Posted by hn_acker 1 day ago
Is it even possible to reliably know that a connection is from a VPN? Anyone can proxy through a random hosting provider.
Folks would just host their own vpns various places and this would be pointless ….
/Same as it ever was
- religious/cultural. My beliefs forbid this, it makes people bad/worse in some hard-to-define way, so no one should be allowed to do it. Sometimes with an emphasis that the sellers are luring good people into sin/ruin.
- it harms women. Many of the participants are trafficked or coerced in some way (and further abused). The profits from the industry encourage more of this. It “warps” the mind of men who use it, leading them to mistreat and abuse women.
I see elements of truth in all these, but IMO they are ultimately not compelling, prohibition is unworkable and unduly infringes on willing participants and consumers.
I am all for individual freedoms, but I've read enough about this issue, and seen enough documentaries, that I think the claim is very well-founded. Of course, some porn stars are just willing adults doing something they want to do, but there are many who are not.
Women who do not provide fully informed and voluntarily consent are harmed
Porn makes some (or many, or all) men who consume it treat some (or many, or all) women badly
The main point of contention becomes what "enough" constitutes. Almost no women in commercial porn is underage as all countries that legally allow its production also require strict proof of age for the people actually having sex.
I’ve watched plenty of porn in my life, probably a bit more than average. I’ve never done anything out of the norm or unwanted to woman, let alone abuse one.
I think shitty people will be shitty people and it’s just a really easy thing to point at instead of taking responsibility for it. It’s also a convenient plausible sounding correlation for people who already want to ban porn to use.
Umm, I played plenty of GTA growing up and I’ve never stolen a car. People are actually very good at separating fantasy from reality, believe it or not.
That's one reason why traditionists in power usually crack down on any sort of pornography or alternate sexuality. Sex is a huge driver for human behavior. And established power structures would prefer that the only way for anyone to get sex is via compliance with the existing power structures. It's not something where the establishment is ever going to be able to perfectly control things, but if they can make it more difficult to get any sort of sexual gratification that doesn't align with their preferred social structure that gives the establishment an advantage in holding on to power.
Ofcom is investigating PornHub even after PornHub installed age checks as Ofcom claims age checks not “robust” (read: VPN ban). So hand over your id to see porn.
The government demonstrably has the ability to break into your comms and data without going through any of this. Instead of a libertarian conspiracy theory have you considered that politicians chase power and re-election?
Taking a stand and making major changes is hard to pull off, costs a lot of political resources, and can backfire horribly. Doing symbolic, popular crap that’s popular with the (admittedly thick and ignorant) majority is an easy win. Moral outrage is an easy win. “Think of the children” is an easy win.
Ed: Corrected “comma” to “comms”
In the real world, very few people have that capability.
Less savvy individuals/business would also have no reason to obey these laws.
The limitation is technical skill, even having enough skill to know that this is a solution.
Now of course, if your VPN is a home-lab style VPN where you are connecting to a little wireguard box sitting in your own home, that is a totally different story.
I use VPN most of the time. My work requires it, and I like Mozilla VPN for personal privacy. (Note: it has ad blocking DNS built in which is nice!)
I occasionally get blocked by websites or services, especially streaming apps, if I'm on VPN. I suspect they're just looking out for Amazon/Microsoft/etc IP address blocks. It's very annoying
The simplest methods block known datacenter IP ranges like you thought. More will score it based on several heuristics and a reputation over time. If you get 100 different users connecting from a single IP, it's probably not someone's home internet connection.
Or, their so-called "smart" TV is acting as a proxy without their informed consent.
There are also third party providers of IP annotations to classify known VPN address ranges that content providers typically subscribe to blanket block providers.
The reason for this aggressive approach is streaming apps all need your IP as core signal for tagging your region and all content licensing is region locked (even on YT).
Netflix are/were the most relaxed about it , and for long time would only buy content if they got global distribution rights, but not anymore. Many VPN ads specifically used to market that you can watch Netflix geolocked content.
[1] IME they block DC IPs too although not needed for blocking professional VPN, even self hosted OpenVPN on cloud box usually gets flagged.
It’s starting to get annoying that things aren’t working. They’re shooting themselves in the foot though.
If they didn’t block VPNs, they would at least know what category to group them in.
There is a very vocal anti-porn group in Utah. They do things like put up massive billboards that say "[Store name] sells porn." (Which is basically free advertising instead of shaming.)
On the other hand, using Masque for TCP transfers will probably fool a server to believe the MSS is 1500.
No, it's not possible. You can only try to identify known protocols or suspicious patterns of data, timing or entropy. Theoretically, with a big enough collaboration, you could hide a VPN behind shaping traffic patterns and request order towards hundreds of different servers, and there's just no method of traffic analysis that can possibly identify that without prior knowledge.
Like, some firewalls try to identify an absence of connections outside the VPN, or an abnormal volume of data over a sustained period of time. But all that goes out the window when, say, you are connecting to hundreds of real servers at all times and only exchanging, say, basic HTTP requests with each one. For all they know you just have a million browser toolbars installed. They wouldn't know if the choice of request, order and timing encodes information because they wouldn't be able to prove what the client's intentions are in sending it or what the servers do with it.
If you tried to identify it, you would block every real connection.
I believe some VPN providers are beginning to play with things like this, but the problem is really that it's impossible to provide this. It only really works when you run it yourself, because that's the only way others don't know. So they're having to settle for compromises, like Mullvad's DAITA, which still uses a single server but tries to avoid showing tells of a VPN connection as opposed to something else like streaming.
Let’s block traffic on the internet blindly just in case someone is looking at an adult website.
To handle the matter technically Utah would need a "great firewall of Utah" and a legislative mandate that all ISPs route thru it. Somehow they'd have to factor-in signals from cellular sites neighboring states and satellites.
The inability to immediately and perfectly eliminate a behavior is not a good enough reason to be against any attempt to eliminate that behavior.
So if you are legally required to block all VPN users and then fail to actually block all VPN users what is stopping you from being punished for not complying with the law?
Since when do you have to pull permits to put a server on the web?
Under Utah's law as written, a private business has to assume any single IP address could be operating a VPN/proxy.
Is this still true, or has it become a truism? It seems nations like Iran and China (and events like Kashmir come to mind) have progressed the state-of-the-art and playbook to where we can't actually say it definitively will route around it.
Now seeing that the US and EU are flirting with these similar restrictions it's making me wonder how we'll be able to keep hold of these principles.
Maybe my concern with that adage is ultimately its passive voice, since it takes 'active' action by people to give us those options, and will probably take more actions by more people to keep it alive now.
Things China can't do: Magically "downgrade", "decrypt" or "intercept" the secure protocols we use every day like HTTPS. Facts won't budge, the technology we are using does what it says on the tin.
The Internet can't route around you being thrown off a tall building by men with guns, but the IETF has for some years considered it to be extremely important to design the network protocols to prevent these shenanigans. BCP # 188 "Pervasive Monitoring is An Attack"
Normal people don’t care about “downgrade” or “decrypt” or “intercept” they care about availability.
But of course the easiest approved “VPN” is just data roaming.
They aren't stupid, they're not going to insta-block everything they can detect, giving away clues to people trying to evade it.
If there's civil unrest, they can of course essentially turn off the internet, but there's a distinction between "the internet can route around censorship" and "the internet can be blocked in its entirety (or near entirety)"
1. Make it illegal to distribute a browser that distrusts their CA
2. Make it illegal to run a browser that distrusts their CA
3. Block all encrypted traffic that they can't MITM and notify police that you are running illegal softwareI mean... They could, though, no? If they control the gateways they could drop any traffic that isn't encrypted with some root cert that allows them to decrypt in transit packets.
I'm sure that works in a Hollywood movie, in the same way you could reverse the polarity of the lasers to enable you to travel inside the computer from a household video projector, or decrypt all the world's telephone calls using a device built into your batmobile - but this isn't a Hollywood movie and so traffic isn't in fact "encrypted with a root cert".
If for any of a variety of reasons the Chinese authorities don't want your connection to exist they'll terminate the connection, exactly as I described in my earlier comment.
So there is a route around censorship, but maybe the public doesn't really care about it.
I suppose Utah could impose some sort of strategy here, but would be so burdensome and anti-American I’m not sure they could pull it off. Instead of a blacklist of sites dictated by the site provider, you go the other way where all Utah ISPs maintain a whitelist of IPs permitted to Utah citizens. Any traffic attempting to reach a non-white listed IP, would be rejected.
It's a politico-technological arms race. They make their laws. We make technology that completely nullifies their laws. They need to increase their tyranny in order to enjoy the same level of control they had before. The end state is either a totalitarian government or an uncontrollable population.
I used to think that we'd find some kind of equilibrium along the way, that we'd eventually discover the government's limits: some principle they refuse to break, some line they refuse to cross...
But the truth is these tyrants have no limits whatsoever. They'll stop at nothing in their quest to control the flow of information.
The layer 2 and 3 of ISO/OSI stack does indeed "route around censorship". But the Internet as we know it is all Layer 7, and it's as centralized as it gets.
That's why regulators often aim straight at Layer 7 entities - companies providing consumer services over the web. Because no matter how unblockable the route between you and some server is, it doesn't mean anything when the server itself is refusing to talk to you.
A VPN/proxy could exist at almost any single address at any given time.
> “I sometimes joke that we might as well turn the Ministry of Communications and the Supreme Council of Cyberspace into amusement parks, because they will no longer serve any purpose,” Hakami said.
https://gulfnews.com/world/mena/iran-official-says-starlink-...
To a large degree, most of the internet today is ultimately controlled by a few people. If what you have to say pisses off these people, and someone is determined to keep you off the internet, you have a problem. Kiwi Farms is a well known example, and continues to suffer under regular DDOS attacks. Regardless of how you feel about KF, it's undeniable that a) this nonsense has streissanded the site enormously and b) it's speech you don't like that needs protection.
Also there was the whole covid "misinformation" garbage fire... I certainly do not want my government or some megacorp to decide what can and can't say or read.
And going beyond the internet, I just want to remind you Americans, that your 1st amendment is almost unique (to my knowledge). Enjoy and protect your offensive, hateful, blasphemous, extremist, and deeply unpopular speech.
It won't route around self-censorship that arises out of surveillance
Nor will it take a stand against SNI which is a dead simple means of implementing censorship that's in widespread use every day for years
Could you elaborate? What's "SNI", and how does it relate to censorship?
Doesn't help your arm, but when they're asking for things in that second category, it doesn't help them either.
https://www.everycrsreport.com/files/20080714_RL33224_1e6b93...
How is that not a blatant first amendment violation?
Under state and common law at the time many kinds of speech were routinely regulated or even criminalized, such as defamation and blasphemy.
Or at least it shouldn't.
This Utah law requires perfection.
So in theory sites could block all VPN users (if you can somehow "perfectly (1) detect VPN/proxy users"), but if the law necessitates that nationally/globally then it's unconstitutional anyway. It's the age assuring of VPN-users specifically from Utah part that Utah are relying on being possible for the law the be constitutional.
A VPN/proxy could exist on any given IP address at any time, which the California law recognizes but the Utah law does not.
Heck, Lowes and BestBuy are pretty unusable in general via VPN already.. (or maybe due to ublock, or privacy badger or eff, etc.. :-)
Unfortunately know this because a gambler friend showed me.
Seems like we need a fundamental challenge to the concept that you have any jurisdiction whatsoever.