Thinking about this a bit more. I was wondering, what if we used an alternate service port not in use by the portal that is likely unblocked on many networks, such as POP3 (TCP port 110). The problem with using 'priviledged' ports in this way is that networks that have content-aware firewalls might start blocking traffic when they see something in the traffic that they don't recognise. Moving connection tunnels to these ports could potentially cause problems for more people than just networks that block connections to non-priviledged ports.
TCP 443 might work in most cases, as firewalls are usually forced to ignore the packet contents as they are typically encrypted anyway. As we look at scaling our tunnelling system to support more connections (another frequent OnPlus user request) and possibly make this kind of change, we'll have to do some extensive testing around the many types of content-aware firewalls to see how they react.
Trying to think of non-priviledged TCP ports (1024+) that might be more likely to be open on public networks for encrypted traffic. there are some networks that *do* black-list things like typical instant messenger or VoIP ports, but allow connections through on all other ports. I think we originally chose the range in use today out of consideration for this issue.
-mike
