1y ago

Please stop blocking VPNs for established accounts

I often use a commercial VPN service, which I suspect is not rare among Lemmy users. Most of the time, I'm able to post to lemmy.world, but on occasion I am not. The default web UI provides zero feedback, just a spinning submit button forever, but if I look in the browser dev tools, I can see it's being blocked.

I understand that some limitations are necessary to prevent spam and other abuse, however this is a very blunt instrument. The fact that I have a 10 month old account with consistent activity should outweigh any IP address reputation issues.

Perhaps the VPN limitations could be narrowed in scope to cover only account creation and posts from young accounts.

8 comments

I've always wondered why Google makes me jump though hoops when I'm tunneled through my VPN. I'm logged in to Google for chrissakes, that should be all the difference in both of these situations.
- There's some very good reasons:
  VPN traffic could be masking an attack on the account
  By using a VPN, they lose a degree of certainty that it's you, they can't use the IP address as a factor to establish the probability it's actually you
  Differentiating you as a person, from other people with the same source address, perhaps who are behaving poorly, or who've implemented robots to do things Google doesn't like.
  I fully believe VPNs should be a fundamental right on the internet, nobody should have to identify themselves by IP address to use the internet. But from an account security perspective alone there's a good reason to be extra super duper sure of somebody before allowing them to log in
Hello @Zak@lemmy.world ,
we understand your frustration, but lemmy doesnt give us any alternative to that, as we cant block posts/comments from younger accounts easily.
The issues with the UI, that it doesnt give any real feedback is, sadly an issue with the LemmyUI, but it will be probably improved in the future.
We are looking into better alternatives to that, but until then we sadly have to stay on our current path.
We will be of course announcing if we found an alternative to that.
- "As we cant block posts/comments from younger accounts easily."
  OP " scope to cover only account creation and posts from young accounts."
  Wait... so yall automatically do this to all new accounts even if they're legitimate? Just because they're new ?
  So basically, that means non of their posts or comments show anywhere, they just think everyone can see their stuff, but have no idea they're stuff is blocked bc their account is new ?
  Kinda like reddit you can't post if you have zero or enough karma right ?
  Do y'all let them know that even ? Or is the goal here to keep them in the dark about it ?
  Or are you talking about just the ability for individual users to use the regular block feature against new accounts if they want to block them ?
  
  We activated that rule after the acute CSAM attacks, and many used vpns, and after we did this the CSAM posts dropped.
  Everybody in vpn is blocked to post comments or create posts. Not depending on account age.
  We are NOT a dark web service where everyone needs to be under tor, vpn, proxy, and back again. We are an public service.
  Please, imagine you are a instance hoster, you have either to choose csam ( and legal issues ) or users cant use VPNs.
- Reddit has been blocking VPN users (even on old reddit) for the past few months.
The fact that I have a 10 month old account with consistent activity should outweigh any IP address reputation issues.
I dont even know where to begin unpacking this flagrantly ridiculous sentence, but I’ll just say this is the same energy as the “devs are lazy” entitlement when popular video games suddenly acquire a cheater problem
- Proposing changes like this is how open source projects work.
  Account age and reputation metrics are a pretty good way to limit abuse because the supply of established accounts is limited, making them difficult to replace when they get banned.

8 comments