41 ms·

Ask HN: How many people got VPNs in response to laws like UK Online Safety Act?

98 points by hodgesrm 10mo ago

I was reading The Free Press (thefp.com) from London and an article was automatically blocked to ensure conformance with the UK Online Safety Act. I thought the site was broken. It took a few minutes to diagnose the problem. 15 minutes later I had Mullvad installed and was back online. Talk about unintended consequences. How many other people have done the same?

grumblepeet 10mo ago
I did despite being quite resistant to the idea at first. Eventually I didn't have a choice, as many things I wanted to read were suddenly hidden. I am paranoid however and worry that the VPN maker is tracking me, but there is only so much I can be paranoid about in the day.
- notsatan 10mo ago
  Why not get a remote server and tunnel your connection through it -- Tailscale, or Cloudflare, or even raw WireGuard if that's what you prefer. You'll basically have your own private VPN
  - pirates 10mo ago
    This is what I do, except into the UK so I can watch geo-blocked sports. Pure wireguard, nothing fancy. But that also means if anything were to go wrong or stop working I can just tear it down and set it up somewhere else.
- WithinReason 10mo ago
  Look up what kind of tracking UK ISPs are mandated to do by law and how easy it is to request that information. Your VPN can't possibly be worse than that.
petepete 10mo ago
I was trying to follow a tutorial the other day and couldn't because the embedded images were on Imgur and it was so frustrating. It was the straw that broke the camel's back. I caved, bought a 3 year PIA plan, had my router configured within about 2 minutes (actually impressed how straightforward Unifi made it) and now my browsing experience is fixed.
- secret-noun 10mo ago
  By putting it on your router, all your traffic is tunneled through the VPN, right? I ask this in comparison to applying it at a finer-grained level, such as just a particular machine, or to an application, or to even a browser tab or particular domain. I feel like I would never want all my traffic VPN-ed because it is slow, there are greater privacy concerns of VPN operators, and my needs for VPNs are a cleanly-separable small chunk of my online activities.
  - hodgesrm 10mo ago
    I'm planning to turn the VPN off when I don't need it. Mullvad is nice because you can just put money on the meter when you are traveling to locations that make it necessary.
  - 7bit 10mo ago
    Depending on the configuration it could be selective, I'm Ike routing only imgur through VPN.
  - petepete 10mo ago
    I used Policy Based Routing so only imgur.com/i.imgur.com are redirected, everything else is as it was before. https://help.ui.com/hc/en-us/articles/12566175125783-UniFi-Gateway-Policy-Based-Routing https://help.ui.com/hc/en-us/articles/12566175125783-UniFi-G...
    - zorked 10mo ago
      I use Unifi Policy Based Routing to watch a streaming service from my home country. It is so easy to setup and works so well.
DarkmSparks 10mo ago
Just used tor browser when I was back last week.
hodgesrm 10mo ago
I should mention that what pushed me over the edge was discovering that the FP problem was [among other things] triggered by a user comment that was then suppressed. However, it had a helpful message that I could solve the problem by uploading identification information to a website somewhere that I've never heard of. Given the rate at which those sites are hacked, that's basically the following, simple procedure: Step 1: Share your identifying information with the entire Internet.
delichon 10mo ago
I got one to bypass Arizona's internet ID law. It put a crimp in my watching of adult entertainment (for science). Although I don't live in Arizona, IP geo mappers disagree. Borders contain censorship about as well as they contain invasive species.
flir 10mo ago
Nah, but I very occasionally break out ssh port forwarding. Very occasionally.
ataru 10mo ago
I did, I don't want the hassle of anything being blocked, and I don't want to upload identity details as they have the potential for misuse. I notice that some tech companies claim they are "trusted" or have "trusted third parties", I don't trust them at all, I'm not sure why they think I do.
- generic92034 10mo ago
  They trust themselves to do whatever increases the shareholder value. Is that not trust enough for you? /s
latexr 10mo ago
> How many other people have done the same? For your own personal sake, you may be selfishly wishing it’s as few people as possible. Eventually they’ll outlaw VPNs too and by then you’ll have little recourse. You can’t hide behind them forever, deeper change is needed.
- olalonde 10mo ago
  > Eventually they’ll outlaw VPNs too and by then you’ll have little recourse. Even China doesn't quite manage to enforce that.
  - latexr 10mo ago
    It’s a mistake to think you need to get everyone perfectly all the time to be effective. Stopping businesses from operating legally and having your population afraid of committing a crime does a lot of work by itself. It’s only techies who think “if I can get around it, it’s not that big of a deal”. As long as you live in a society, how other people behave affects what you can do too.
    - ben_w 10mo ago
      Yes, and more. Even those who are happy to break laws, don't generally do so perfectly. Even nation states' pulling James Bond stunts don't do it perfectly. Imperfect enforcement used to be the default even for petty crimes, before CCTV and finger prints and DNA tests and all the other forensics got cheap. The legal systems don't care if the methods are imperfect… and worse, they don't understand why we do, making it hard to explain to them the consequences of this kind of thing in our domain.
  - xzjis 10mo ago
    VPNs can never be completely banned because they're a tool used by businesses (nothing is more important than a business in neoliberal capitalism).
    - zorked 10mo ago
KaiserPro 10mo ago
I have a VPN, self hosted, I had one because it was a way to keep my infra in one network for config management. I then extended it for skirting round giving my raw ID to some dogshit start who'll then either get hacked, or sell my details to someone nefarious. If there had been a free, public and verifiable Age/ID service, that wasn't tied to advertising, then I might be more willing to hand over my ID. But because the VC whispered "freemarket" in the ears of the prick who designed this, we are stuck with the worst of all worlds. A non-secure way to prove ID, and a non-acceptable way to shield those that don't or cant consent, from harm.
GaryBluto 10mo ago
I just use TOR for circumventing blocks.
- abc123abc123 10mo ago
  Yes, another one for tor. You can restrict exit nodes to certain countries, if you need to read something only available locally. Works for most, but not all, sites.
tlb 10mo ago
I already had a VPN, because I live in the UK and do business in the US, and the easiest way to get websites to show local prices & shipping is a VPN. I think anyone that is involved with multiple countries needs one. Localization was supposed to be a browser thing, using headers like Accept-Language, but alas.
amiga386 10mo ago
I was already using Tor Browser for sites that UK ISPs are banned from letting me access. I continue to use Tor Browser for entirely innocuous sites that are collateral damage of the OSA. For example, the Interactive Fiction Archive. All its game files are voluntarily blocked in the UK by its well-meaning but stupid operators. Even games intended for children. They should stop complying and just serve up all their files to everyone. If a teenager learns what a. z5 file even is, they deserve to be able to play it. Any reddit thread where someone said naughty words? "Oh we're going to need your phone number and a facial". I don't think so, Mr Data Harvester. Click on URL, Ctrl+c, alt-tab to Tor Browser, Ctrl+v, "Are you over 18?" Yes I am. See how easy that is? I hate my government.
- Flere-Imsaho 10mo ago
  I use Orbot on Android - which provides a Tor connection. I'm not sure why people are paying for VPNs for the small number of sites that are blocked in the UK.
  - thenthenthen 10mo ago
    Sadly Orbot is not working from China.
- afandian 10mo ago
  Not only your government. The Conservatives who proposed it. Labour who provided no opposition. But most importantly Ofcom, who comprehensively failed to implement a competent and reasonable solution. Everyone could have done a lot better, and could have achieved the stated aims without so much damage.
  - badgersnake 10mo ago
    Labour actively supported it and still do. I got this from my Labour MP: The UK has a strong tradition of safeguarding privacy while ensuring that appropriate action can be taken against criminals, such as child sexual abusers and terrorists. I firmly believe that privacy and security are not mutually exclusive—we can and must have both. The Investigatory Powers Act governs how and when data can be requested by law enforcement and other relevant agencies. It includes robust safeguards and independent oversight to protect privacy, ensuring that data is accessed only in exceptional cases and only when necessary and proportionate. The suggestion that cybersecurity and access to data by law enforcement are at odds is false. It is possible for online platforms to have strong cybersecurity measures whilst also ensuring that criminal activities can be detected.
constantcrying 10mo ago
So much of the Internet is broken if you don't have a VPN (and much of it is broken if you do). But the consequence of circumventing laws through VPNs will inevitably be bans on VPNs for individuals. By the way, the people who are writing these laws aren't clueless 60 year olds who need help operating their phones. The EU politicians pushing through chat control understand what they are doing. The idea of a global internet is becoming increasingly infeasible and I believe that China is just ahead of its time. If you look at the UK, it is really just a matter of time until they figure out that the real issue they are having is that, the Internet allows communication with entities they can not enforce their laws on. The logical consequence for them will be to deny access entirely. The same seems true for the EU, which is moving in a similar direction.
- breppp 10mo ago
  laws are not the issue as much as foreign totalitarian entities have a strong ability to influence local voters in adverse ways. This is such a threat to democracy that ironically the only solution is to crack down on democracy
  - salawat 10mo ago
    Not a big fan of Managed Democracy, thank you.
  - constantcrying 10mo ago
    This is such an insane stance. The proposal of chat control is surveillance of most private communication. Blaming Russia is such a tiresome stance. Russian propaganda is so bad and so hilariously ineffective that it penetrates only small bubbles inside political parties, even after years of propaganda. Also the current German government includes the historically most notorious Russian shill party. The laws are absolutely the issue and if you are tearing down democracy to "preserve democracy", you just see democracy as a useful propaganda tool, for the sake of your own power.
    - breppp 10mo ago
gmac 10mo ago
I’m in the UK and have been using a self-hosted VPN for years, since the Investigatory Powers Act obliged ISPs to keep records of what you browse and gave public bodies warrantless access to those records (which I think on principle is entirely wrong). Originally IKEv2 and more recently WireGuard, configured like so: https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup https://github.com/jawj/wireguard-setup https://github.com/jawj/wireguard-setup
- egamirorrim 10mo ago
  I've often thought about doing this, and it's probably easier when ever just with a tailscale exit node or something. What's always given me pause though is that this basically just an ec2 instance or other cloud instance that you route all your traffic through? Doesn't that mean it's just an non anonymous as your home IP if so?
  - gmac 10mo ago
    Depends what you’re defending against. Certainly I don’t suggest you get up to bad things using this as your protection! But if your VPS exit-point is outside the UK, it should defend against the indiscriminate traffic-logging dragnet mandated in the UK. (And maybe even if the VPS is in the UK it does that? I think these provisions might apply only to ISPs). Basically I don’t mind too much that the spooks can figure out what I’m up to if they specifically make the effort. I object much more to having all my online movements observed and stored and made available to dozens of public bodies. The physical world analogy would probably be that someone is assigned to tail you and record what building you go into every time you leave the house, and I think almost nobody would be OK with that.
cs02rm0 10mo ago
A lot I expect. There were stories about VPNs being top of the App Store, etc. when the law kicked in. Lots of people using Brave's Tor or Opera's VPN in their browsers, and free VPNs like Proton (which seems like a negative security outcome for the country to me). I'd have thought the intel agencies would be pissed at all that data going dark, but haven't heard a peep in the media.
koakuma-chan 10mo ago
People from countries with oppressive governments: first time?
googlebot6178 10mo ago
Since Google eliminated country specific search sites like google.co.uk and bans you from changing location you have to get VPN. If you happen to be travelling and want to do Xmas shopping for UK Google now blocks this possibility because it assumes you want to shop for delivery at your airport transfer lounge location because it doesn't understand user intent or helpful content, in its own bubble land it unbelievably says this is a smoother experience for users! Most expats now are forced onto vpn if they still use Google. Fortunately ai is doing away with the need for Google altogether.
- CWIZO 10mo ago
  I love how google (youtube) starts immediately showing me ads in the language of whatever country I happen to be on holiday at the time. For that country specific services/products. As if they don't know exactly where I'm from and which languages I speak. Absolutely baffling that they get this so badly wrong.
chaz6 10mo ago
I am in the UK, and I work for a combined FNO/ISP (a company that owns and operates both the access network and the internet service). It makes me angry that corporations and governments are ruining what was once a thriving network that allowed people to communicate freely with one another. I hope that we will be able to save what remains before it's completely out of our control. My fear is that eventually all devices will be required to have a government-mandated backdoor installed, and anyone found with a non-compliant device will be treated as a criminal. For now, I used my Hetzner server via Tailscale running fast-socks5 [1] using FoxyProxy [2] (for Mozilla Firefox) which allows me to select a list of domains to re-direct through the socks proxy. I also have Tor installed which is useful when roaming. [1] https://github.com/dizda/fast-socks5 https://github.com/dizda/fast-socks5 [2] https://addons.mozilla.org/en-GB/firefox/addon/foxyproxy-standard/ https://addons.mozilla.org/en-GB/firefox/addon/foxyproxy-sta...
- acomjean 10mo ago
  >My fear is that eventually all devices will be required to have a government-mandated backdoor installed, They tried to have the back door mandated with the Clipper chip. Governments will try again. https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
mytailorisrich 10mo ago
On HN probably a few but HN is an extremely niche demographics. Among the general public I would say effectively zero. The Online Safety Act does not even register in the news or as part of people's concerns. There might have been a burst of interest because of reports in the media when the OSA came into force but I suspect that this is about it.
Thev00d00 10mo ago
ProtonVPN free tier is great
nomilk 10mo ago
I got a VPN in preparation for Australia's (even more draconian) "age verification" laws (those take effect in 4 days). But what I'd really love (startup idea!?) is an app that let's you map websites to countries and it handles tunnelling that domain's traffic through the selected country's VPN. For example, I'd like to view Reddit, YouTube, X, Facebook, Instagram and social media apps from a US IP (to avoid Australia's "age verification"), dailymail.co.uk from a UK IP (since it's blocked in Thailand), predication markets from a country that allows them, Imgur from a country that allows it, Spotify from any country so long as it's fixed (to avoid it randomly stopping mid workout with a 'your country has changed' notification). Until something automated like this exists the current best solution is a VPN and manually switching countries when something you want isn't available from the current country, which isn't great UX.
- bitcoinmoney 10mo ago
  How much would you pay for that app?
  - nomilk 10mo ago
    I currently pay $10/month for ProtonVPN, so at least that much.
- aprilnya 10mo ago
  I’ve seen people do this on the router level with a proxy, with imgur being the example - all other traffic just went as normal but imgur traffic was sent through a VPN. However it was a very complicated setup with many parts and a home server so I would definitely like to see a proper app built around this that just handles everything for you.
  - squishington 10mo ago
    Openwrt with the policy based routing package can do this, and is simple to set up.
- iLoveOncall 10mo ago
aprilnya 10mo ago
> As of Monday morning, half of the top ten free apps in Apple's app download charts in the UK appeared to be for VPN services. > Proton VPN, an app offered by Swiss privacy tech firm Proton, told the BBC it had seen a 1800% spike in UK daily sign-ups over the weekend after age check rules took effect on Friday. https://www.bbc.com/news/articles/cn72ydj70g5o https://www.bbc.com/news/articles/cn72ydj70g5o
- cedws 10mo ago
  Last I checked, many of the top free VPNs on the App Store were dodgy no-name ones that probably funnel traffic through Russia. Well done UK government you saved the children.
  - pixelmelt 10mo ago
    The dodgy ones actually usually use you as an exit node for other users traffic as well as selling your connection commercially as a residential proxy
- hodgesrm 10mo ago
  Marketing network security products is usually hard. Not any more. The practical effect of these so-called protection laws is to break shit across the entire Internet.
cedws 10mo ago
I had a VPN before but used it less. Now my devices are connected pretty much 24/7.
wrxd 10mo ago
I sometimes use a Tailscale exit node on a VPS I already had before. I also switched to use Redlib instances to browser Reddit
lonelyasacloud 10mo ago
Yes. It wasn't an unintended consequence. The goal of the legislation was to "stop children from accessing age inappropriate content" on the internet. Ahead of the legislation it was known that there would be a significant proportion of individuals who would switch to using VPN's because without platform based verification it would be a pita for users (more logins, random age verification services, and some sites just deciding to block). However, VPN's, come with their own minimum age 18 T&C's, as do the means of payment for those services (credit and debit). So from the pov of "stop children from accessing age inappropriate content" similar result Not perfect, but empirically this seems to be working well enough e.g. "New data shows no rise in children’s VPN use after the introduction of online age checks" (https://www.internetmatters.org/hub/research/data-shows-no-rise-childrens-vpn-use-amid-online-age-checks/ https://www.internetmatters.org/hub/research/data-shows-no-r...), i.e. the VPN traffic is largely adults. As to other unintended consequences, such as making it more difficult for the authorities to snoop on their citizens, I doubt this effectively makes any difference whatsoever.
- malfist 10mo ago
  How much of that is conflated with plenty of sites still operating without age gates? I think its more likely to push people to shadier and shadier sites and not VPNs
oliwarner 10mo ago
Had one anyway, but yes, now I have to use it for cat memes on Imgur. It's plumbed into the router so some websites automatically get routed through the VPN, regardless of device. What a time to be alive.
kypro 10mo ago
I'm kinda surprised at how many people I know who have gotten VPNs as a result. Just a couple of weeks ago I was talking with a 12 year old in my family and he was showing me the free VPN apps him and his friends are using to get around the gov censorship. Basically all my friends are using VPNs now too, but I suppose I have more tech literate friends so many that's less surprising. But in general I get the sense if you're <50 and spend a decent amount of time online, you're probably using a VPN. It's kinda difficult to use the internet in the UK without one.
glimmung 10mo ago
I've been using a VPN on and off for years when there was a privacy concern. Now there is a privacy concern 24x7, and so I use a VPN 24x7. A bad law and risk-averse sites have made the web a complete PITA without one. The number of e.g. news sites and other vanilla content that requires intrusive checks, photo-ID etc. is astonishing. I wonder how many parents have had to ask their kids for help setting a VPN up? <sigh>

_dan 10mo ago

I mean good luck banning ssh connections.

gorgoiler 10mo ago
You’ll need to have some plausible amount of non-ssh traffic otherwise your account will be automatically re-assigned as an Enterprise Infrastructure Account. It will be temporarily suspended while you apply for a license. EIAs are £452.17/month (a statutory amount originally defined in The Online Safety Act’s 2027 update, subject to triple-lock inflation), licensed, and subject to inspection. There’s a four month waiting list for licensing due to backlogs at the local County Court. The alternative is therefore to use up a strike and apply to have the account repurposed back to a Citizen User Account. CUAs must remain below a 50:1 down/up ratio and must have p90 non-https “control” traffic of 48kbps or less. They are expensive too but you get a 25% discount if you install your ISP’s mobileconfig / MDM profile though. With the profile discount the price is now only £64.99 a month. (This assumes you run an Approved Platform capable of mobile device management. Anything else — Linux based, old versions of macOS, Windows <= 13 etc. — has to pay the full price and CUAs are limited to one Custom Access device per connection.) You can get it down to £49.99 a month if you sign up for a 12-month trial of their home security system — cameras, door “e-locks”, that sort of thing. The devices are locked down but you can see the last 48h of events on their cloud portal. The devices have tamper detectors and the traffic is encrypted e2e but luckily that doesn’t count towards your CUA agreement’s limits on opaque traffic.
- cedws 10mo ago
  You forgot about the Internet Tunnelling Tax. * does not apply to pensioners
- _dan 10mo ago
  Well that is ridiculous. ..but sadly within the margin of ridiculousness for our government's approach to the internet.
latexr 10mo ago
Good luck having the general public using SSH connections to route their traffic. You’re not a hermit (or you wouldn’t be on HN). You live in a society and what affects your peers and their behaviours also influences your life.
- iamnothere 10mo ago
  If a VPN ban happens, I (a US citizen) and others will happily provide your people with easy to understand plain English circumvention instructions and tools, designed for the “regular Joe”, regularly adapting to whatever the latest conditions are. Maybe SSH based, maybe a VPN over SSL, maybe Tor, most likely some combination designed to evade detection. If your society is anti freedom of information, your society deserves a spanking.
  - latexr 10mo ago
    You should look at your own society before criticising others. Your own US states are already implementing age-verification laws, your own government is attacking its own citizens and foreigners, you’re know for mass surveillance of your own citizens (the name Snowden ring a bell?) and others (which is exactly why other countries are avoiding US companies), and your government is hiding inconvenient files (Epstein) and ordering the erasure of scientific information (climate change). You’re not the bastion of freedom you believe you are, and you’re definitely not one to school others on “freedom of information”.
    - iamnothere 10mo ago
      I have the capacity to fight for freedom of information both at home and abroad, and yes there is urgent need in both places. My primary complaint with the UK and EU right now is that they have been attempting to restrict US freedom of information, versus say China who doesn’t make an effort overseas. Not only are the UK and EU exerting pressure against US companies to change their global policies, but especially in the case of the UK, they are attempting to change the legal framework governing the internet by claiming that sites are somehow subject to UK law unless they proactively block the UK. All this on top of long time EU/UK participation in shady “counter-misinformation” efforts that have spun up a web of state-funded NGOs who attempt to influence US policy against freedom of information. So yeah, I’m pissed at your countries in particular.

kneel25 10mo ago

I don't know why people immediately have this thought, outlawing VPNs achieves virtually nothing in the UK. An adult bypassing an age check is irrelevant; underage users are at least mature enough to know what a VPN is - not the main target of the act. And there's virtually no real anonymity; hiding from your ISP doesn't make you untraceable. So why would they even consider it?

salawat 10mo ago
For the children of course. Haven't you been around for this before?
latexr 10mo ago
It’s naive to believe the goal of these laws is truly to protect children and that it has anything to do with age. That’s just the justification which gets them in the door.
- kneel25 10mo ago
  What is the goal then? Why do they care that you're bypassing it? I wouldn't deny using children in messaging isn't a deliberate focus to strengthen the case, but I don't think they're lying that it's about reducing access to harmful material, and I don't disagree with that goal or the way they've implemented it. It would be a weak case not to use statistics they find in the younger internet users because that's where it's causing the most unacceptable harm.
  - latexr 10mo ago
    > What is the goal then? Why do they care that you're bypassing it? Mass surveillance, population control, and the destruction of services they disapprove of. Pornhub’s traffic went down by 80% when they implemented the mandatory age verification checks in some state. So they simply blocked them because it wasn’t worth it. Later, someone (I don’t have the ability to track down the source right now) was caught admitting one of the goals of the law is to drive those sites out of business. I recommend reading about authoritarian regimes in Europe (it was not just Germany) and how they controlled discourse, and what people had accessed to. Some of their decisions have repercussions which are felt to this day. In Spain, foreign media is dubbed while in Portugal it is subbed. Both are due to their respective dictators.
    - kneel25 10mo ago
      There is no surveillance because it's third-parties responsible for the verification and no knowledge of the content or identity is passed between them beyond yes/no. Population control, sure, but that's not inherently wrong or unreasonable for reducing harmful internet usage. Pornhub's traffic are temporarily lazy users looking for a quick fix. Them being able to serve up step-sister roleplay slop in two clicks isn't something I care about protecting. I doubt they said that comment about Pornhub specifically, maybe, but I can believe driving certain sites out of business being part of the intention, barely moderated suicide discussion forums filled with teenagers for one. I will read about that, but I quite quickly realised talking about this in person it's one of the few things I feel this strongly about, and even I'm not sure why I agree so entirely. I think I look at it a bit like climate activists interacting with deniers. Say what you want about future risks and criticisms, but there is no time, the situation is extremely fucked right now, particularly with children, and something needed doing asap.