Conversation

Notices

1. Embed this notice
   Em :official_verified: (em0nm4stodon@infosec.exchange)'s status on Monday, 01-Dec-2025 05:44:27 JST Em :official_verified:

   I'm seeing more and more websites are blocking VPNs entirely and I really really don't like it.

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Monday, 01-Dec-2025 05:44:25 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • Dave Mason

     @DaveMasonDotMe @Em0nM4stodon Mostly they just use IP lists, often from a subscription data feed service. There are methods that can identify VPNs on the fly based on network characteristics, but they're rarely used due to the technical complexity of implementation.

   • Embed this notice
     Dave Mason (davemasondotme@mastodon.social)'s status on Monday, 01-Dec-2025 05:44:26 JST Dave Mason

     in reply to

     @Em0nM4stodon

     Dumb question: how does a website block VPNs? Is it nothing more than a game of whack-a-mole with blocked IP addresses?

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Monday, 01-Dec-2025 06:17:04 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • Dave Mason

     @DaveMasonDotMe @Em0nM4stodon This paper describes some techniques for identifying VPNs without relying on lists.

     The implementation challenges are such that I (a principal engineer who does adjacent things at a major company) rated the feasibility of doing it at scale as "LOLNO".

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 01-Dec-2025 07:12:26 JST Rich Felker

     in reply to

     • Dave Mason

     @DaveMasonDotMe @Em0nM4stodon Extortionists making lists of IP blocks that belong to "VPNs" and requiring payment to get taken off, and selling those lists to BOFHs who want to block ppl who care about their privacy.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 02-Dec-2025 02:16:38 JST Rich Felker

     in reply to

     • Dave Mason
     • LisPi

     @lispi314 @Em0nM4stodon @DaveMasonDotMe For key addressing they'd probably want you to have a key signed by a state authority tying it to your legal identity... That's even worse.

   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Tuesday, 02-Dec-2025 02:16:39 JST LisPi

     in reply to

     • Rich Felker
     • Dave Mason
     @dalias @DaveMasonDotMe @Em0nM4stodon Site operators who do this are throwing a red flag indicating that you should discontinue use of their site as they have zero respect for you and their other users (and therefore deserve zero respect in return).
     
     This is again something that would be avoided by key-addressing (which would also provide end-to-end encryption for free) and which reflects fundamental problems with the currently directly-used net.