407
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 Feb 2024
407 points (98.6% liked)
Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ
54390 readers
508 users here now
⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.
Rules • Full Version
1. Posts must be related to the discussion of digital piracy
2. Don't request invites, trade, sell, or self-promote
3. Don't request or link to specific pirated titles, including DMs
4. Don't submit low-quality posts, be entitled, or harass others
Loot, Pillage, & Plunder
📜 c/Piracy Wiki (Community Edition):
💰 Please help cover server costs.
 |
 |
|---|---|
| Ko-fi | Liberapay |
founded 1 year ago
MODERATORS
VPNs are extremely easy to detect and block. You need to do deep packet inspection but it can be done if they're willing to pay for it.
This is what it's going to come down to, whether ISPs will be willing to eat the costs for all the blocking.
Any mid-range / price firewall solution is capable of effectively blocking most VPN solutions. Both OVPN and Wireguard VPN traffic is trivial to identify as such and block. Here's an example and another.
China's great firewall works a little bit differently. They aren't actively blocking certain kinds of traffic by default because that would mean a large DPI effort they don't want to undertake. Also if you google a bit about it you'll find that people's experiences are mostly "my VPN worked fine for a day/week/month and then it was blocked". It seems they've some IPs and domains blocked and the rest is some kind of machine learning that applies rules as it sees fit, this guy here has a good analysis of it.
All the serious companies (financial sector) I worked for so far did it, because as I linked is really easy with any cheap firewall solution.
Well... a bank could be considerar that indeed, but you know, security concerns and all.
So what? A company can use a firewall to block VPNs when the target IP isn't on some whitelist, or the source computer isn't authorized to use VPNs. On those high security setups at banks and whatnot client machines inside the company network won't need to touch a VPN to do a "remote checkup of a server" at some cloud provider as the network will be configured to internally route the traffic from all computers / users (backed by SSO/AD credential) to access those resources via a special VPN setup on some router / server.
Fortinet and WatchGuard can both distinguish a VPN from TeamViewer. They can actually do much more than that, even TeamViewer from RDP or VNC is just a couple of clicks on their UIs.
That's also the policy for the majority of the machines/users but there are a few that do have admin privileges like IT teams and whatnot and even if they manage to install a VPN solution (the app would most likely get blocked by endpoint security either way) they couldn't communicate to the outside because the firewalls, as I described, are all set to block VPN traffic. Except for those situations I specified above.
The bottom line is: distrust everything, everyone and anything. Even if you can ensure nobody can install a VPN application on their computers, assume someone might get around that and add proper firewall checks and blocks as well.
I agree with you, but still the portuguese law is equally a violation of the EU human rights agreement.
Kind of, the law doesn’t actually say that it only applies to ISPs… technically speaking the Portuguese law could be applicable and enforced with a VPN provider is a court decided to do so. The legislation is kind of written in a vague way that may apply to more than just ISPs. So far they only pressured ISPs to block websites.
Not the case at all around here (Portugal), the blocks are quick and ISPs don't even complain, they simply comply. What the law says is that there's a govt entity called IGAC that is allowed to ask ISPs to block a website (domain name) as long as the website is flagged as containing / hosting piracy or other form of copyright infringement. The only requirement is that IGAC has to notify the website owner asking to remove the content prior blocking. After 48 if the website is still hosting said content then IGAC will ask the ISPs to block it.
Since this is all DNS based one can, obviously, set their DNS servers as Google or Cloudflare and bypass the block. Now the problem is that this is all fun and games until someone in the govt decides to go against Cloudflare and other DNS providers, the law would allow them to easily do it the way its written.
Yes, but what if the govt just politely tells them "look, we've a law about piracy and we think you should block websites at the DNS level like our ISPs are doing". Do you think Google / Cloudflare will fight it? They already have mechanisms for that in place for parental controls etc. so... the effort of adding a block list for a country shouldn't be a big deal.
😂 😂 😂 well the irony is that this is the kind of "authoritarian shitshow" we got by electing the left. That and a tax on digital storage (flash drives, disks etc) because they might be used to hold piracy. Even phones are taxed.
Great piece of shit of a tax indeed.