Hacker News

Requires the vpn provider to snitch and possible tag the ip frames or http frames lol

Folks would just host their own vpns various places and this would be pointless ….

Kinda.

I use VPN most of the time. My work requires it, and I like Mozilla VPN for personal privacy. (Note: it has ad blocking DNS built in which is nice!)

I occasionally get blocked by websites or services, especially streaming apps, if I'm on VPN. I suspect they're just looking out for Amazon/Microsoft/etc IP address blocks. It's very annoying

Right, all you see is the IP address. And anyone in the world can set up an “individual” VPN just for them on a cheap VPS or cloud server anywhere else in the world. There’s no technical way to accomplish what they’ve mandated, only something approximating it like “block all connections from known commercial VPN services”.

Depends on how you define "reliably". You can get pretty damn close by triangulating on traffic patterns and browser fingerprinting. There is a lot of research in this area. But it'll never be perfect.

All it would take is for a major ISP in Utah to route everyone through a VPN, and boom, it's the same picture.

TCP MSS < 1500 bytes can be a tell, although it will sometimes falsely identify non-"VPN" tunnels.

It's hard to find a proxy or VPN that isn't flagged as such. People pay extra for residential proxies.

It seems like withdrawing from Utah is the obvious option

> Is it even possible to reliably know that a connection is from a VPN?

No, it's not possible. You can only try to identify known protocols or suspicious patterns of data, timing or entropy. Theoretically, with a big enough collaboration, you could hide a VPN behind shaping traffic patterns and request order towards hundreds of different servers, and there's just no method of traffic analysis that can possibly identify that without prior knowledge.

Like, some firewalls try to identify an absence of connections outside the VPN, or an abnormal volume of data over a sustained period of time. But all that goes out the window when, say, you are connecting to hundreds of real servers at all times and only exchanging, say, basic HTTP requests with each one. For all they know you just have a million browser toolbars installed. They wouldn't know if the choice of request, order and timing encodes information because they wouldn't be able to prove what the client's intentions are in sending it or what the servers do with it.

If you tried to identify it, you would block every real connection.

I believe some VPN providers are beginning to play with things like this, but the problem is really that it's impossible to provide this. It only really works when you run it yourself, because that's the only way others don't know. So they're having to settle for compromises, like Mullvad's DAITA, which still uses a single server but tries to avoid showing tells of a VPN connection as opposed to something else like streaming.

You do not need to know "reliably". You can block everything remotely suspicious, and in case someone is blocked by mistake, they can file an application with all necessary documentation proving the connection is not a VPN.

Not when the definition of VPN is subjective. I could proxy/VPN through a friend's house and nobody would ever know it wasn't them.

The classic: ping the endpoint address, then “ping” the code. If the IP address comes back in 30ms but the JavaScript responds in 330ms, then the client is probably 300ms further away than they say they are claiming.

The thing China can do, and does do: Kill your network connections, whether that's a TCP session, your ability to send or receive packets with some particular IP addresses, or at the extreme armed men show up and now it's not an Internet problem.

Things China can't do: Magically "downgrade", "decrypt" or "intercept" the secure protocols we use every day like HTTPS. Facts won't budge, the technology we are using does what it says on the tin.

The Internet can't route around you being thrown off a tall building by men with guns, but the IETF has for some years considered it to be extremely important to design the network protocols to prevent these shenanigans. BCP # 188 "Pervasive Monitoring is An Attack"

Is China that successful at it lately? I see a lot of posters and info from China getting around the great firewall, and my understanding was that they don't really care if 1% of users do that so long as it mostly holds and only the technical minded or really fixated will see it.

So there is a route around censorship, but maybe the public doesn't really care about it.

I’m pretty sure with Iran, and I assume other authoritarian nations, the state controls what traffic can and cannot leave their borders. When they go dark, they just effectively cut off access to the outside world entirely. Sure they may have their own state run servers that provide some services, but then they can inspect and manage all traffic being routed inside the country. Don’t have to try and find the VPN if there’s just no traffic.

I suppose Utah could impose some sort of strategy here, but would be so burdensome and anti-American I’m not sure they could pull it off. Instead of a blacklist of sites dictated by the site provider, you go the other way where all Utah ISPs maintain a whitelist of IPs permitted to Utah citizens. Any traffic attempting to reach a non-white listed IP, would be rejected.

The internet will always route around censorship in principled western nations.

It's a politico-technological arms race. They make their laws. We make technology that completely nullifies their laws. They need to increase their tyranny in order to enjoy the same level of control they had before. The end state is either a totalitarian government or an uncontrollable population.

I used to think that we'd find some kind of equilibrium along the way, that we'd eventually discover the government's limits: some principle they refuse to break, some line they refuse to cross...

But the truth is these tyrants have no limits whatsoever. They'll stop at nothing in their quest to control the flow of information.

It's never been true.

The layer 2 and 3 of ISO/OSI stack does indeed "route around censorship". But the Internet as we know it is all Layer 7, and it's as centralized as it gets.

That's why regulators often aim straight at Layer 7 entities - companies providing consumer services over the web. Because no matter how unblockable the route between you and some server is, it doesn't mean anything when the server itself is refusing to talk to you.

It seems like Utah could do mostly do this by intercepting all consumer traffic.

It's true unless we let freedom of speech and the press be interpreted narrowly, as the right to flap our jaws and to press paper against ink. That is up to us collectively.

> Over the last two years, Iran officials warned that wider use of the satellite internet service could make communication controls within the country "ineffective", adding the regime has failed to produce an adequate policy response.

> “I sometimes joke that we might as well turn the Ministry of Communications and the Supreme Council of Cyberspace into amusement parks, because they will no longer serve any purpose,” Hakami said.

https://gulfnews.com/world/mena/iran-official-says-starlink-...

There will always be >0 people who find a way around censorship, that's about it. It's not bad AND ineffective, that's a contradiction.

It's certainly less true than it was. It depends on how Matt Prince feels on any particular day.

To a large degree, most of the internet today is ultimately controlled by a few people. If what you have to say pisses off these people, and someone is determined to keep you off the internet, you have a problem. Kiwi Farms is a well known example, and continues to suffer under regular DDOS attacks. Regardless of how you feel about KF, it's undeniable that a) this nonsense has streissanded the site enormously and b) it's speech you don't like that needs protection.

Also there was the whole covid "misinformation" garbage fire... I certainly do not want my government or some megacorp to decide what can and can't say or read.

And going beyond the internet, I just want to remind you Americans, that your 1st amendment is almost unique (to my knowledge). Enjoy and protect your offensive, hateful, blasphemous, extremist, and deeply unpopular speech.

To big to fail social media is a problem for this

There are a category of things that are technically impossible until a burly man threatens to break your arm if you don't do them, and a category of things that are still impossible.

Doesn't help your arm, but when they're asking for things in that second category, it doesn't help them either.

No stranger to expecting to apply their morality to all people, even those who have a very different set of beliefs. Just a niche brand of christian nationalism seeking to subjugate everyone to their ways.

Huh? Is this comment referring to something specific or is it just a general swipe at a religion that's unliked around here?

The smart version of this is that adult content providers send a header or something with every response that contains NSFW, and then you use parental controls on client devices to not show those responses. This even works for sites that show a mix of kid-friendly and adult content cough reddit cough. It offers fewer opportunities for general purpose censorship, though, so there's less interest.

The US Congress evaluated [1] the legality of forcing adult websites onto certain TLDs in the 2000s and it was determined to be legally ambiguous and would almost certainly face substantial 1st amendment challenges. So they didn't pursue it.

https://www.everycrsreport.com/files/20080714_RL33224_1e6b93...

Because you shouldn't get behind a thing that shouldn't exists. Technical solutions to societal problems are and will always be naught and fraught with unnecessary jump roping. In this case, the content itself isn't dangerous, what is dangerous is consuming it without the correct context, ie. education.

What's the enforcement mechanism if some porn company in Elbonia "forgets" and uses hothothot.el, instead of hothothot.porn?

Because we don’t like people doing it. Duh.

It is, but the first amendment isn't absolute.

DraftKings does it in a way that is good enough to comply with California law, which doesn't require perfection.

This Utah law requires perfection.

I'm not in California and DraftKings blocks me connecting with a VPN, so they just don't seem to be distinguishing whether a VPN user is in California (which is the impossible part of this law).

they want to stop VPN traffic. If it's a plain IP address it's easy. VPN makes it hard.

Being able to tie an IP to a rough physical location was, in retrospect, a huge Internet design mistake. IPs should be like random UUIDs. They should have been designed to get assigned randomly when you obtain one, rotated / thrown away periodically, with no hierarchical numeric relationship with the ISP that is assigning them.

Wow, that is a wild read, thank you: https://en.wikipedia.org/wiki/Indiana_pi_bill

They seem to know what they're doing here. A website can comply as long as they perfectly geofence (impossible) or do "reasonable" age verification. "Reasonable" only for the latter. So they basically want these sites in any US state to do age verification.

I'm not sure your claim is backed up by the evidence you've provided (to wit, that Indiana did not pass the bill).

https://le.utah.gov/~2026/bills/static/SB0073.html

| An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location to make it appear that the individual is accessing a website from a location outside this state.

But how can any site check if a client is a) a VPN client (typically this can be known because VPN exit node IPs can be learned), __and__ b) in Utah?

The impossibility lies in (b). Effectively this forces any affected companies having a nexus to the state of Utah to forbid VPN clients. I think that's a bit too far-reaching. It would be much more practicable instead to ask VPNs to disallow Utah client exits to affected sites w/o age checks -- VPN services aren't free, so VPNs basically can do age checks.

Given that this could have been written to be feasibly implemented, either this text was written to cause a controversy, or this text was written by people who don't know how things work. Either way, this text cannot be enforceable as written. The Utah legislature can easily modify this to be enforceable (see above), so it's not like a court striking this down might be playing partisan games just by striking it down.

The law is only meant to apply to citizens of Utah though. Blocking all exit relays would mean that absolutely anyone accessing that website would not be able to do so from a VPN which burdens people outside of Utah too.

The law requires blocking all VPN access.

It's impossible to have perfect knowledge of the entire set of VPN exit node addresses.

  The law likely violates the U.S. Constitution’s prohibition on passing laws that significantly burden businesses and people outside Utah’s borders.
  SB 73 burdens the rights of all internet users outside of Utah because it requires adult websites to either know every visiting user’s physical location, and then block those in Utah, or to verify every visitor’s age just in case they might be in Utah.

I would think that requiring adult websites to essentially block all VPN traffic to be pretty heavy handed and hardly a solution. Especially considering there are many reasons to use a VPN.

It's impossible to have a full and complete list of VPN exit nodes, for the simple reason that no company publishes the full list, and also technically if you set up an OpenVPN server on digital ocean and connect to that you're also using a VPN but no one would know your address is hosting a VPN server.

Let’s not forget that “dirty mormon girls” is a category on pornhub