Hacker News

points by seethishat 3 days ago | 0 comments

I have T-mobile 5g. My IP shows up as a residential proxy. I can't control the T-Mobile 5g device. It's a black-box. And, I only have one Linux desktop on the home network (so no Windows/Mac malware).

Not sure why my IP is listed as a residential proxy.

[–] hetspookjee 3 days ago

There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users

[–] BLKNSLVR 3 days ago

You certainly can ban that IP.

It should be a balancing act though, somewhere between what you said and my first sentence.

Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.

It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.

IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.

[–] Gigachad 3 days ago

The blocking of residential proxies might be the thing that moves the world to ipv6. These days what we need is a dynamic map of all the IPs running proxies so servers can block them. If every device gets it's own v6 address, you could block just the TV running the proxy. Modern crowd sourced security products could identify the proxies and share their IP live so you can ban and unban addresses as the device moves.

[–] BLKNSLVR 3 days ago

A list of proxy lists: https://proxy-scraper.de/sources/

The lists generated by this tool can be useful as well: https://github.com/maximilianfeix/proxy-scraper (which point to here: https://github.com/maximilianfeix/free-proxy-list)

There is also this bot proxy IP list: https://github.com/antoinevastel/avastel-bot-ips-lists

[–] 1e1a 3 days ago

The TV can just pick a different address when it notices that it is being blocked.

[–] Gigachad 3 days ago

In that case you’d just block the whole subnet that the TV is using.

[–] hafizmaaz 6 hours ago

Cant we go beyond IP blocking?

[–] hafizmaaz 6 hours ago

Yes, all users suffer on the same IP due to IP block

[–] skinfaxi 3 days ago

> It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic

Is this like a corporate support response? I legit can't tell. Try explaining to a retail consumer why they can't buy from your site because they have TMobile service.

[–] what 3 days ago

They’re saying T-Mobile should be monitoring traffic on their network and block traffic from bad actors that ruin it for everyone for everyone else? Or at least they do in the next paragraph.

[–] skinfaxi 3 days ago

When the bad actor is grandma who has an infected computer, T-Mobile will be dealing with a lot of support calls from objectively non-malicious actors.

[–] neuroticnews25 3 days ago

>you shouldn't just leave to door open to potentially known bad users / traffic

Why not? If security is the priority, the worst that could happen from that is clutter in logs and higher resource use. Nobody wastes 0days spraying them on random hosts, and a real motivated attacker targeting your server will not be stopped by an ip blacklist.

[–] sva_ 3 days ago

Not sure about US but where I live I can manually set the access point of my phones mobile network and it gives me a unique ipv4 (new one each time in fact)

[–] hod6654 3 days ago

Care to elaborate? Your mobile network operator gives you a long list of APNs that you can use?

[–] sva_ 2 days ago

No, you have to manually enter it, and it isn't well known

[–] hod6654 2 days ago

How did you find out? And how long is the list of working APNs?

[–] walrus01 3 days ago

You're almost certainly behind a cgnat shared with a bunch of compromised/residential proxy running phones and other traffic.

[–] cowlevel 3 days ago

Or ones who are running it knowingly to make money. Can that even be called a compromise?

[–] ofcrpls 3 days ago

You might just be experiencing T-Mobile's CGNAT on mobile broadband?

[–] cannonpalms 3 days ago

T-Mobile esp. their 5G network is behind CGNAT

[–] jimz 3 days ago

And of course everyone downstream like Google Fi are carried with it.