14 ms·
ThreeUK blocks access to encrypted provider Tutanota due to 'age restriction'
- roboben 4y agoHow do ISPs do a page in front of their service? Do they have a DNS blacklist, resolve to their servers first and then let the users pass when accepting? How is this acceptance working and persisted? And could you not circumvent this by either using another DNS provider?
- Semaphor 4y agoIt depends, but DNS lists are by far the most common, and you can indeed circumvent it by using another DNS server.
- Reason077 4y agoChanging DNS servers will not get around the UK ISP “adult content blocks” in my experience, but using a VPN will. Generally it’s a good idea to disable ISP content blocking if you can, because they can cause all kinds of problems (slowdowns, false positives).
- Semaphor 4y agoHow do they do that? IP Lists?
- AntoniusBlock 4y agoI can get around Sky Broadband's block on Libgen by just using Libgen's IP, for example.
- Varloom 4y agoEven with secure DNS, the SNI part is passed as plain text for the ISP to intercept and block.
- sidewndr46 4y agoWouldn't they just block outside DNS?
- denton-scratch 4y agoThey can't block a customer-premises recursive resolver. But the SNI is on the TCP connection, not the DNS request; if you have that sort of ISP, they can filter based on SNI.
- sidewndr46 4y agoWhy would the location of the DNS resolver matter? If I am running a local DNS resolver, presumably it recurses to an outside DNs server. If my ISP blocks that, I can't use it.
- denton-scratch 4y agoIt recurses to the root, and then down the tree. So yes - the final query is a lookup for the name you are targeting, and yes, it goes through your ISP, like all your other traffic. But it doesn't go through your ISPs DNS infrastructure, it goes direct to the nameserver for the parent domain. And even that doesn't happen if your local resolver has the result cached. The easiest way to block DNS lookups is at the DNS server; using DPI to block DNS lookups is straying into sledgehammer/nut territory.
- sidewndr46 4y agoYeah, but isn't that laughably easy to block such a scheme? If a packet is destined for port 53 that isn't the ISPs DNS server, poof it's gone!
- Nextgrid 4y agoOr just redirect any outbound port-53 traffic to the ISP's DNS which will pretend to be the server you're talking to while silently applying the filtering.
- TheCapeGreek 4y agoIn short (and from my own layman understanding as networking is not my strong suit) the packets still go through the ISP and can be analysed - data contents itself not as much with encryption, but they can still often figure out the destination.
- adders 4y agoMost mobile ISPs in the UK use Procera Networks (now Sandvine) products that do basic deep packet inspection to filter traffic. You can allocate users to pools and provide contectivity based on the pool, ie allowing you to limit speeds of high usage users or have different filtering lists like this under 18s list. With these devices you are able to block traffic to specific domains even if SSL is used with relative ease. As it is done at network level, you can't bypass via different DNS provider, only vpns can bypass
- Varloom 4y agoNothing can stop SNI sniffing & blocking except DNS with encrypted client hello. Which is taking forever to be standardized.
- benmmurphy 4y agoISPs in the UK mitm TLS connections and use SNI sniffing in order to block banned sites. You can see this is happening by either visiting a banned site and seeing the connection being reset after the client hello is sent or you can check the TCP SYN packet your client sends on 443 vs the TCP packet the server receives. Oddly enough on the O2 network they are not simply sniffing the packets on the wire but doing a full TCP proxy because the TCP syn packet has been heavily rewritten. For example when using an iPhone the order of the SYN flags is very different from Linux. the SYN packet the server receives will look like it came from Linux even though it originated from an iPhone. This is not what you would expect if they were just doing normal NAT.
- kaszanka 4y agoWhat do you mean by the order of the SYN flags?
- benmmurphy 4y agoI meant the order of the TCP options.
- sidewndr46 4y agoFor IPv4 the SYN flag is a single bit in the packet at a fixed location. So to say the 'order' is 'very different' does not make any sense.
- benmmurphy 4y agoI misdescribed how you can detect the OS from the TCP packet with the SYN flag set. The order of the TCP options is often different between different OSs.
- jonas-w 4y agoWouldn't you need to trust their certificate?
- 10000truths 4y ago
- nibbleshifter 4y agoThey also block archive.org sometimes, among other things. You have to go into a 3 store to get adult content unlocked by presenting ID. It is extremely annoying.
- scrlk 4y agoI'm surprised they don't have the option to verify age via credit card (usually a 1p transaction that gets reversed).
- FreezingKeeper 4y agoThey do [0]. You can also do it in their app if you are on a contract and therefore over 18 by definition. [0] http://ask3.three.co.uk/srvs/cgi-bin/webisapi.dll/,/?new,kb=mobile,ts=mobile,t=casedoc.tem,case=obj(2468),varset_username=Mobile:mobileUser http://ask3.three.co.uk/srvs/cgi-bin/webisapi.dll/,/?new,kb=...
- lxgr 4y agoHow would having a credit card prove somebody‘s age?
- pmx 4y agoYou have to be 18 to get a credit card
- 4y ago
- throwaway378037 4y agoThree is also the worst network, switch as soon as you can
- colesantiago 4y agoIs there an open source phone network that one can switch to?
- deleted 4y ago[deleted]
- lzauz 4y agoWhat is an "open source phone network"? I've never heard of such thing existing.
- gumboza 4y agoWell you can get a ham radio license, spend $1500 on a basic radio and antenna and accessories, erect it in your garden, get on air and feel the joy of open communications all over the globe. Or more realistically get blasted by people on contests or doing DX, hear about numerous health problems and waltz into casual racism, homophobia and sexism. The last bastion is CW (morse) where it's too much effort to be an asshole.
- traceroute66 4y agoTL;DR No, no and absolutely not. Well established UK Wholesale operator Simwood had not one but TWO very good goes at establishing an independent low-level UK network (or at least as low-level as is possible, they wanted to become as close as was humanly possible to a full MNO). They ended up hitting obstacle after obstacle in the usual protection racket vicious circle between so-called regulator OFCOM and the incumbent operators. IIRC they encountered difficulties at every step, be it obtaining an independent allocation of mobile numbers or anything else. In the end, they threw in the towel on the mobile project because they refused to be "just another" MVNO reselling someone else's rebranded service.
- 4y ago
- colesantiago 4y agoI'm currently on 3 UK and considering switching, who should I switch to?
- scrlk 4y agoIMO it's dependent on your location as network performance can vary wildly. Might be worth getting a PAYG SIM from EE and Vodafone/O2 (they share networks) to test speed, signal strength etc. If you are on a contract I would wait until next April when the yearly inflaton price hikes are announced. FWIW I am paying Vodafone £7 pcm after cashback for 200 GB 5G data, unlimited minutes and texts.
- jonatron 4y agoPretty sure Vodafone and O2 are different. Maybe there's some sharing going on, but I've found Vodafone to be much better than O2.
- scrlk 4y agoSee: https://www.youtube.com/watch?v=KRDzWoNG0jo https://www.youtube.com/watch?v=KRDzWoNG0jo https://pedroc.co.uk/content/vodafone-o2-beacon-1-and-2 https://pedroc.co.uk/content/vodafone-o2-beacon-1-and-2 In London, the network sharing agreement was unwound due to capacity issues.
- alias_neo 4y agoWhat are your requirements? I'd suggest grabbing a pre-paid SIM from each of the major networks and see which gives you the best signal and speeds in the locations you frequent, but this may seem excessive to most. I signed up to a 2 year 5G deal with EE shortly before moving out of London, now the signal and speed are junk and I'm stuck in a 2 year deal. Given the absurd amount our "contracted" price increases by each year (my monthly payment went up ~15% on a SIM-only plan thanks to RPI or whatever excuse they use) I'd be tempted to go with someone like GiffGaff or similar next (they're an MVNO on O2 network) and just get monthly goody bags, then you can ditch them the minute you've had enough and want to get better service/signal/data etc.
- friend_and_foe 4y agoI want to see the shock on the faces of the people who support legislation like this for the sake of the children. Of course this was going to happen. If it gets enough blowback there will be a statement claiming this was a mistake. But people warned everyone, scope creep is real, if you allow governments to restrict access for one reason they'll use it to restrict access for any and every reason. This starts with pornography, then it will be anonymous services to get around the anonymity, eventually it will be "please verify your identity to access internet services".
- ChildOfChaos 4y agoCan't you just verify your age and be done? I don't see the issue, plenty of things end up being blocked, so it seems like this is just something you'd do anyway, it's no big deal.
- FpUser 4y ago>"plenty of things end up being blocked" So let's block even more and turn country into China
- glitchc 4y agoHow do you verify your age without showing some kind of ID?
- gambiting 4y agoUhm.....you don't? With my provider here in UK(GiffGaff) I had to send them the digits from my passport to have "adult" content unlocked on my sim, it's all blocked by default otherwise. There are several other types of ID you can use for this.
- ThePowerOfFuet 4y agoThe solution is to enable full-time VPN, not to provide your ISP with information they have no business collecting.
- Wildgoose 4y agoI had a Three SIM in my old chromebook for internet browsing while staying in hotels without free WiFi. It was blocking regular US news sites as "adult content". Supposedly you could enter your driving license number (which also encodes your date of birth) in order to get the restriction lifted. It never worked. I gave up using Three.
- Computeiful 4y agoThree is widely considered the worst mobile network in the UK. I think they have won #1 worst network for years in a row.
- comprev 4y agoUnfortunately the competition for last place is very tough. It's not a case of "who is the best" but rather "who is currently the least worst"
- alborzb 4y agoFor anyone who wants the source to this -- https://www.which.co.uk/news/article/virgin-media-and-three-named-worst-for-complaints-by-ofcom-aclJG6s1QaMe https://www.which.co.uk/news/article/virgin-media-and-three-... Three is named (joint) worst network in the UK by the official telecoms regulator (part of the UK government).
- sn0wleppard 4y agoI'm not surprised, back when I was using them at uni they turned off my mobile data without warning. Called them multiple times, no-one would tell me why. Went to a Three shop and they told me I'd been disconncted for "security" because I'd been away from the address on my account too long! Plus their broken app and abysmal coverage in London...
- gamjQZnHT53AMa 4y agoThree have always had a policy of age restricting things. I had to give them a copy of my passport years ago to be able to use tinder on my phone.
- daveoc64 4y agoSorry, I don't see the fuss here. It's widely known that UK ISPs and mobile networks put filtering in place by default. They did this to avoid the government passing a law to make it mandatory. This often blocks VPNs and sites that may or may not be used to access adult content. There is always a way to remove the block, typically with credit card/ID verification of some sort. Three might be blocking some things that other networks aren't, but I imagine you'll find the other networks block some things that Three doesn't.
- tommica 4y agoWait what? They added a system to filter traffic, to avoid having the government make it mandatory to have a system for filtering traffic? That seems silly.
- Nextgrid 4y agoThere are also PR reasons. The general public unfortunately believes that this is a good thing and is indeed "protecting" children. IMO it would've happened regardless of regulatory reasons.
- neopw 4y agoThis happens with regulations all the time. For example Apple allowing sideloading of apps on their phones in their own terms before the European regulators tell them how to do it
- bogle 4y agoNot all the ISPs kowtowed, Andrews and Arnold famously refused: https://support.aa.net.uk/Filtering https://support.aa.net.uk/Filtering
- daveoc64 4y agoThey did, but they're tiny so the government doesn't care about them.
- boomboomsubban 4y ago
- nmstoker 4y agoI nearly moved back to Three recently, but in the end opted not to, which seems lucky in light of this. This is somewhat similar to the reason I left them back in 2009. They were surreptitiously redirecting me to a different version of Hotmail by fiddling with DNS records. This in turn broke Hotmail on my early HTC phone (unless I was connecting over WiFi as that would bypass their bad DNS). It may be little better even now, but back in those dark days the prospect of getting support to recognise what this even meant was nigh on impossible - at the point of cancelling my contact to leave them as a supplier, they interjected that they could offer the same services at £4 a month (insanely cheap) which totally missed the point: what good is a service no matter how cheap, if it's fundamentally unusable! It's a shame, because in many other respects Three are one of the more differentiated suppliers here and they seem to offer more useful services with fewer gimmicks than the others in the UK.
- dncornholio 4y agoUK's internet seems to be broken to the core for a long while now. How come it came so far? People don't care? How come UK is so progressive in the censoring?
- switch007 4y agoWe’re very authoritarian in the sense of being submissive to power and liking parties that appear to be strong leaders, in England at least. We’re also greatly uneducated in critical thinking, so we’re easily swayed. Also very prudish. We love the party which advertises it’s tough on crime (emphasis on advertises) - the conservatives. They’ve been in power the majority of the time since WW2.
- Nextgrid 4y agoEvery government would like this, but I think the issue in the UK is that there's legitimately a lot of public support for "protecting" the children in a way that other countries don't have - so while every government would want this, UK succeeds where as most others don't (yet?) because commercial interests override it (this kind of filtering at scale is not cheap, so ISPs would rather not do it unless they are either forced to or get good PR from it).
- bennysonething 4y agoIs this just the opt out age restriction thing that all ISPs in the UK have? I don't agree with it, but it's not really censorship on the level that is being claimed
- vorpalhex 4y agoI think having to present ID to get access to encrypted tools is pretty dystopian. A big part of encryption is anonymity.
- Nextgrid 4y agoThere's no evidence to believe this block is intentional and designed to prevent access to encrypted services, as opposed to a false-positive from whatever provider they're buying the "adult domains" list. If it was an attempt to ban encryption they'd block much more.
- vorpalhex 4y agoThey're a reasonably well known email service. If this was accidentally ingested then we are bordering on negligence. I would worry about troublesome newspapers and protestor sites being "accidentally" included next.
- psychphysic 4y agoGlad I'm no longer with three! I'm with a carrier that runs on the Vodafone network. I can't log into my Vodafone settings to disable their parental locks. Luckily I use a VPN and their lock is more reasonable than Three apparently. But still a nuisance
- forthorbor 4y agoThis is the same nonsense that Apple does with their 18+ censor wall of any apps that can access the internet.
- valdiorn 4y agoI remember getting a three card and then not being able to access half the internet because I needed to verify my age. I went to the nearest branch and loudly proclaimed I was there to "to verify my age because I want to watch porn in my phone". Absolutely dumb policy - probably enforced by the govt.
- pja 4y agoYes, O2 has the same policy - they block a chunk of the internet unless you demonstrate that you’re over 18 & get the block lifted. I don’t know whether the government leant informally on the mobile providers to do this or whether it’s legally required for them to do so if they don’t know that a user is 18+.
- uni_baconcat 4y agoI do using a pay-as-you-go SIM card from three. They enabled adult content filter by default. The only way to disable it is have a chat with online customer service and submit your ID to prove you are an adult.
- alexiaa 4y agothe title is misleading, it makes it sound like tutanota had an age restriction and three blocked them because of that, but instead three put it behind an age gate.
- aurizon 4y agoAh the good old days, when 10 year olds had full time jobs in the 1800's UK factories and spent their wages on gin unless parents beat it out of them for their gin. So laws came, school until 14 in UK, later 16, same in usa etc. No liquor to kids under 21 or 18 as geography dictates. So the internet wants similar age rules for age 13 or other age adult stuff and it progresses to that end. We see nothing wrong with kids 'carded' at bars to make sure they are 18 or 21? If valid age rules are set, how do we enforce them? Are we just to allow fully unfettered access to anyone who can hit a key? Some kids are smarter at 13 than others at 21 - should we have a mental competence test? Should we apply that to voter rules in elections. Obviously young kids of 12 want to pass as 18 to enjoy the pr0n that 18 years olds access - do we lose by short circuiting maturation? Island cultures often schooled young boys/girls in sex by older opposite sex partners, which Columbus's sailors found delightful as they were inundated by nubile young women who gave sex for pins/needles/buttons - also VD was passed over in payment, both ways.
- Espionage724 4y agoI went to check my Tutanota email and found it was deleted. I haven’t logged into it maybe 2 years. They may have notices and warnings about this, but I’m not too confident in recommending them to others. Checked Protonmail which I made around the same time and also didn’t log into for about 2 years, and still had my account and emails. Same with that one meme email provider that starts with a C lol (I have a firemail.cc address), and I’m more surprised at them still being around and maintaining my account.