Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mastercard and Visa Start Banning VPN Providers

torrentfreak.com

Post reply on HN
Print view View original

91–100 of 113 posts

Re: Mastercard and Visa Start Banning VPN Providers

#91

Post by xkidug »

fingerprinter wrote: post #58
dangrossman wrote: post #6

Keep in mind that this is about chargeback risk, not implementing some secret government policy. "Anonymizing VPNs" are a high risk service -- the people signing up for them are more often "bad guys" than tech professionals looking for privacy -- and they're signing up with stolen payment information. There are far more hackers, crackers, carders, "script kiddies", spammers and other people that need to hide their lo…

> Keep in mind that this is about chargeback risk, First, I do not think this is about chargebacks, at all. I don't know what it is about, but it's not chargebacks. This looks like a blanket revocation of anonymizing/VPN services. That isn't how fraud/risk engines work (note: I wrote several fraud/risk engines for ecommerce/banking/travel industry as well as passive device fingerprinting). Sure, make this a riskier t…

> First, I do not think this is about chargebacks, at all.

This case may also have other motives (the pirate bay related?) but chargeback is the issue and the story is more complex than it sounds: http://www.securitykiss.com/resources/roboblog/credit_cards/

Re: Mastercard and Visa Start Banning VPN Providers

#92

Post by jasonlotito »

weavejester wrote: post #89
_mulder_ wrote: post #87

Earlier quoted context omitted.

Well I imagine it might go something like this: Bad guy gets CC details Uses stolen CC to sign up to VPN Goes on a shopping spree via the VPN so law enforcement can't trace him So you're going to see more use of VPNs by fraudsters trying to hide than you are genuine users... hence the ban.

I agree that some users use VPNs for credit card fraud. What I find hard to believe is that the majority of VPN users are committing credit card fraud. If nothing else, it would be difficult for VPNs to make a profit if they had that many chargebacks.

> What I find hard to believe is that the majority of VPN users are committing credit card fraud.

The problem isn't the majority. The problem is just a significant amount. Keep in mind how low the chargeback rates need to be to avoid serious penalties. Also, keep in mind the number of people isn't the issue, but it's the number of fraudulent transactions that occur. One person can attempt many.

It's an attack vector, and one person can cause problem for many, many customers.

Re: Mastercard and Visa Start Banning VPN Providers

#93

Post by furyg3 »

dangrossman wrote: post #6

Keep in mind that this is about chargeback risk, not implementing some secret government policy. "Anonymizing VPNs" are a high risk service -- the people signing up for them are more often "bad guys" than tech professionals looking for privacy -- and they're signing up with stolen payment information. There are far more hackers, crackers, carders, "script kiddies", spammers and other people that need to hide their lo…

While I don't doubt that there are bad guys who are paying for anonymizing VPNs, I wonder to what extent this is a majority.

I know around ten people, who are technically-adept (but not techies), who are using VPNs for Netflix, BBC iPlayer, Hulu, sporting events, etc... In many cases they are "paying to pay" for these services.

Hackers, crackers, carders, and script kiddies can pretty easily get access by compromising insecure hosting accounts or remote windows machines in the desired location.

Re: Mastercard and Visa Start Banning VPN Providers

#94

Post by Amadou »

nknighthb wrote: post #82
Amadou wrote: post #80

Earlier quoted context omitted.

NFC isn't even close to completion, who knows when, if it ever will, get there. What you are missing is the massive infrastructure investment in retail terminals. There are millions of these things out there and they just work. The cost-benefit ratio of a scheme like yours just falls apart in the face of all that inertia.

> NFC isn't even close to completion And yet it is progressing. See Europe. This despite lackluster support from big banks. > What you are missing is the massive infrastructure investment in retail terminals. No, I'm not. Not at all. I'm well aware of it. I'm also well aware that they get replaced quite frequently. And virtually every retail terminal I've seen in the last few years is new enough that if the banks had…

> I'm also well aware that they get replaced quite frequently.

You and I have a significant difference of opinion then.

Re: Mastercard and Visa Start Banning VPN Providers

#95

Post by Karunamon »

nateabele wrote: post #12
cortesoft wrote: post #7

Earlier quoted context omitted.

This is why the key is to make these types of services ubiquitous..... if everyone is using them for everything, then it becomes more difficult to infer anything from their use.

You can't infer anything from VPN use, and it's one of the most ubiquitous communications-security tools already.

You can infer a great deal with VPN usage combined with other things, this is what risk assessment is all about.

Re: Mastercard and Visa Start Banning VPN Providers

#96

Post by lnanek2 »

belorn wrote: post #77

VPN's are unique in providing translation from a dynamic IPv4, to multiple static IPv4. Since most ISP's won't give out enough static IPv4 addresses, if you want to run private servers at home then a VPN is more or less the only way. Dynamic DNS can be used for a singular server, through how reliable depend on the TTL and how accepting other DNS resolvers are in accepting low TTL's (which in practice some aren't). Ho…

Many ISPs forbid running servers on residential connections. So it could even be intentional.

Re: Mastercard and Visa Start Banning VPN Providers

#97

Post by rsync »

ceol wrote: post #60
dangrossman wrote: post #6

Keep in mind that this is about chargeback risk, not implementing some secret government policy. "Anonymizing VPNs" are a high risk service -- the people signing up for them are more often "bad guys" than tech professionals looking for privacy -- and they're signing up with stolen payment information. There are far more hackers, crackers, carders, "script kiddies", spammers and other people that need to hide their lo…

> the people signing up for them are more often "bad guys" than tech professionals looking for privacy Thank you. All we hear about is how the government is trying to silence us and there's some vast payment processor conspiracy trying to stop us from using credit cards, as if they would want to stop us from giving them money. No, HN, the majority of VPN traffic is not innocent nerds accessing Facebook on a public wi…

Just roll your own VPN(s) with EC2 hosts. I have a feeling amazon will not ever get cut off by the processors.

Re: Mastercard and Visa Start Banning VPN Providers

#98

Post by kbenson »

jasonlotito wrote: post #92
weavejester wrote: post #89

Earlier quoted context omitted.

I agree that some users use VPNs for credit card fraud. What I find hard to believe is that the majority of VPN users are committing credit card fraud. If nothing else, it would be difficult for VPNs to make a profit if they had that many chargebacks.

> What I find hard to believe is that the majority of VPN users are committing credit card fraud. The problem isn't the majority. The problem is just a significant amount. Keep in mind how low the chargeback rates need to be to avoid serious penalties. Also, keep in mind the number of people isn't the issue, but it's the number of fraudulent transactions that occur. One person can attempt many. It's an attack vector,…

Additionally, while a legitimate VPN user most likely will only need one VPN, someone interested in committing fraud may want many. The relevant metric is not the number of users, but the number of accounts.

Re: Mastercard and Visa Start Banning VPN Providers

#99

Post by Ensorceled »

weavejester wrote: post #83
Ensorceled wrote: post #52

Earlier quoted context omitted.

Well you did draw the conclusion that it was a "bold claim" without evidence... The phrase "bold claim" is usually reserved for cases where the claim seems unlikely.

Claiming that VPNs have more people signing up with stolen credit cards than their own credit cards rather unlikely to me. The penalty fees on the resulting chargeback would make it difficult to make a profit, particularly on a service that competes on price in an increasingly crowded marketplace.

Ah, now I see our problem.

As I see it there are three main customer groups for VPNs; people using it to circumvent copyright protections (either location based or outright theft), tech savvy people who want privacy, and bad guys.

The original said more bad guys than tech savvy people, I assumed that excluded copyright circumventors (the largest group) and you assumed they were included.

Post reply on HN