That should give some hint about how difficult it is to do in real life, at scale.

Downsides: Cross origin tracking.

Comments URL: https://news.ycombinator.com/item?id=49931448

Points: 2

# Comments: 0

I think even the _threat_ that the 'job applicant' is a cop seems like it would deter this behavior in a non negligible way. /shrug

Putting it out in the universe...

Comments URL: https://news.ycombinator.com/item?id=49805648

Points: 2

# Comments: 1

Dialects and syntax are weirdly fascinating .

Comments URL: https://news.ycombinator.com/item?id=49775614

Points: 3

# Comments: 1

Obviously, this would be a SAAS -I wouldn't want webmaster at jocokfuel.com or whatever having to roll their own rust stun server and make TCP RTT measurements :-)

Spun up a quick and dirty demo at https://proxy.kyc.red

More detailed description is in there.

I just ran some proxied sessions through your demo - really impressive! FWIW, make the "BLOCKED" text bright red and bold - success/accepted green.

Would love to chat more about what you're doing and how you're doing it.

I'm justin at wolcott dot io

:salute

Most residential proxy providers that I've seen don't support UDP. UDP is what WebRTC uses and has been part of the browser's "core" since 2021. If someone says they're on Chrom(), FireFox, Safari - they have it.

So the setup goes like this:

1) Create a subdomain to get the client's TCP ip address. You can force it to ipv4 by not giving it an AAAA record. This will make future-comparison easier.

2) Create a subdomain to get the client's UDP ip address. Ditto the quad-a bit. You'll want to run your own STUN server (are you there, Claude? Its me, Justin...). To make it tamper resistant, I have the STUN server encrypt the ipv4 address and some other stuff and return it as an ipv6 ice candidate. Its abuse, but it works and I don't have to worry about back-end-server communication bottle necking anything. Just catch, encrypt, return.

And the algorithm looks like this:

** YOU HAVE A TCP AND UDP IP ADDRESS ***

1) If both IP Addresses are the same - probably not a residential proxy

2) If both IP Addresses are different but on the same ASN and in the same .../24(?) - they're on a cell network

3) If the IP Addresses are on different ASNs - that's a MAJOR red flag. Most people who use residential proxies have it drilled into their head - TURN OFF WebRTC. This leaked bad in the mid 2010's and people are still terrified of it.

4) If one of the Addresses is on Cisco Web Umbrella or zScaler - and other is residential - they're behind a corporate protection firewall. Not really a proxy per se, but it'll trip this algorithm. Based on your threat model, they're probably ok to whitelist.

*** YOU __ONLY__ HAVE TCP IP ***

So this is the "one weird trick" / secret sauce / whatever that makes this work. TLS-duration / TCP-rtt > 3.0

* "Many residential proxies split the connection at the exit: the origin’s TCP socket ends there, so Linux TCP_INFO estimates only origin <=> exit RTT. The exit forwards TLS handshake bytes to the true client, making ClientHello handshake-complete include the hidden proxy chain. An unusually high TLS-duration/TCP-RTT ratio exposes that split." *

This is really all we need. From here, we just do the following:

TCP == UDP === not proxy

TCP ~= UDP === if on same ASN, not proxy

TCP != UDP === proxy or zScaler-thing. Whitelist to suit.

No UDP and TLS/TCP RTT Ratio < 3 === probably not a proxy (lower is better here)

No UDP and TLS/TCP RTT > 3 === probably a proxy (most I've seen float between 6-12x)

I've worked with this thing for the last 6 months and have worked mainly with Soax, BrightData, and OxyLabs proxies. I also built my own ProxyDevice (android) and C2 - put it on my own network and it caught it.

This is extremely cool because this means you don't have to blacklist IP addresses (not like it works) since a legitimate user and a proxy will come from the same IP - the proxy client will look _very_ different. They get blocked by NetAcuity/MaxMind/StaticList - the entire IP is killed. This is surgical.

This probably isn't perfect, but based on my limited experience its spooky accurate. I won't claim its 100% accurate for all cases everywhere but if its better than nothing - by definition its better than nothing - and that helps. Which, at the end of the day is all I want to do with this - help.

p.s. more than happy to share what I've built. Test, evidence, code, whatever. Just let me know.

Comments URL: https://news.ycombinator.com/item?id=49668557

Points: 4

# Comments: 2

Remote: preferred

Willing to relocate: No

Technologies: TypeScript/JavaScript, Node.js, AWS, Cloudflare Workers, distributed systems, high-scale data pipelines, fraud/security

Senior technical lead specializing in ambiguous, high-scale systems. I turn messy security, infrastructure, and data problems into pragmatic production systems—recently cutting cloud costs by $200K+/year. Seeking senior/staff engineering or technical leadership roles with real ownership.

LinkedIn: https://www.linkedin.com/in/justinwwolcott

Email: justin@wolcott.io

If you're needing to give the model direct and broad access to your SqlServer instance...I don't get it.

Dedicated customer facing API is like whitelisting approved actions; MCP feels like getting an LLM to enforce a complex blacklist.

You could even repurpose the MCP so you only ever produce the API documentation as EVERY response. No LLM necessary.

Comments URL: https://news.ycombinator.com/item?id=49488654

Points: 12

# Comments: 18

Sam Neil - Gone. Sean Connery - Gone. Tim Curry - (now)Gone.

All the big names from my childhood are starting to die... Damn.

Plus, I can verify for employers that I am a real human with a real employment history snd I can prove it...by giving them my SSN and Mother's Maiden name? What stops a bad guy from speed rushing the dark web, registering these things en masse and selling access to DPRK?

IP Blacklists, no matter how good can't stop this. You have to start using stats or deep-diving telemetry.

https://darknetdiaries.com/episode/172/

You take IP down, you kill the cancer but you also end up killing the patient.

So far, its pretty successful detecting SOAX, BrightData, and a custom proxy app I built for my phone - but I have a pretty limited sample size.

Give it a spin!

* https://github.com/JWally/sofa-king-bad-box

* https://github.com/JWally/sofa-king-bad-box-android

Comments URL: https://news.ycombinator.com/item?id=49227962

Points: 1

# Comments: 2