5 ms·

Out of sheer curiosity: Does anyone know/suspect if Netflix is actually using techniques in addition to blocking IPs of known proxy/vpn/unblocking services? Bec

by lauritz 11y ago

Out of sheer curiosity: Does anyone know/suspect if Netflix is actually using techniques in addition to blocking IPs of known proxy/vpn/unblocking services? Because I would imagine that is a bit like fighting a hydra, very labor- and cost-intensive, yet they are getting excellent results (apparently, still, the sample of people who complain and thus get media coverage is pretty biased). Is anyone with a 'homegrown' vpn tunnel experiencing issues? I could also think of a solution involving cookies/fingerprinting that detects if someone's geolocation moves around quicker and more often than is physically possible. I'm sure the technology is under tight wraps, and I'm also sure that other companies will be dying to license this from Netflix if they get it right, even if it's just a lengthy list of IPs (e.g. the BBC for iPlayer).

tshtf 11y ago
It isn't fighting a hydra. The Netflix team is known for using reproducible automation in all their efforts. They have a significant "big data" team that can use and setup automatic classification using hundreds of available data points to classify users who are violating their ToS versus those who aren't. Netflix doesn't do anything that is labor or cost intensive: they have all of this automated. Even approaching this from a naive set of data points is cheap: It isn't particularly hard to classify IP addresses between cable modem blocks and those for VPS/VPN providers. Geolocation on a country level is relatively reliable. Also it's pretty easy to detect OpenVPN users on layers 2 and 3.: https://medium.com/@ValdikSS/detecting-vpn-and-its-configuration-and-proxy-users-on-the-server-side-1bcc59742413#.wdelq8jvq https://medium.com/@ValdikSS/detecting-vpn-and-its-configura...
- baby 11y ago
  I don't see how they could block VPN at all. Checking the amount of packet fragmentation works well if you want to make guesses, but if you start blocking on that you're in a lot of trouble...
cheez 11y ago
It's not super hard.. Customer has an address in country X, they're accessing from country X and Y in the same day. Probably block.
- tschuy 11y ago
  I'm currently ueing my family's account while abroad in France. Should I get blocked?
  - mytochar 11y ago
    DVDs used to be region-locked, so probably. Not the answer you wanted, not the answer that seems fair, but probably the technically right answer right now, until this situation changes.
    - mattmanser 11y ago
      The EU were looking at abolishing this as against free trade, much like they are waging war on roaming charges within the EU. They were talking about it a year or two ago, not sure what has happened since then as different countries in the EU have different censorship so it's not that simple (e.g. games in Germany are usually less gore). This is the only thing I can find about it, but I'm sure it was reported on here on better known sources: http://www.thesixthaxis.com/2015/03/30/european-commission-looking-to-remove-digital-region-locking-within-eu/ http://www.thesixthaxis.com/2015/03/30/european-commission-l...
      - bazzargh 11y ago
        From the european commission itself: What does the Commission plan to do about geo-blocking? Addressing unjustified geo-blocking will give more choice of products and services for consumers at lower prices. The Commission is planning to make legislative proposals in the first half of 2016 to end unjustified geo-blocking. Action could include a targeted change to the e-commerce framework, and to the framework set out by Article 20 of the Services Directive (on non-discrimination of recipients of services). As a result, traders will have only limited possibilities to deny access to online services.In parallel to legislative proposals, the Commission today launched a Competition Sector Inquiry to analyse the application of competition law in this area (press release and factsheet) http://europa.eu/rapid/press-release_MEMO-15-4920_en.htm http://europa.eu/rapid/press-release_MEMO-15-4920_en.htm There's lots to this behind that link, and at the digital single market site (https://ec.europa.eu/digital-single-market/en https://ec.europa.eu/digital-single-market/en) but it seems like some DSM legislation will be proposed later this year, but not all of it (since the eCommerce report isn't scheduled to be completed until 2017)
benologist 11y ago
The unblocker services use a DNS server to present you as being from another location, Netflix is only making it hard to pirate without incurring the bandwidth costs too - we were only paying $2/month to adfreetime.com for 3 people.
- johansch 11y ago
  DNS doesn't work that way. What these DNS-based unblocking services do is to selectively point certain hostnames to their own IPs, where they run TCP tunnels to the actual service.
  - benologist 11y ago
    Thanks for clarifying.
  - robhu 11y ago
    It sounds like it'd be very easy for Netflix to put a stop to this - they just need to make their webpage / app / whatever check the IP their certain hostnames lookup to and if it's not the whitelisted addresses it refuses to work. Or (much simpler) use actual IPs rather than hostnames. They can still dynamically change the IPs at will by updating their web code, so it's not hugely worse than using hostnames.
    - johansch 11y ago
      Yeah. I hope they don't :).
mcbridematt 11y ago
There was a report on the NANOG list of customers being flagged for VPN use while using an account in two countries simultaneously, but if one used another account from those IPs, there is no issue. http://mailman.nanog.org/pipermail/nanog/2016-January/083833.html http://mailman.nanog.org/pipermail/nanog/2016-January/083833... I suspect this type of analysis plays a bigger role than most people think. i.e A user jumping back and forth between US and Australian Netflix - faster than 'physically' possible, would act as a VPN flag. Personally I had to change the end point of my home made VPN, but have not had any issues since. As a precaution, I have avoided region jumping. If I did, I would try and leave a realistic gap between any access.
- copperx 11y ago
  I share my Netflix account with my sister who lives in Mexico, and we haven't had problems ... yet.
- j00pY 11y ago
  I am in the UK and have my user profile always set to the USA. It has been this way pretty much since I joined in 2013. I have not been blocked yet. My girlfriends user profile jumped between USA and UK all the time and was blocked when they started to crack down. Strangely, these two profiles both use the same registered account and unblock.us to switch regions.
Element_ 11y ago
Yes, they are using some kind of heuristics in addition to ip ban lists. I was using an openvpn instance on a private US server which was working fine until a couple weeks ago when I didn't notice the VPN connection dropped and accidentally reconnected from 2 different countries quickly. It banned me immediately.

by lauritz 11y ago

tshtf 11y ago

It isn't fighting a hydra. The Netflix team is known for using reproducible automation in all their efforts. They have a significant "big data" team that can use and setup automatic classification using hundreds of available data points to classify users who are violating their ToS versus those who aren't. Netflix doesn't do anything that is labor or cost intensive: they have all of this automated. Even approaching this from a naive set of data points is cheap: It isn't particularly hard to classify IP addresses between cable modem blocks and those for VPS/VPN providers. Geolocation on a country level is relatively reliable. Also it's pretty easy to detect OpenVPN users on layers 2 and 3.: https://medium.com/@ValdikSS/detecting-vpn-and-its-configuration-and-proxy-users-on-the-server-side-1bcc59742413#.wdelq8jvq https://medium.com/@ValdikSS/detecting-vpn-and-its-configura...

baby 11y ago
I don't see how they could block VPN at all. Checking the amount of packet fragmentation works well if you want to make guesses, but if you start blocking on that you're in a lot of trouble...

cheez 11y ago

It's not super hard.. Customer has an address in country X, they're accessing from country X and Y in the same day. Probably block.

tschuy 11y ago
I'm currently ueing my family's account while abroad in France. Should I get blocked?
- mytochar 11y ago
  DVDs used to be region-locked, so probably. Not the answer you wanted, not the answer that seems fair, but probably the technically right answer right now, until this situation changes.
  - mattmanser 11y ago
    The EU were looking at abolishing this as against free trade, much like they are waging war on roaming charges within the EU. They were talking about it a year or two ago, not sure what has happened since then as different countries in the EU have different censorship so it's not that simple (e.g. games in Germany are usually less gore). This is the only thing I can find about it, but I'm sure it was reported on here on better known sources: http://www.thesixthaxis.com/2015/03/30/european-commission-looking-to-remove-digital-region-locking-within-eu/ http://www.thesixthaxis.com/2015/03/30/european-commission-l...
    - bazzargh 11y ago
      From the european commission itself: What does the Commission plan to do about geo-blocking? Addressing unjustified geo-blocking will give more choice of products and services for consumers at lower prices. The Commission is planning to make legislative proposals in the first half of 2016 to end unjustified geo-blocking. Action could include a targeted change to the e-commerce framework, and to the framework set out by Article 20 of the Services Directive (on non-discrimination of recipients of services). As a result, traders will have only limited possibilities to deny access to online services.In parallel to legislative proposals, the Commission today launched a Competition Sector Inquiry to analyse the application of competition law in this area (press release and factsheet) http://europa.eu/rapid/press-release_MEMO-15-4920_en.htm http://europa.eu/rapid/press-release_MEMO-15-4920_en.htm There's lots to this behind that link, and at the digital single market site (https://ec.europa.eu/digital-single-market/en https://ec.europa.eu/digital-single-market/en) but it seems like some DSM legislation will be proposed later this year, but not all of it (since the eCommerce report isn't scheduled to be completed until 2017)

benologist 11y ago

The unblocker services use a DNS server to present you as being from another location, Netflix is only making it hard to pirate without incurring the bandwidth costs too - we were only paying $2/month to adfreetime.com for 3 people.

johansch 11y ago
DNS doesn't work that way. What these DNS-based unblocking services do is to selectively point certain hostnames to their own IPs, where they run TCP tunnels to the actual service.
- benologist 11y ago
  Thanks for clarifying.
- robhu 11y ago
  It sounds like it'd be very easy for Netflix to put a stop to this - they just need to make their webpage / app / whatever check the IP their certain hostnames lookup to and if it's not the whitelisted addresses it refuses to work. Or (much simpler) use actual IPs rather than hostnames. They can still dynamically change the IPs at will by updating their web code, so it's not hugely worse than using hostnames.
  - johansch 11y ago
    Yeah. I hope they don't :).

mcbridematt 11y ago

There was a report on the NANOG list of customers being flagged for VPN use while using an account in two countries simultaneously, but if one used another account from those IPs, there is no issue. http://mailman.nanog.org/pipermail/nanog/2016-January/083833.html http://mailman.nanog.org/pipermail/nanog/2016-January/083833... I suspect this type of analysis plays a bigger role than most people think. i.e A user jumping back and forth between US and Australian Netflix - faster than 'physically' possible, would act as a VPN flag. Personally I had to change the end point of my home made VPN, but have not had any issues since. As a precaution, I have avoided region jumping. If I did, I would try and leave a realistic gap between any access.

copperx 11y ago
I share my Netflix account with my sister who lives in Mexico, and we haven't had problems ... yet.
j00pY 11y ago
I am in the UK and have my user profile always set to the USA. It has been this way pretty much since I joined in 2013. I have not been blocked yet. My girlfriends user profile jumped between USA and UK all the time and was blocked when they started to crack down. Strangely, these two profiles both use the same registered account and unblock.us to switch regions.

Element_ 11y ago

Yes, they are using some kind of heuristics in addition to ip ban lists. I was using an openvpn instance on a private US server which was working fine until a couple weeks ago when I didn't notice the VPN connection dropped and accidentally reconnected from 2 different countries quickly. It banned me immediately.