Comment by jeroenhd | Hacker News Reader

Comment by jeroenhd | Hacker News Reader

Parent Full thread

> how is anyone expected to tell that I’m accessing a website from a hotel in Berlin instead of my house in California

Remote attestation in combination with location access as a start. DPI on TCP/UDP timinings/round trip time measurements for distant locations, combined DNS leak detection to catch bad VPNs. Use browser APIs to detect WiFi vs mobile data to let some 2G users through. IPv6 accessibility checks to catch many other VPNs.

There are always technical means, as the more restrictive streaming services like to prove. There are many, many more ways websites can verify that users are not on a VPN that most websites don't bother with, and until they all do and people still use VPNs, legislators will find ways to punish websites.

The real end goal isn't to block content these people dislike within their state, of course. The goal is to go after the existence of adult websites and, in worryingly more common cases, websites discussing basic LGBTQ topics.

Technical measures while technically existing failed first in China and then in Russia lately, Russian authorities recently all but admitted that they can not block xray+reality-style VPNs (which were and are developed in China to go over their "great firewall") and now talk about a blanket ban on foreign traffic and basically a whitelist for internet.

The goal is always a perception of control of public narrative. Those people deeply care what "masses" think of them. That they measure mostly by sampling more or less public media (and I actually worked at a company in 2010s which was selling exactly that). And when they don't like what they see, they try to fix that by controlling that media, up to and including banning the whole world.

That is what is happening with all this protecting the children stuff.

Countries like China and Russia are different, in that they try to catch all communication towards every website, most of them outside of their jurisdiction. They're targeting internet users, and without installing a watchdog on either the server side or the client side, that's hard to pull off on the encrypted internet.

Laws like these target the website providers. These website providers are in control of infrastructure, they have the private keys, and they don't try to do any transparent monitoring. Browsers and VPNs are very good at protecting communications between you and a third party, but if that third party is trying to spy on you, things change. That's why governments buy data from data brokers: why bother spying on your citizens when they and their computers willingly give a few companies all the information you need.

You can't buy cocaine on the clearnet in most countries. It's not hard to switch to TOR, but only because TOR is legally accepted at the moment. Accessing TOR from China is not all that easy without at least a (government-sanctioned) Hong Kong VPN.

These legal attacks on the free internet won't stop hidden services from hosting porn videos, but they will make it very difficult to make money off of them. MindGeek and friends aren't going to risk illegality by going full dark web and moving their employees to a country that doesn't extradite to the US.

You are wrong. The goal is not to "catch all communication" whatever that means.

For the most part that has been accomplished before Snowden, and it does not help much in shaping the public opinion as they perceive it, which is the end goal.

No one cares about drugs or porn outside of them being useful labels to incite public outrage in certain cultures, like US. For example, in eastern europe no one gives a shit about that. Or your Epstein brouhaha either, reaction being - lolwut, what's the drama, they all did that in adriatic for as long as anyone can remember.

All this moral crusade is just smoke, no one behind it gives a shit about porn, children or drug money, get real.

Now cutting down freedom of expression, that's something that could help them. So they attack along the axis of denying means to execute it, as in making it hard to have a visibile discussion on internets so that less people bother. And in that targeting websites with idiocy like age/identity verification is quite useful.

No. That’s how someone with pervasive access to Internet infrastructure could tell when I’m on a VPN. It’s impossible for a given website to tell that I’m accessing it over a VPN. Not difficult: impossible. It cannot be done.

Most of these features can be employed on the website side perfectly fine.

Tools like https://obfusgated.com/tools/vpn-detection-test will use very basic timing tricks to detect VPNs, for instance. Not very reliable, but if you add data points about things like MTU size and WebRTC, and cross-reference that with GeoIP location, you could detect most VPNs. Not without rejecting a small amount of edge cases (Firefox users with JS disabled, weird browsers, and so on), but that's worth the risk if you're held liable for damages if you don't do it.

In practice, nobody really cares. Even Netflix and Disney apply "good enough" VPN detection, mostly by going by IP address, because they don't really care about whether you're using a VPN or not, they just want to make sure they and their shareholders don't allow too much piracy.

With this law, there are significant financial risks, not in an effort to combat a handful of pirates, but because of a "save the children" legal risk. That changes things for website owners.

BTW, I connected to that test using Apple’s Private Relay and it rated my VPN-ness as 0%. I stand by my point.

The test I linked is just an example of the technology (it's designed for proxies rather than VPNs, as it just uses websockets vs TCP timing).

Tests like http://witch.valdikss.org.ru/ are a bit better, although that particular one has been around for a while and is probably outdated (it flags the WireGuard VPN to my home IP as being OpenVPN, for instance).

I don't have Apple Premium so I can't test private relays, but the technology for detecting VPNs is quite sound. It's just not used very often, because there's no real incentive to detect use cases like "people VPN'ing into their home IP". The only exception I've found is maximum-security Cloudflare-protected websites, they seem to run an extra layer of CAPTCHAs when my VPN is on, but those websites are exceedingly rare and probably have some non-determinism in their CAPTCHA ruleset.

So the individual website has to subscribe to the surveillance operator's IP location verification service, or be fined.

Basically. Party of small government, my ass.

Edit: actually, not even then. In my home VPN scenario, the IP is a legitimate residential connection.

This is exactly it. Compliance is a big business. When your company's lawyers tell you you've gotta do something then you do it. Half my team is wasting time on this bullshit and big money is getting paid to those who make the lists.

Reply on news.ycombinator.com