown to the public residential proxies are a national security threat, and there's no need to ban them in order to protect from that - just make them public. There would be no problem if I knew the IPs who could act as proxies and block them, that would be a fair game.

Re: Residential Proxies Are a National Security Threat

#99

Post by [deleted] »

rf15 wrote: post #66
DocTomoe wrote: post #47

Earlier quoted context omitted.

After decades of watching people use these three words, I've come to the conclusion that 'national security threat' is a right-wing dog-whistle for 'we have no actual proof, but we dislike it, so let's ban it'. They are basically 'won't someone please think of the children?', but with higher stakes.

it's a general politician dogwhistle, don't underestimate "the left" (especially in countries like the US, where the democrats are really not that left compared to other left parties in e.g. europe; leaving you with a pointless right-wing vs right-wing fight where nobody wins)

[deleted]

Re: Residential Proxies Are a National Security Threat

#100

Post by arbol »

Chu4eeno wrote: post #91
simoneree wrote: post #82

Earlier quoted context omitted.

This is not always the case, although plausible, as residential proxies exit on a real residential IP geographically near the victim/target, so RTT looks normal most times and latency won't reveal them. The actual tells are elsewhere: ASN/IP reputation, TLS (JA3/JA4) fingerprint vs. claimed client, and session-behavior inconsistencies.

But the overall latency will be longer than expected because you add the latency from the proxy connection as well. If you're able to ping back to the connecting IP in combination with some clientside js to help measure total latency I think you should be able to reliably detect proxy users in general?

It's not enough to use latency alone as the other commentor said. You need to look for repeat behaviour at scale. It's ML model time once these basic signals fail you.
Post reply on HN