Thread

Court agrees with EFF: Utah's VPN law demands a technical impossibility

802 points · 405 comments · hn_acker

SoftTalker · 1790960547 · focus · HN ↗
> platforms are left with an impossible choice: completely block all VPN traffic nationwide or withdraw access from Utah entirely
Is it even possible to reliably know that a connection is from a VPN? Anyone can proxy through a random hosting provider.
1. not_a_bot_4sho · 1790961532 · focus · HN ↗
  Kinda.
  I use VPN most of the time. My work requires it, and I like Mozilla VPN for personal privacy. (Note: it has ad blocking DNS built in which is nice!)
  I occasionally get blocked by websites or services, especially streaming apps, if I'm on VPN. I suspect they're just looking out for Amazon/Microsoft/etc IP address blocks. It's very annoying
  1. alnwlsn · 1790961993 · focus · HN ↗
    My home internet is on a CGNAT, so I experience a lot of the same. Ironically, sometimes a VPN will get through.
  2. manquer · 1790963312 · focus · HN ↗
    Mozilla VPN runs on Mullvad who are transparent and publish active server and IP lists <a href="https://mullvad.net/en/servers.so" rel="nofollow">https://mullvad.net/en/servers.so trivial to block them without blocking all of Azure/GCP/AWS[1]
    There are also third party providers of IP annotations to classify known VPN address ranges that content providers typically subscribe to blanket block providers.
    The reason for this aggressive approach is streaming apps all need your IP as core signal for tagging your region and all content licensing is region locked (even on YT).
    Netflix are/were the most relaxed about it , and for long time would only buy content if they got global distribution rights, but not anymore. Many VPN ads specifically used to market that you can watch Netflix geolocked content.
    [1] IME they block DC IPs too although not needed for blocking professional VPN, even self hosted OpenVPN on cloud box usually gets flagged.
    [deleted] · 1790966268 · focus · HN ↗
    [deleted]
    kevincox · 1790966893 · focus · HN ↗
    That list is the IPs users connect to. It is entirely distinct from the list of IPs the VPN traffic egresses from. I doubt believe that they publish their egress ranges.
    buckle8017 · 1790967523 · focus · HN ↗
    It's almost always in the same /24.
    VanTheBrand · 1790979068 · focus · HN ↗
    Don’t think there was ever a time since Netflix started streaming where they only licensed global rights to shows. For their own originals they get global rights but the majority of their content is licensed and has always been slightly different in different territories.
  3. Aurornis · 1790963869 · focus · HN ↗
    That's not the same. You get blocked because the IP address you're coming from is associated with a VPN list, not because they're analyzing the traffic in detail.
    The simplest methods block known datacenter IP ranges like you thought. More will score it based on several heuristics and a reputation over time. If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.
    a4isms · 1790967633 · focus · HN ↗
    > If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.
    Or, their so-called "smart" TV is acting as a proxy without their informed consent.
    someonebaggy · 1791027800 · focus · HN ↗
    One of the positive side effects of smart TV proxies: IP addresses become useless information.
    medvidek · 1791009995 · focus · HN ↗
    > If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.
    In some parts of the world hiding (NAT) entire neighborhoods behind one public IP is normal practice.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.