Until Comcast blocks VPNs, because why wouldn't they?

Because Comcast at their heart is a good company who has the best interest of their customer in mind in everything they do.

Well, worst case, we turn to massive hard drives, darknets and sneakernet, like Cuba.

Suppose the VPN is on port 443, 465, 993, or 995. Would the ISP be able to tell that it is a VPN and not an HTTPS, SMTP, IMAP, or POP server?

It's hard but possible. China manages to detect VPN's with their great firewall and cut a VPN connection to outside countries fairly fast.

You basically need to look at traffic patterns. A TLS handshake (HTTPS) is very distinct from a typical VPN handshake (except maybe OpenVPN since it uses TLS)

Or they can just block/throttle IP's of VPN providers. Not a lot of people can set up their own VPN server.

Even OpenVPN seems to be detectable, there's a provider that suggests running it over an extra TLS tunnel[1]. The overhead must be terrible, though.

[1] https://airvpn.org/ssl/

Ports are not enough, they can inspect packets. I believe most VPN protocols can be detected, although you could probably adapt one (possibly OpenVPN, which can already use TLS) to look like a regular HTTPS or IMAPS connection (assuming they don't analyze the patterns of traffic).

There's still the possibility of blocking commercial VPN services by their IP addresses, making it harder for anyone who can't host one themselves on a VPS or something.

VPNs can and will adapt, they're only detectable if they behave a certain way, last article i read a while ago openvpn was generally being detected by the way it did the handshake.

but yeah, the only permanent way to block VPNs is to get rid of encrypted traffic, otherwise they're going to be in a running battle of updating their detection methods and vpn providers obfuscating their protocol

Yeah, I wasn't clear. I meant running the VPN on a TLS connection to those ports, so that it looks like an HTTPS or IMAPS or whatever connection.

I suspect that the direction the web has been moving for the last few years is making traffic analysis harder. More and more things that used to only done locally with desktop applications are now also being done over the web, and so we now have many more traffic patterns that are not unusual for an HTTPS connection. That means more and more chance that some non-web traffic pattern will be similar to a web traffic pattern.

The problem ISPs face if they try to block things is that what they want to block will be specific sites, not specific protocols or specific types of use. For example, an ISP might want to block or slow subscription video streaming services other than one that it owns, but it probably does not want to block video from news sites, sports sites, company tech support sites, and many others.

If they just go by detecting that a site has video, perhaps by traffic analysis, they won't be able to tell which are the ones they want to block and which they don't.

As far as IP addresses go, perhaps IPv6 could help. Most of the major sites that support net neutrality have way more IPv6 addresses than they will ever use. Perhaps some of them could get together and offer a service where they run a VPN forwarding service on some of those IP addresses. So when Alice signs up for VPN service from Bob's Budget VPNs, she also goes to her Google account configuration, and enables Google's VPN forwarder and points it to Bob's Budget VPNs. Google dedicates an IPv6 address to this and tells it to Alice.

Actually, if major sites like Google wanted to provide a VPN forwarding service, they could just run it on the same addresses as their other services and provide a way for clients to signal they want to use the connection for VPN forwarding instead of whatever it is normally used for. For example, make it so you can start the VPN forwarder via HTTPS by having their HTTP server recognize "GET /vpn_forward HTTP/1.0" as meaning the client wants to use the VPN forwarding service, not the web service.

China could get away with blocking all of Google (and any other major site that might also do this) because China is an authoritarian government that takes a hands on approach to censoring and restricting what people there can see, and can bring its major propaganda machine to bear to trying to convince people that its approved alternatives are better.

I don't think that would work for private ISPs in the US.

How do you just "block VPNs"? Corporations need them don't they?

Buy the Business & Work VPN Package for just 5,99$/m so even you can connect to your workplace remotely without having to worry about your datacap!!!

Back when Verizon introduced data plans, it was called "Business email and internet access" or some such, and it cost $30.

This is a great way for ISPs to milk legitimate VPN traffic _and_ tax downloaders.

You mean, ala Great Firewall? I can't imagine that happening, but who knows.