Slashdot Mirror

← Back to Stories (view on slashdot.org)

How To Defeat VPN Location-Spoofing By Mapping Network Delays (thestack.com)

Posted by timothy on from the tricky-echoes dept.

An anonymous reader writes: An interesting paper from a PhD student in Ontario outlines a system which in initial tests has proved 97% effective at unmasking geo-spoofing VPN users. The Client Presence Verification (CPV) system presented in the paper utilises analysis of delays in network packets in order to determine the user's location, disregarding the IP address geolocation information which currently underpins the efforts of content providers such as Netflix to prevent VPN users accessing content which is not licensed in their country. The detection system was tested at global network laboratory PlanetLab using 80 network nodes based in the U.S. and Canada.

81 comments

  1. Seems trivial to mask by DreamMaster · · Score: 5, Interesting

    I haven't RTFA yet, but If the analysis is solely based on network delays, then a VPN company could simply introduce randomized delays to all it's users, even the local ones. Then an analysing service wouldn't be able to definitively say whether any given user is geo-spoofing or not. The best they could say is that the connecting service is likely a VPN.

    1. Re:Seems trivial to mask by Anonymous Coward · · Score: 1

      sure but you can't spoof FTL, that is the point

    2. Re:Seems trivial to mask by The-Ixian · · Score: 2

      Nobody can spoof FTL... It is impossible to move faster than light... everyone knows this...

      --
      My eyes reflect the stars and a smile lights up my face.
    3. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      Actually I think you are missing a completely different point. You don't have to speed up connections to match the speed of non-vpn traffic, you just have to slow everything down so that you can't be sure which is VPN and which is normal. Sure, nobody likes slowing down their own connection, but if you really want to hide your vpn usage from a system like this it would work. In one situation you could have multiple IP's from your ISP. You could just set one of them to be delayed regardless of whether the VPN is on or off, that way all connection attempts take a standardized time (or more in rare situations) to complete.

      And anyway this method only stops direct VPN connections between an end user and the service. If the VPN is instead a sort of NAT system instead this method of detection wouldn't work. Since the service would only see a connection between it and a close VPN exit server and not the full tunnel between the service and the end-user. The VPN exit tunnel would use a form of NAT to man-in-the-middle the connections, thereby hiding the end-user's actual latency thus foiling this detection method. I'm not 100% sure but I believe a SOCKS proxy may act this way.

    4. Re:Seems trivial to mask by ArmoredDragon · · Score: 2

      A problem with this is that some types of connections are slower than others when it comes to overall latency. With modern broadband, geosync satellite is the slowest, followed by DSL, followed by cable, with fttp being the fastest. How are they supposed to control for that? A VPN really doesn't add a whole lot of latency, and even if it did, they could just replace it with GRE to reduce that added latency (we don't really need encryption if we're just trying to geospoof since the sites we're trying to geospoof to always use TLS anyways) and you're adding the same amount of latency that say DSL would add vs cable.

    5. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      Uh, talking about yourself again?

    6. Re:Seems trivial to mask by AHuxley · · Score: 2

      Yes AC, all the better VPN providers have to do is buy into the right ip ranges and hardware locations in the USA.
      Huge blocks of ip's exist and so do interesting telco like options. A 100 optical link in New Zealand or the UK becomes a virtual copper connected user in a US state.
      Every line test and request shows an average community of US users, a brand name and a US ip range. With a low "ms" ping to match the geographic location.
      The magic will be in the interface between a city or rural network front and the global backend.

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:Seems trivial to mask by DarkOx · · Score: 1

      I would think the thing to do would not be to introduce randomized delays but rather to adopt a fairly pessimistic minimum latency to your client end points. If packets from a given client arrives closer together than the pessimistic latency the trailing packet should be held until that minimum time is reached. You probably want do this on sending to the client as well as that might still enable timing attacks otherwise. That wont effect performance much streaming media where the MTU will full most of the time and jitter matters as much as anything. It will probably be okay for things like VOIP too if the value is help to something like 250ms and the VPN provider is well connected / peered on the output side.

      This should have the effect of making all your VPN clients appear equally well connected to third parties. Yes there will be some throughput limitation introduced but the reason to use these services is for anonymity not performance.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    8. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      A problem with this is that some types of connections are slower than others...

      LIE. All services, including Verizon FTTP, are exactly the same speed as 2400 baud modems.

    9. Re:Seems trivial to mask by 110010001000 · · Score: 3, Funny

      I don't live in my Mom's basement. I live in my Mom's Au Pair suite!

    10. Re:Seems trivial to mask by joshuao3 · · Score: 4, Funny

      Actually I think you are missing a completely different point. You don't have to speed up connections to match the speed of non-vpn traffic, you just have to slow everything down so that you can't be sure which is VPN and which is normal.

      So... Comcast really had our best interests in mind after all?

      --
      Monitor bandwidth usage on IIS6 in real-time: http://www.waetech.com/services/iisbm/
    11. Re:Seems trivial to mask by Thanshin · · Score: 2

      Never underestimate the spoofing abilities of an Alcubierre drive station wagon full of tapes hurtling down the highway.

    12. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      Nor the destructive power...

    13. Re:Seems trivial to mask by Thanshin · · Score: 1

      Well, it's for the client to choose which method is more convenient to him.. You can have your packets in time or without the cone of ultra-energetic particles that vaporizes your entire civilization.

    14. Re: Seems trivial to mask by Anonymous Coward · · Score: 0

      But that's only part of the point. You wouldn't be able to take delay away though. The application would still be able to go "Hey, the latency is higher than it aught to be, they are most likely not actually on that network / in that area".

      An oversimplification, but you get my point?

    15. Re:Seems trivial to mask by Lumpy · · Score: 2

      Or just use Comcast... They introduce random delays in their normal traffic due to how crappy their network is.

      --
      Do not look at laser with remaining good eye.
    16. Re:Seems trivial to mask by sudon't · · Score: 1

      I haven't RTFA yet, but If the analysis is solely based on network delays, then a VPN company could simply introduce randomized delays to all it's users, even the local ones. Then an analysing service wouldn't be able to definitively say whether any given user is geo-spoofing or not. The best they could say is that the connecting service is likely a VPN.

      From TFP: "To achieve high accuracy, CPV mitigates Internet path asymmetry using a novel method to deduce one-way application-layer delays to/from the client’s participating device, and mines these delays for evidence supporting/refuting the asserted location."

      But, simply saying that the connection is through a VPN could be enough for some to refuse the connection. For instance, if content providers really got on Netflix and Hulu's ass about it, they might opt for this simpler solution of blocking VPNs. I'm kinda surprised they aren't already doing this.

      --
      -- sudon't

      Air-ride Equipped

    17. Re:Seems trivial to mask by ooloorie · · Score: 1
      No, us space nutters simply don't care much either way. Overcoming the light speed limit isn't necessary for space exploration or colonizing the galaxy.

      In any case, FTL travel is consistent with known physics; at this point, the question is merely whether it's practical.

    18. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      I am in the Middle East for work. I can tell you for a fact that Hulu blocks streaming because I am on a VPN into the US. Netflix,Sling and Amazon work like a charm.

    19. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      No; it is impossible for anything to move through spacetime faster than light, but spacetime itself can move faster than light.

    20. Re:Seems trivial to mask by Anonymous Coward · · Score: 0

      Yes, you obviously have not RTFA yet.

    21. Re:Seems trivial to mask by mysidia · · Score: 1

      Nobody can spoof FTL... It is impossible to move faster than light... everyone knows this

      VPN environments will get replaced with VPC environments (Virtual-Private Compute)

      They'll just move more and more elements of the protocol stack out to the external provider, until the spoofing can no longer be detected.

      The next step above VPN is using an Application-Layer Proxy or Tunnel instead, such as Wingate or a HTTP proxy.

      A step above that would be to run the web browser/software from the service provider's datacenter, and just redirect the Keyboard/Screen output to the remote user.

    22. Re:Seems trivial to mask by nazsco · · Score: 1

      >97% detection rate

      with a probably 95% false positive rate on top.

      who the heck thinks slow network is a way to detect location is a good idea!?

    23. Re:Seems trivial to mask by MrDoh! · · Score: 1

      Aye, spin up an AWS instance in whatever region you need, run Chrome, and chrome remote the screen to your real machine/tablet/phone anywhere in the world. Heck, if Netflix is now running using AWS, it's probably a couple of racks over it needs to get to, decent ping rate! "It's already in the house!!!"

      --
      Waiting for an amusing sig.
    24. Re:Seems trivial to mask by antdude · · Score: 1

      Prove it. :P

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  2. False positives by Stuarticus · · Score: 4, Interesting

    False positives are a pretty major issue when you look at Netflix's user base, 97% effective isn't very good if you're going to refuse to serve content to over a million paying customers every day.

    --
    If you think someone isn't free to have a different definition of "freedom" you may be a tyrant.
    1. Re:False positives by Anonymous Coward · · Score: 0

      Combine it with geo-location and you'd might get a better figure.

    2. Re:False positives by Anonymous Coward · · Score: 0

      False positives are a pretty major issue when you look at Netflix's user base, 97% effective isn't very good if you're going to refuse to serve content to over a million paying customers every day.

      It doesn't have to be over one day. You can run the report over multiple runs/trials of the 'customer'. With enough statistics you could probably get 99.999% of detecting someone.

      As someone who uses these services, I hope someone slugs him in the mouth for not helping.

      Cough *back to bittorrent* cough

    3. Re:False positives by Anonymous Coward · · Score: 0

      I guess they could just submit all flagged users to a more in-depth analysis, maybe by a human instead of a machine. 97% would be effective in lowering the number of hits to be manageable by a human. A service like Netflix wouldn't restrict itself to one mode of detection anyway, so that 97% would be in adjunct to whatever system(s) they are currently using.

    4. Re:False positives by Qzukk · · Score: 1

      According to this research, Comcast users are from Mars.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    5. Re:False positives by wbr1 · · Score: 1

      This. I know many people on slow rural DSL with terrible upstream speeds. Thier ping and jitter can be bad, but downstream is enough to support streaming. This is a whole class of users that would be branded with a false positive as VPN user if delay is the only factor.

      --
      Silence is a state of mime.
    6. Re:False positives by AmiMoJo · · Score: 1

      I wonder if it really is as high as 97%, even when accounting for ISPs that are heavily oversubscribed and offer massively variable packet latency.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    7. Re:False positives by Lumpy · · Score: 1

      No, it's just Comcast bounces all their internet traffic off of mars.

      --
      Do not look at laser with remaining good eye.
    8. Re:False positives by pr0fessor · · Score: 1

      97% in a partially controlled environment the internet is not that consistent but even still 3% of Netflix reported 33.3 million subscribers is 999,000 even if only half are false positives and even if only half of those people decide to leave it's still a loss of over $20 million a year assuming they all have the basic $7.99 account.

      I imagine that when you start looking at rural dsl or satellite internet it will be much harder to tell based on latency and that number will go up.

    9. Re:False positives by Anonymous Coward · · Score: 0

      > slow rural DSL

      Don't you mean urban DSL? Most of the rural areas have newer wiring. Many cities are stuck with slow DSL, or even can't support it at all like parts of Seattle due to the early adopter problem. Here's my 0.15 Mbps results:

      http://www.speedtest.net/my-result/3840461248

      I live two blocks from the tallest building in Seattle, and this is the fastest connection I can get.

    10. Re:False positives by lowen · · Score: 1

      While I do have mod points, I need to post this. I regularly see 1,000ms ping RTT on my otherwise reasonably fast (7/.5) DSL service when I have a lot of upstream traffic, and that ping RTT is to the router's gateway, a single hop away. My boss, who is on a 50/5 cable service, has consistent 1,000ms ping RTT to his next-hop. RTT for other packets varies according to protocol and IP target, showing some QoS queueing going on.

      My DSL RTT to the next hop varies between a couple of ms to 1,000 ms depending on upstream traffic amount; determining my location based on that would be foolish.

    11. Re:False positives by radarskiy · · Score: 1

      3% of someone else's paying customers? The MPAA is willing to make this sacrifice. ;-)

  3. Mask this by violating TCP rules? by Theovon · · Score: 2

    People have pointed out that this is hard to make because you can’t make signals move FTL. Basically, you can send a packet, and by the rules of TCP, the ACK is generated at the destination, so while you could artificially lengthen the round-trip ping time, you can’t shorten it. But why not? How about we have the VPN buffer the TCP packets and break the rules. When a packet is received from Netflix, the VPN sends the ACK. When the user’s computer sends its ACK, the VPN consumes it. If there’s a chance of this being unreliable, them’s the breaks.

    1. Re:Mask this by violating TCP rules? by silas_moeckel · · Score: 5, Interesting

      The satellite guys have done this forever. Moving the syn/ack to the VPN head end is a stock application at this point.

      --
      No sir I dont like it.
    2. Re:Mask this by violating TCP rules? by Anonymous Coward · · Score: 0

      I have heard through the grapevine that the high speed trading fiber line providers introduce delays at the last mile by sending the signal through tens or hundreds of spools of fiber to introduce a delay. If you want the faster premium service they take you out of this loop and your service gets faster. So there is always a way albeit not always practical or affordable for most providers.

    3. Re:Mask this by violating TCP rules? by Quince+alPillan · · Score: 4, Interesting

      What you're talking about is a forward proxy. Forward proxy servers do this (and will even proxy SSL traffic).

      In the whitepaper, they're actually talking about making a new protocol that measures the one way distance time and compares it to their database of network speeds and distances to determine your location. Their solution is an application-level solution, which depends upon a Forward Proxy to know about the protocol and spoof it correctly.

      The problem with their solution is that network speeds are fluid and a computer with a problem (e.g. a local neighborhood node or a legitimately slow client that is delaying all traffic 20-30ms) can make their estimates wildly inaccurate. Even today, Cogent to Level 3 has a 197ms ping in LA. In the paper, they used average speeds for various known networks. This can be mitigated somewhat by measuring client traffic and only counting outliers (e.g. all traffic from a certain area being delayed the same, except for our rogue client) but it still doesn't mitigate the local computer problem.

      A second problem with their solution is that it only measures distance - a server in Miami, Florida accepting data from a client in Seattle, Washington is 2732 mi and the same distance (roughly) as Lima, Peru. This means that a client in Lima should pretend to be from Seattle when they connect to their combo VPN/Forward Proxy in Miami. Satellite customers are will almost always have extremely high latency because of the round trip between Earth and the Satellite, even if they're legitimately in the correct area.

      In addition, they were only able to make this accurate to about 400km, which means if you have a nearby beneficial country within that range, you can use a VPN in that country and they still won't know.

    4. Re:Mask this by violating TCP rules? by Anonymous Coward · · Score: 0

      Even today, Cogent to Level 3 has a 197ms ping in LA

      That's because Level 3 throttles/deprioritizes ICMP traffic aimed at their equipment a lot heavier than most ISP's do. I used to work for a large ISP and we constantly got people griping about "high ping times to level 3 routers". It got really old having to explain that ICMP passing through their network is treated different than ICMP traffic going TO their routers, and if the endpoint you're pinging has an average latency of 50ms with no packet loss, then it really does not matter at all if your traceroutes show 500ms + latency/packet loss on the Level 3 routers along the path.

      I really shouldn't have to explain this on Slashdot of all places, but apparently I still do.

    5. Re:Mask this by violating TCP rules? by Bengie · · Score: 1

      You do make a good point, but they didn't mention how they measured the latency. Maybe the used a looking glass server. It's also not common to see high pings like that, but they do happen. I only notice them a few times a week while i'm looking. At one point I had my Internet quality graph pointed to my first Level 3 hop, and it was fine for several days before it decided to have wild ping swing and packetloss even though the Internet was fine. I am now stuck using 8.8.8.8 and 8.8.4.4 for monitoring, and those servers had a lot of jitter.

    6. Re:Mask this by violating TCP rules? by ooloorie · · Score: 2

      Or, alternatively, you can simply run the Netflix app on a virtual machine in the target country and then stream the video from the virtual desktop.

    7. Re:Mask this by violating TCP rules? by Anonymous Coward · · Score: 0

      That's a lot of effort to go to just to watch some TV shows or movies. Perhaps I'll just use Show Box instead. Using a VPN to spoof your location isn't exactly legit to start with, so if the content producers or distributors make it too difficult to pay for what you want, why not skip the charade altogether?

      I think Netflix knows this, which is why they don't make more than a token effort to block those using VPNs to access content from a different country, they just have to be seen to do something by those that license the content to Netflix, Netflix doesn't really want it to be very effective.

  4. Odd Turn of Phrase by Anonymous Coward · · Score: 0

    I found it odd the it was worded as a "... PHD student in Ontario ...", the I read the article and saw that the person was from Last Change U.

  5. Re:evil farce mug portland coffin wig by Anonymous Coward · · Score: 0

    True

  6. Holy IEEE Membership, Batman! by EmagGeek · · Score: 1

    These people sure seem to think that IEEE Membership means something...

  7. 97% is not even close to commercially viable by Thanshin · · Score: 4, Insightful

    97% to detect irregular behavior is completely useless unless the rate of regular and irregular behavior is reasonably balanced. In most commercial settings the rate is biased towards regular behavior by several orders of magnitude. In other words, thousands of times more more biased than 97:3.

    Therefore, this system will have orders of magnitude more false positives than positives. So the positives will just disappear inside a mass of angry customers.

    In short; the ratio of success has to be in the same order of magnitude as the ratio of irregular behavior. e.g.: for Netflix you'd need better than 99.99% precision.

    1. Re:97% is not even close to commercially viable by Anonymous Coward · · Score: 3, Insightful

      And even then, you must consider that Netflix doesn't actually give a flying fuck about geospoofing as long as the number of people doing it consistently remains small and those people remain paying customers...

      Netflix has no reason to actually WANT to prevent or disallow these customers from consuming content this way--there's nothing to be gained by winning that fight and lots to lose.

      They're simply playing along so content owners don't start threatening to pull content. They're actually between a rock and a hard place, hence the "we're trying to prevent geospoofers from consuming content where they shouldn't. We won't let it happen again, honest!" thing.

    2. Re:97% is not even close to commercially viable by Some+nick+or+other · · Score: 3, Insightful

      Typical base rate fallacy example. Suppose 1% of the users are VPN users. Suppose the service is 97% accurate at classifying VPNers as VPNers and regular users as regular users. What's the probability that a user is a regular user given that the system says he's a VPNer?

      Out of 10000 users, there are 100 VPN users. 97 of these will be recognized, 3 not.
      There are 9900 ordinary users. 9900*0.03=297 of these will be falsely flagged.

      So the probability of a positive being true is 97/(97+297) = 24.6%. The probability that he's a regular user is 75.4% which is not nearly good enough for Netflix.

    3. Re:97% is not even close to commercially viable by myowntrueself · · Score: 1

      And even then, you must consider that Netflix doesn't actually give a flying fuck about geospoofing as long as the number of people doing it consistently remains small and those people remain paying customers...

      The most telling part of this whole saga is that the content providers themselves don't seem to have caught on to a basic economic detail: if people are consuming the content through the likes of Netflix, bypassing region restrictions, they (the content providers) get some money.

      If they manage to get Netflix to clamp down on out-of-region customers then those people will become former customers and will go back to piracy and the content providers will get no money at all.

      It is in the interest of the content providers to do away with region restrictions but they just can't see this because thats how stupid they are.

      --
      In the free world the media isn't government run; the government is media run.
    4. Re:97% is not even close to commercially viable by mysidia · · Score: 2

      If they manage to get Netflix to clamp down on out-of-region customers then those people will become former customers

      The content creators want Netflix to PAY MORE to license the content in these extra countries.

      Regional restrictions are about generating more $$$ by allowing the content to be priced higher in other areas according to their local market conditions and to force companies that need worldwide usage to jump through many hoops and pay a heck of a lot more.

    5. Re:97% is not even close to commercially viable by Anonymous Coward · · Score: 0

      Typical base rate fallacy example. Suppose 1% of the users are VPN users. Suppose the service is 97% accurate at classifying VPNers as VPNers and regular users as regular users. What's the probability that a user is a regular user given that the system says he's a VPNer?

      Out of 10000 users, there are 100 VPN users. 97 of these will be recognized, 3 not.

      There are 9900 ordinary users. 9900*0.03=297 of these will be falsely flagged.

      So the probability of a positive being true is 97/(97+297) = 24.6%. The probability that he's a regular user is 75.4% which is not nearly good enough for Netflix.

      No.

      Why are you assuming the accuracy for identifying actual VPN users is also the accuracy for identifying non-VPN users? Just because the detection algorithm claims to correctly identify 97% of VPN users, it does NOT follow that it will inaccurately identify 3% of non-VPN users.

      Finding whatever characteristics of a VPN connection 97% of the time when they're actually present does NOT mean those characteristics will be found 3% of the time when they're known to not be present.

      For example, when you're looking for a needle in a haystack, you may only have a 10% chance of finding it. But if it's not there, your chances of finding it are zero. You'd say you'd find a needle when one isn't present fully 90% of the time. That's ridiculous.

    6. Re:97% is not even close to commercially viable by myowntrueself · · Score: 1

      If they manage to get Netflix to clamp down on out-of-region customers then those people will become former customers

      The content creators want Netflix to PAY MORE to license the content in these extra countries.

      Regional restrictions are about generating more $$$ by allowing the content to be priced higher in other areas according to their local market conditions and to force companies that need worldwide usage to jump through many hoops and pay a heck of a lot more.

      The thing is they aren't going to get more, they are going to get nothing at all.

      --
      In the free world the media isn't government run; the government is media run.
  8. Nothing can go wrong by HideyoshiJP · · Score: 1

    My average ping time over VPN is pretty similar to my ping rate over some in-home powerline adapters I have when they're doing okay but not great. Guess I'll have to rewire my entertainment area since someone wants to ruin the fun.

  9. What a waste of brainpower by The+Last+Gunslinger · · Score: 1

    All that time and effort spent on finding ways for corporate profiteers to artificially restrict the transmission of bits from point A to point B; and even if implemented, it will probably be circumvented in a minuscule fraction of the development time.

    Such a fucking waste.

    1. Re:What a waste of brainpower by PlainWhiteTrash · · Score: 2

      Here, I must disagree. I'm a software developer and network engineer. Specifically, my particular software development specialty involves interacting intimately with the network layer. (I'm in the VoIP world.) These people are doing good work in relating characteristics of latency to distance and geolocation and along the way are learning a great deal about the various factors that influence latency and jitter in the real world across working, real world networks. While you may not enjoy the particular aims that they're pursuing as a commercialization strategy, they have to get paid somehow... Meanwhile, the things that they learn about the causes of latency, jitter, and other aspects of service quality in packet networking can be USEFULLY utilized by everyone else in improving the network. Just a thought.

    2. Re:What a waste of brainpower by Anonymous Coward · · Score: 0

      Well Carlton is a third rate University at best.

  10. Fuck Abdelrahman Abdou by Anonymous Coward · · Score: 1

    Why? Other than making VPN users miserable, why did Abdelrahman Abdou do this?

    1. Re:Fuck Abdelrahman Abdou by Anonymous Coward · · Score: 0

      Because someone else would have.

      And because it's far better to identify security flaws than to stick your fingers up your ass and pretend they don't exist.

    2. Re: Fuck Abdelrahman Abdou by Anonymous Coward · · Score: 0

      Security flaw? What security flaws did he discover?

    3. Re:Fuck Abdelrahman Abdou by Anonymous Coward · · Score: 0

      Because he's a miserable sand nigger?

  11. Randomization + TCP Accelerators by luis_a_espinal · · Score: 1

    The Client Presence Verification (CPV) system presented in the paper utilises analysis of delays in network packets in order to determine the user's location, disregarding the IP address geolocation information which currently underpins the efforts of content providers such as Netflix to prevent VPN users accessing content which is not licensed in their country

    Maybe I'm missing something, but it looks to me that this can be defeated with randomized throttling of packet delivery and TCP accelerators that intercept/cache/send ACK packages on the client's behalf.

    1. Re:Randomization + TCP Accelerators by The-Ixian · · Score: 1

      I am sure it can be defeated with enough effort... but the question is: When is it too hard for the masses to bother with it?

      --
      My eyes reflect the stars and a smile lights up my face.
    2. Re:Randomization + TCP Accelerators by luis_a_espinal · · Score: 1

      I am sure it can be defeated with enough effort... but the question is: When is it too hard for the masses to bother with it?

      All it takes is software (in this case, a delay analysis countermeasure) good enough to make it plausible to the masses. Consider DVD ripping. At the beginning, it was just too much of a hassle for the common person to get all the necessary pieces together. Now, there are full-feature applications that can do that at the click of a button. Or consider managing photographs on external storage. Picasa and the like makes it extremely simple for the common person.

      It will be too hard for the masses until someone automates it for them.

  12. Helping the industry, screwing over users by Anonymous Coward · · Score: 0

    Thank you NOT, PhD student in Ontario.

  13. good point, but multiple indicators are used by raymorris · · Score: 1

    You make a good point about the a priori probabilities. If most customers are legit, then most customers who are flagged may be legit. ("97% accuracy " doesn't tell us if there are 3% false positives or 3% false negatives. There's a BIG difference. )

    However 97% from a single indicator is very useful because indicators can be combined. Consider you're looking at someone and classifying them as male or female. One thing you see is the length of their hair. You also see what kind of shirt their wearing, etc. Each of these indicators is only 90% accurate, but together they allow you to recognize male vs female correctly 99.5% of the time, and you know whem you're unsure.

    Applying this to the current question, if their browser is set to prefer Russian, their latency and jitter is characteristic of Russia, their form of payment is typical of Russian vpn users, they're watching movies popular in Russia, etc, they might be in Russia or a neighboring country. Again, you can tell when you're getting conflicting indicators or borderline values, so you can compute the level of uncertainty.

  14. Canada once more again showing it's true fascist by Anonymous Coward · · Score: 0

    colours.

    Thanks for more censorship, and authoritarian dictatorship, assholes.

  15. Solution: proxy by vojtech · · Score: 1

    Ok, so the next step in the game is a VPN with a built-in transparent TCP (or deeper) proxy at the VPN provider end. That'll take care of the latencies.

  16. Netflix does not care by Ivan+Stepaniuk · · Score: 1

    They limit content access to countries based on contract restrictions that they agree to when acquiring the distribution licenses.

    They are only going to implement these kind of thing if the content owners require so.

    --
    My other signature is a car
  17. Goodbye US municipal Wifi/WiMAX Networks by Anonymous Coward · · Score: 0

    subject says it all

  18. Not Unmasking by Anonymous Coward · · Score: 1

    It's not unmasking, it's detecting. Unmasking would reveal the actual source IP of the user. This method simply shows whether or not a user is likely using a VPN. There is a huge difference.

  19. Missing from the article... by mark-t · · Score: 1

    ... is what percentage of connections that were *NOT* using vpn were falsely detected as still being from another country? The article only claims that the tech can identify 97% of out-of-country vpn users as such, but says nothing about the accuracy of identifying actual in-country users. Is it higher? Is it lower? Article leaves it as completely unspoken

    --
    File under 'M' for 'Manic ranting'
  20. Rasberry for Science award? by Anonymous Coward · · Score: 0

    I nominate this bit of work for a Raspberry award, as it is something that has no benefit to science. A PhD which does not further the understanding of the universe or help mankind in anyway. Congratulations on making the world a little bit crappier!

  21. Pirating by slashping · · Score: 1

    If people don't want to me pay for their services because I'm in a different country, I guess I'll have to resort to pirating the material instead.

  22. Feel sorry for satalite users by evil9000 · · Score: 1

    If all they're looking at is latency, then watch out for anyone who over-uses their bandwidth and creates artificial lag through network congestion - this technology will label you a dirty international thief.

    I'm sure the farmers who wrote the constitution thought about this when they were writing up trade and copyright laws.....

  23. Why. by Anonymous Coward · · Score: 0

    None of this needs to exist.
    It is equal to helping a prisoner rape another inmate.

  24. Good idea but by Anonymous Coward · · Score: 0

    Defeated by remote desktop