4 ms·

The UK is gonna realize real quick they can't just ban their way out of the mess they have created. Most VPN providers are going to be outside their jurisdictio

The UK is gonna realize real quick they can't just ban their way out of the mess they have created. Most VPN providers are going to be outside their jurisdiction and players like Mullvad will have no way to actually comply because of the way their VPN's are setup. The only step the UK can take is to force ISP's to block these VPN's which will kick off a cat and mouse game and for the reasonable technical, getting around any VPN ban will be as easy as spinning up an EC2 outside the UK.

gjsman-1000 1y ago
It's not quite that hard. Hypothetically, you have a digital certificate, signed by the government, for your VPN provider with a list of VPN endpoints. Your client presents that certificate to the ISP, unblocking ports in that specific instance, to those endpoints. Otherwise, all common ports are blocked, and anything that smells VPN-y gets throttled. Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed. Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?
- aaomidi 1y ago
  When VPNs design to hide themselves, which they will do as this law spreads, this problem becomes a lot harder. Countries like Iran and China have been trying to block VPNs for years, and all they are doing now is heuristics. For example I can tunnel traffic over a TLS tunnel. How do you distinguish that with everything else?
  - gjsman-1000 1y ago
    Heuristics again. 99% of your traffic is going to one endpoint... and it's hundreds of gigabytes, both up and down. Obvious red flag. Even an automated system could throttle it.
    - hedora 1y ago
      That step of the cat and mouse game is over a decade obsolete. If I spent a week setting up a VPN provider, I’d start with this: 99% is spread across 100 endpoints, 55% are cloudflare, and 45% are amazon/azure/google. A special client mode would check for non-blocked IPs in your country and have those bypass the VPN.
      - gjsman-1000 1y ago
        The government doesn't care... because no 16 year old is doing that or can afford that. And if one VPN provider did that, that specific VPN provider can have all their endpoints manually blocked by the government. In which case, the objection is irrelevant. Also, heuristics again: 99%+ of your traffic is going to the same two or three companies only. The owners of the endpoints are not very diverse, which is statistically extremely unlikely. Throttle you to 0.5mbps, so you won't be watching anything, and call it a day.
        joquarky 1y ago
        None of this does anything to mitigate people from trading flash drives with their peers. This is all political theater to bootstrap censorship.
        aaomidi 1y ago
        16 year olds are in fact doing this.
- hedora 1y ago
  Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless. They could start whitelisting money / credit card transfers, I guess. However, reputable VPN providers already accept envelopes full of cash and crypto, so I guess the UK would need to start reading all international mail, and block crypto. At that point, people could just use tor to bootstrap the VPN account + payments. History says teenagers will figure this stuff out before adults (due to infinite free time and infinite bragging rights for knowing how to do it).
  - gjsman-1000 1y ago
    > Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless. Did you miss the part where every VPN port is blocked, and all other ports have heuristics in place to detect and throttle VPN-like patterns (e.g. 99%+ of traffic going to less endpoints than you can count on one hand), unless you're specifically whitelisted?
    - out_of_protocol 1y ago
      > Did you miss the part where every VPN port is blocked Many protocols can use https ports and packet envelope. Also, there's special censorship resistant VPN protocols, which work even in China despite its nigh-infinity money to block it via DPI
    - joquarky 1y ago
      You've never been on a red team.
- _fat_santa 1y ago
  > The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it? Speaking from personal experience, never underestimate a bored 16 year old with access to YouTube and a generous AWS free tier.
  - gjsman-1000 1y ago
    Considering Gen Z is one of the least tech-savvy generations right now, even less tech-savvy than Boomers, and unable to use anything that isn't an app; yes, I don't think it's possible to underestimate them.
    - general1726 1y ago
      A man can tear down mountains for a pussy. After these bans UK Gen Alpha and Gen Z are going to be the most skilled hackers in Western world.
      - Der_Einzige 1y ago
        Yes, the most incel/prudish generation in history is going to suddenly turn into l33t hackers? The anglo mind loves to be subjugated. They are the ultimate bootlickers.
      - LargoLasskhyfv 1y ago
        ...most skilled wankers, you meant to say?
- drcongo 1y ago
  As a dad of teenagers, I can confidently tell you every single school will quickly have at least one enterprising kid who will set up wireguard on an Oracle free tier box and charge other kids to use it. The government is essentially incentivising kids to dip their toes into criminality.
gruez 1y ago
>The only step the UK can take is to force ISP's to block these VPN's which will kick off a cat and mouse game and for the reasonable technical, getting around any VPN ban will be as easy as spinning up an EC2 outside the UK. They can make it very difficult if they want, just look at China[1]. It's not impossible to get around, but it's not as easy as buying a random VPS, and following a tutorial for openvpn/wireguard. [1] https://www.usenix.org/conference/usenixsecurity23/presentation/wu-mingshi https://www.usenix.org/conference/usenixsecurity23/presentat...
- _fat_santa 1y ago
  Personally I don't think China is a good comparison in this case. Yes China has the great firewall but they also a highly top-down government whereas the UK us much more like the US. Beyond straight government control, there's also the politics of all of it. China being a one party system doesn't really care if something is popular with the public but with the UK's parliamentary system, one wrong move and your party gets voted out of power.
  - gruez 1y ago
    >Beyond straight government control, there's also the politics of all of it. China being a one party system doesn't really care if something is popular with the public but with the UK's parliamentary system, one wrong move and your party gets voted out of power. But apparently that wasn't enough to stop the online safety act from being implemented in the first place? If voters okay with sites requiring intrusive id/face scans to access 18+ sites, they're probably also fine with ISPs requiring 18+ verification to use VPNs.
duxup 1y ago
They can't just ban their way out. However, even if politicians / clueless administrators acknowledged their actions aren't doing much I don't see those people / groups reaching for any other tool other than "let's ban / legislate more". There's no going back for some folks who are so clueless.
immibis 1y ago
One of their politicians did comment, in Parliament, that it was going to make the UK be China.
GeoAtreides 1y ago
sure they can, the gov only has to ban payments processing from uk clients
- paffdragon 1y ago
  some providers accept crypto or even cash in an envelope

gjsman-1000 1y ago

It's not quite that hard. Hypothetically, you have a digital certificate, signed by the government, for your VPN provider with a list of VPN endpoints. Your client presents that certificate to the ISP, unblocking ports in that specific instance, to those endpoints. Otherwise, all common ports are blocked, and anything that smells VPN-y gets throttled. Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed. Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?

aaomidi 1y ago
When VPNs design to hide themselves, which they will do as this law spreads, this problem becomes a lot harder. Countries like Iran and China have been trying to block VPNs for years, and all they are doing now is heuristics. For example I can tunnel traffic over a TLS tunnel. How do you distinguish that with everything else?
- gjsman-1000 1y ago
  Heuristics again. 99% of your traffic is going to one endpoint... and it's hundreds of gigabytes, both up and down. Obvious red flag. Even an automated system could throttle it.
  - hedora 1y ago
    That step of the cat and mouse game is over a decade obsolete. If I spent a week setting up a VPN provider, I’d start with this: 99% is spread across 100 endpoints, 55% are cloudflare, and 45% are amazon/azure/google. A special client mode would check for non-blocked IPs in your country and have those bypass the VPN.
    - gjsman-1000 1y ago
      The government doesn't care... because no 16 year old is doing that or can afford that. And if one VPN provider did that, that specific VPN provider can have all their endpoints manually blocked by the government. In which case, the objection is irrelevant. Also, heuristics again: 99%+ of your traffic is going to the same two or three companies only. The owners of the endpoints are not very diverse, which is statistically extremely unlikely. Throttle you to 0.5mbps, so you won't be watching anything, and call it a day.
      - joquarky 1y ago
        None of this does anything to mitigate people from trading flash drives with their peers. This is all political theater to bootstrap censorship.
      - aaomidi 1y ago
        16 year olds are in fact doing this.
hedora 1y ago
Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless. They could start whitelisting money / credit card transfers, I guess. However, reputable VPN providers already accept envelopes full of cash and crypto, so I guess the UK would need to start reading all international mail, and block crypto. At that point, people could just use tor to bootstrap the VPN account + payments. History says teenagers will figure this stuff out before adults (due to infinite free time and infinite bragging rights for knowing how to do it).
- gjsman-1000 1y ago
  > Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless. Did you miss the part where every VPN port is blocked, and all other ports have heuristics in place to detect and throttle VPN-like patterns (e.g. 99%+ of traffic going to less endpoints than you can count on one hand), unless you're specifically whitelisted?
  - out_of_protocol 1y ago
    > Did you miss the part where every VPN port is blocked Many protocols can use https ports and packet envelope. Also, there's special censorship resistant VPN protocols, which work even in China despite its nigh-infinity money to block it via DPI
  - joquarky 1y ago
    You've never been on a red team.
_fat_santa 1y ago
> The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it? Speaking from personal experience, never underestimate a bored 16 year old with access to YouTube and a generous AWS free tier.
- gjsman-1000 1y ago
  Considering Gen Z is one of the least tech-savvy generations right now, even less tech-savvy than Boomers, and unable to use anything that isn't an app; yes, I don't think it's possible to underestimate them.
  - general1726 1y ago
    A man can tear down mountains for a pussy. After these bans UK Gen Alpha and Gen Z are going to be the most skilled hackers in Western world.
    - Der_Einzige 1y ago
      Yes, the most incel/prudish generation in history is going to suddenly turn into l33t hackers? The anglo mind loves to be subjugated. They are the ultimate bootlickers.
    - LargoLasskhyfv 1y ago
      ...most skilled wankers, you meant to say?
drcongo 1y ago
As a dad of teenagers, I can confidently tell you every single school will quickly have at least one enterprising kid who will set up wireguard on an Oracle free tier box and charge other kids to use it. The government is essentially incentivising kids to dip their toes into criminality.

gruez 1y ago

>The only step the UK can take is to force ISP's to block these VPN's which will kick off a cat and mouse game and for the reasonable technical, getting around any VPN ban will be as easy as spinning up an EC2 outside the UK. They can make it very difficult if they want, just look at China[1]. It's not impossible to get around, but it's not as easy as buying a random VPS, and following a tutorial for openvpn/wireguard. [1] https://www.usenix.org/conference/usenixsecurity23/presentation/wu-mingshi https://www.usenix.org/conference/usenixsecurity23/presentat...

_fat_santa 1y ago
Personally I don't think China is a good comparison in this case. Yes China has the great firewall but they also a highly top-down government whereas the UK us much more like the US. Beyond straight government control, there's also the politics of all of it. China being a one party system doesn't really care if something is popular with the public but with the UK's parliamentary system, one wrong move and your party gets voted out of power.
- gruez 1y ago
  >Beyond straight government control, there's also the politics of all of it. China being a one party system doesn't really care if something is popular with the public but with the UK's parliamentary system, one wrong move and your party gets voted out of power. But apparently that wasn't enough to stop the online safety act from being implemented in the first place? If voters okay with sites requiring intrusive id/face scans to access 18+ sites, they're probably also fine with ISPs requiring 18+ verification to use VPNs.

duxup 1y ago

They can't just ban their way out. However, even if politicians / clueless administrators acknowledged their actions aren't doing much I don't see those people / groups reaching for any other tool other than "let's ban / legislate more". There's no going back for some folks who are so clueless.

immibis 1y ago

One of their politicians did comment, in Parliament, that it was going to make the UK be China.

GeoAtreides 1y ago

sure they can, the gov only has to ban payments processing from uk clients

paffdragon 1y ago
some providers accept crypto or even cash in an envelope