3 ms·
"Here's what happens if VPNs get blocked: everyone has to verify their age by submitting government IDs, biometric data, or credit card information directly to
by 1vuio0pswjnm7 1y ago
"Here's what happens if VPNs get blocked: everyone has to verify their age by submitting government IDs, biometric data, or credit card information directly to websites-without any encryption or privacy protection.
We already know how this story ends. Companies get hacked. Data gets breached. And suddenly your real name is attached to the websites you visited, stored in some poorly-secured database waiting for the inevitable leak. This has already happened, and is not a matter of if but when. And when it does, the repercussions will be huge."
Then
"Let's say Wisconsin somehow manages to pass this law. Here's what will actually happen:
People who want to bypass it will use non-commercial VPNs, open proxies, or cheap virtual private servers that the law doesn't cover. They'll find workarounds within hours. The internet always routes around censorship."
Even in a fantasy world where every website successfully blocked all commercial VPNs, people would just make their own. You can route traffic through cloud services like AWS or DigitalOcean, tunnel through someone else's home internet connection, use open proxies, or spin up a cheap server for less than a dollar."
EFF presents two versions of "here's what will happen"
If we accept both as true then it appears a law targeting commercial VPNs would create evolutionary pressure to DIY rather than delegate VPN facility to commercial third parties. Non-commercial first party VPNs only service the person who sets them up. If that person is engaged in criminal activity, they can be targeted by legislation and enforcement specifically. Prosecution of criminals should not affect other first party VPNs set up by law-abiding internet users
Delegation of running VPNs to commercial third parties carries risks. Aside from obvious "trust" issues, reliability concerns, mandatory data collection, potential data breach, and so on, when the commercial provider services criminals, that's a risk to everyone else using the service
This is what's going on with so-called "Chat Control". Commercial third parties are knowingly servicing criminals. The service is used to facilitate the crime. The third parties will not or cannot identify the criminals. As a result, governments seek to compel the third party to do so through legislation. Every other user of the service may be affected as a result
Compare this with a first party VPN set up and used by a single person. If that person engages in criminal activity, other first party VPNs are unaffected
EFF does not speculate that third parties such AWS, DigitalOcean, or "cheap server[s] for less than a dollar" will be targeted with legislation in their second "here's what will happen" scenario
Evolutionary pressure toward DIY might be bad news for commercial third party intermediaries^1
But not necessarily for DIY internet users
1. Those third parties that profit from non-DIY users may invoke the plight of those non-DIY users^2 when arguing against VPN legislation or "Chat Control" but it's the third parties that stand to lose the most. DIY users are not subject to legislation that targets third party VPNs or third party chat services
2. Like OpenAI invoking the plight of ChapGPT users when faced with discovery demands in copyright litigation
- scrps 1y agoPreexisting solutions to future problems! Thanks to AI (mostly) botnets specifically for renting residential IPs have multiplied since most commercial VPN IP blocks get rate-limited, captcha'd, outright blocked which got even worse with AI. People causing shenanigans using residential IPs if they ban VPNs is gonna lead to a lot of kicked doors, red herrings, lawsuits, and very probably ballooning budgets and will yet again fail to stop Bad Things™ not that it was really designed to anyway. I wonder if they think this is a good idea because they have machinations or is it just that they are clueless wealthy dinosaurs corrupting a future that isn't theirs?
- deleted 1y ago[deleted]
- 1vuio0pswjnm7 1y agoCommercial third parties intermediating use of the web don't solve problems of "privacy" They might interfere with the businesses of other third party intermediaries like "Big Tech" Paying the middleman (intermediary) might in theory discourage it from conducting commercial surveillance but it doesn't solve the problem presented by using third parties as middlemen The possibility to profit from surveillance remains An effective solution would remove the possibility, and thereby the incentive, by removing the third party
- deleted 1y ago[deleted]
- 1vuio0pswjnm7 1y agoIt appears the bill would exempt AWS, DigitalOcean and "cheap server(s) for less than dollar" "(b) No Internet service provider or its affiliates or subsidiaries, search engine, or cloud service provider shall be held to have violated sub. (2) on the basis of the entity having provided access or connection to or from a website, content on the Internet, or a facility, system, or network not under that entitys control, or the entitys provision of communicating, transmitting, downloading, intermediate storage of, providing access software for, or other services that communicate ... (c) No Internet service provider or its affiliates or subsidiaries, search engine, or cloud service provider shall be held to have violated sub. (3) on the basis of the entity having provided access or connection to or from a website, content on the Internet, or a facility, system, or network not under that entitys control, or the entitys provision of communicating, transmitting, downloading, intermediate storage of, providing access software for, or other services that communicate ..." The bill restricts "persons" from knowingly retaining identifying information on users. This is some peculiar wording maybe trying to allow for some loophole where automated retention of information is exempted "Under the bill, persons that perform reasonable age verification methods may not knowingly retain identifying information of the individual attempting to access the website after the individuals access has been granted or denied" "(b) A person that performs a reasonable age verification method in compliance with par. (a) may not knowingly retain identifying information of the individual attempting to access the website after the individuals access has been granted or denied." The EFF title is inaccurate The bill does not "ban" VPNs It does not create illegality It creates potential civil liability for certain businesses, and only if and when someone sues and wins