UK PEOPLE: this is REALLY IMPORTANT.

[tiggy@mastodonapp.uk]

@cstross

And of course, while inconveniencing or worse ordinary people, it won't stop a determined teenager.
Same with physical ID, the ones they want to stop get around the new rules but people in general get more problems upon problems.

[oschonrock@mastodon.social]

@PeterSommerlad @cstross

Well the "home lan" is effectively the "corporate use case" I described, just for advanced IT folk.. (I used to do the same).

The geoblocking use case is "fair" in the sense that it "just works", but almost certainly contravenes the streaming service providers T&Cs. It does nothing for privacy, since you clearly log into these services.

(Psst: I also use TOR to get around geoblocking.. not quite as convenient, but free)

[petersommerlad@mastodon.social]

@oschonrock @cstross
i want to watch my streaming abos when traveling without having to download things at home. in Switzerland I pay the highest fees anyway.

[davecb@hachyderm.io]

@cstross Hmmn, Dave has connected to Royal Bank. I thought he banked at Scotiabank. I wonder if he's up to something? (Yes, actually. diversification and a better deal.)

[fazalmajid@social.vivaldi.net]

@cstross you can run your own VPN, I’ve automated the process in https://github.com/fazalmajid/edgewalker

At that point, *you* are the VPN provider and in compliance. Until the next brain dead decision the parasites descended from thugs in the House of Drolls come up with.

[cstross@wandering.shop]

@fazalmajid Right, so that would require me to learn and install OpenBSD and a full stack. (The last BSD I used in anger was SunOS 4.1.3.)

[oschonrock@mastodon.social]

@PeterSommerlad @cstross

So in the context of this discussion, and if you lived in the UK, would you object to being age/identity verified when purchasing your vpn subscription?

It is almost certainly not an annonymous transaction anyway, as those are very very difficult to execute..?

[elricofmelnibone@mastodon.social]

@cstross It would be nice if the government would encourage parents to do the actual parenting, instead of trying to force their idea of parenting down everyone's throats.

[nicovel0@mastodon.social]

@cstross oh absolutely, I have signed three petition. I don’t expect it will have any effect but we have to try.

[dan@axillae.telent.net]

@jaawerth @cstross @Nicovel0 the amendment does not appear to define "virtual private network", so ... does it include TOR? SSH SOCKS proxy? L2TP? PPPoE?

[cybervegan@autistics.life]

@cstross They don't even know what a VPN is or does. They tried to do this with e2e encryption key escrow, to include vpns in about 2017 and then quietly dropped it probably because someone has pointed out that businesses use them extensively for commerce comms and b2b services. Regardless of whether or not the positive effects they want are achieved (they won't be) the negatives will far outweigh them, and it still won't protect kids any better.

[nicovel0@mastodon.social]

@dan @jaawerth @cstross the judge will know when they take a look at it.

[fonant@social.vivaldi.net]

@cstross It's impossible to restrict access to VPNs.

They could perhaps persuade some of the big providers to add access controls, but that would only result in more people using smaller or even self-hosted VPN services.

You can't un-invent encryption algorithms.

[fonant@social.vivaldi.net]

@etchedpixels @cstross I'm not sure that TOR is a "VPN". It's not an encrypted tunnel, it's a distributed internet packet routing system.

But it rather depends on what any law defines a VPN as. Something that lawmakers will have a lot of fun with!

[david_chisnall@infosec.exchange]

@Fonant @cstross

Self-hosted VPNs already have age verification. I know 100% of the people who use my own WireGuard tunnel (i.e. me) and all of them are over 18.

The same is true of corporate VPNs: credentials are given only to employees and they are over 18 for various existing legal reasons.

[david_chisnall@infosec.exchange]

@kbal @cstross

I know a bunch of people who did this without a VPN and didn't get any legal notices. The worst that they got was bandwidth throttling from their ISP.

If you have a VPN, then it's trivial for someone in the right jurisdiction to subpoena the VPN provider and require them to provide data on which account was responsible. Asking an ISP and asking a VPN provider for this information are no different, and both may have legal obligations to keep the information to be able to answer this kind of question (and, even when they don't, may have commercial incentives because their choice is often something like 'tell us who was using your service to attack Google's servers, or the entire Google infrastructure will block or severely rate limit every IP range that you own').

If you use something like Tor, no one has this data, but last time I heard of someone torrenting over Tor they were getting MODEM levels of speed.

[lazarou@mastodon.social]

@cstross signed

[fonant@social.vivaldi.net]

@david_chisnall @cstross But it's almost impossible for a government to detect a VPN service that doesn't have age restrictions. Unless it's one of the big well-known ones.

A foreign entity could set them up, or someone aged less than 16 for themselves (and perhaps also their mates).

You need:

1. A cheap server, anywhere in the world, connected to the internet.
2. VPN server software, available for free from lots of places.
3. Some instructions, easily available.

[cstross@wandering.shop]

@Fonant @david_chisnall Doesn't matter: if the law goes on the books then at any point where your phone/laptop/etc is seized for other reasons it may be discovered to have an illegal VPN and then you get prosecuted.

[hypostase@bsd.network]

@oschonrock
I'm assuming that this is the government's intention. To produce a generation of teenagers who understand TOR, and choose to use it as a first step, using their phones as routers and randomised exit points.
@cstross