<story><title>Mastercard and Visa Start Banning VPN Providers</title><url>http://torrentfreak.com/mastercard-and-visa-start-banning-vpn-providers-130703/</url></story><parent_chain><item><author>dangrossman</author><text>Keep in mind that this is about chargeback risk, not implementing some secret government policy. &amp;quot;Anonymizing VPNs&amp;quot; are a high risk service -- the people signing up for them are more often &amp;quot;bad guys&amp;quot; than tech professionals looking for privacy -- and they&amp;#x27;re signing up with stolen payment information. There are far more hackers, crackers, carders, &amp;quot;script kiddies&amp;quot;, spammers and other people that need to hide their location or appear to be connecting from a different country than there are IT professionals interested in paying for extra privacy.&lt;p&gt;Adult sites, online pharmacies, ticket brokers are treated the same way, and that has nothing to do with evading the NSA. MasterCard added all internet services (the MCC -- merchant category code -- that covers ISPs) to a high risk tier earlier in the year; I got the letter from First Data in the mail myself.</text></item></parent_chain><comment><author>fingerprinter</author><text>&amp;gt; Keep in mind that this is about chargeback risk,&lt;p&gt;First, I do not think this is about chargebacks, at all. I don&amp;#x27;t know what it is about, but it&amp;#x27;s not chargebacks. This looks like a blanket revocation of anonymizing&amp;#x2F;VPN services. That isn&amp;#x27;t how fraud&amp;#x2F;risk engines work (note: I wrote several fraud&amp;#x2F;risk engines for ecommerce&amp;#x2F;banking&amp;#x2F;travel industry as well as passive device fingerprinting).&lt;p&gt;Sure, make this a riskier transaction, flag it for review. Uh oh, CC info is from Ohio,  but IP is from Russia? Up the risk. Same device that is trying to conduct this transaction also tried 30 others in the past two days? Flag for review, up the risk (several hundred more etc etc).&lt;p&gt;Second, I can&amp;#x27;t think of a single thing that is legal to buy that is blanket revoked by some company like this.&lt;p&gt;Third, adult sites, online pharmacies, ticket brokers and the others are NOT treated the same way. They are treated as higher risk transactions that A. need more&amp;#x2F;closer review B. have a more comprehensive&amp;#x2F;exhaustive&amp;#x2F;deeper risk rules engine run on them. and&amp;#x2F;or C. have a special set of rules that apply specifically to that domain. The CC companies don&amp;#x27;t just turn off buying an entire domain of goods (adult, online pharmacies, ticket brokers....or VPNs), that isn&amp;#x27;t how they work.&lt;p&gt;If true, this smells of something different.</text></comment>
<story><title>Mastercard and Visa Start Banning VPN Providers</title><url>http://torrentfreak.com/mastercard-and-visa-start-banning-vpn-providers-130703/</url></story><parent_chain><item><author>dangrossman</author><text>Keep in mind that this is about chargeback risk, not implementing some secret government policy. &amp;quot;Anonymizing VPNs&amp;quot; are a high risk service -- the people signing up for them are more often &amp;quot;bad guys&amp;quot; than tech professionals looking for privacy -- and they&amp;#x27;re signing up with stolen payment information. There are far more hackers, crackers, carders, &amp;quot;script kiddies&amp;quot;, spammers and other people that need to hide their location or appear to be connecting from a different country than there are IT professionals interested in paying for extra privacy.&lt;p&gt;Adult sites, online pharmacies, ticket brokers are treated the same way, and that has nothing to do with evading the NSA. MasterCard added all internet services (the MCC -- merchant category code -- that covers ISPs) to a high risk tier earlier in the year; I got the letter from First Data in the mail myself.</text></item></parent_chain><comment><author>jnbiche</author><text>I&amp;#x27;m pretty dismayed to read this.  If you regularly connect to random wireless networks in cafes and hotels, you&amp;#x27;re a moron if you don&amp;#x27;t connect through a VPN.  If you&amp;#x27;re not connecting through a VPN all your non-SSL&amp;#x2F;TLS traffic is available for reading for whatever bored cracker has found his way onto the router. Plus, not all sensitive sites implement SSL&amp;#x2F;TLS and those that do often implement it poorly[1].  .&lt;p&gt;Not to even speak of the whole NSA spying thing.&lt;p&gt;Not all of us are corporate drones with the mother ship VPN to connect to, so we have to pay for ours.&lt;p&gt;I can&amp;#x27;t believe the number of people here on HN who think that no one but criminals use VPNs.&lt;p&gt;1.  &lt;a href=&quot;http://arstechnica.com/business/2012/04/90-of-popular-ssl-sites-vulnerable-to-exploits-researchers-find/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;business&amp;#x2F;2012&amp;#x2F;04&amp;#x2F;90-of-popular-ssl-si...&lt;/a&gt;</text></comment>