Porn restrictions are leading to a VPN boom

I just want to mention a few things: Fallback, other DNSs like 1.* and Mullvad's free DNS with more options

    # Standard
    1.1.1.1
    1.0.0.1
    2606:4700:4700::1111
    2606:4700:4700::1001

    # Block Malware 
    1.1.1.2
    1.0.0.2
    2606:4700:4700::1112
    2606:4700:4700::1002
    
    # Block Malware & Adult Content (not useful for this case)
    1.1.1.3
    1.0.0.3
    2606:4700:4700::1113
    2606:4700:4700::1003

Mullvad also offers *free* DNS[1], which also supports encrypted DNS

    # DoH is port 443 and DoT is port 853
    # Standard
    dns.mullvad.net
    194.242.2.2
    2a07:e340::2

    # Block Trackers
    adblock.dns.mullvad.net
    194.242.2.3
    2a07:e340::3

    # Block Trackers + Malware
    base.dns.mullvad.net
    194.242.2.4
    2a07:e340::4

I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection"

I am *NOT* a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. Technical forum, so let's get technical and learn ^__^

[0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht...

[1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

This has resulted in the Turkish military having a very large collection of amateur gay porn.

I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT.

Think about accuracy, which is correctness, completeness, and consistency:

Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc.

When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb.

In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier).

It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites.

These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.

DNS queries still leak the domain unless the client is using DoH.

1. Gay porn is not specifically blocked in Turkey, porn is; so gay porn watchers would be mostly indistinguishable from any porn watchers via their evasion techniques

2. Not that it matters as you are free to be gay in Turkey

3. Not that it matters again, because access to blocked content is never prosecuted. No one ever receives letters from their ISP even for pirating

4. Calling the internet state controlled is a bit far imo, smaller ISPs don’t even apply some blocks and comparatively USDoJ can do domain seizures which is not too different from what happens there (websites being blocked via court orders and “administrative preventative measures”). Although I’d agree that the line for blocking is drawn too close.

5. I also wouldn’t call Mersin very conservative, the left CHP just won the municipal election with ~60% of the votes

One last thing, ISPs have moved on to using DPI to block websites so you might wanna suggest something like green-tunnel so they can up their game.

At the religious private high school I attended, all it took to make a student a “hacker” was popping open Internet Options on the computer lab’s XP boxes and disabling the proxy they were using. Had to sneakily do this sometimes not to view blocked stuff, but to just have a working internet connection to complete assignments with because the proxy service was provided by some terribly run local company that must’ve been three Staples special Celeron Compaq Presarios and a Linksys router in a shack somewhere, because they were constantly having outages.

That was a thing even back in my day, when LTE availability was not a given and cellular packages were much less generous.

(asking for a friend, obvs)

I tried AlphaVPS and another and I had no luck with the traffic routing out of the VPS. Went with a droplet in DigitalOcean in the end that's managed through Portainer. Works a treat and equivalently cheap.

payable with Monero

I feel this statement in my bones.

We have one side making all the laws, the other side doing away with laws, both of them acting solely for political points.

No one in the middle is “radical” enough (by definition) to push back. Hard to see how that doesn’t end in major conflict with a single winner, as you say.

https://news.ycombinator.com/item?id=36113215

They also work with Tailscale which makes per-device setup easier: https://mullvad.net/en/blog/tailscale-has-partnered-with-mul.... Tailscale was using a bit too much of my iPhone battery last I tried it out, but they're at least aware of it.

I set up wireguard and unbound on VPS in Amsterdam and share with 10-15 people by posting wireguard config in private telegram channel.

Ironically enough, but I block porn access using StevenBlack hosts converted into Unbound config by awk script, so porhhub dot com will return REFUSE dns response from unbound.

I know, that is not impressive idea of how to utilize computing power of the VPS, but I also used it for running tor snowflake (disabled because of eating too much ram), running tor obfs4_proxy (would also eat much ram, but that can be adjusted, I don't remember clearly why I disabled it at one point) and I used it as a server for Postgres that I tried to use for uni's coursework on databases.

Maybe I am too lazy to setup tools like zapret for bypassing deep packet inspection locally on my laptop or on router. But still there should be a ton of things that can be done on the same vps.

If it is for more regular use or if the occasionally slowness/vpn blocking is too much, I would likely pick mullvad but I have not used their services. They do seem to spend some money on pro-privacy activism, so that is at least a point in their favor.

I set up an OpenVPN server on DigitalOcean for a friend visiting China. It took 10 minutes with the template in the DO marketplace.

It even allows downloading a client with the parameters baked in.

Is this vpn provider trustworthy?

No one forces anyone to gamble.

Well... companies. They don't ban government agencies from retaining that data if they get access to it. But ignore that and assume for a second that they do.

The problem is that the laws kind of contradict themselves: "don't collect information that compromises privacy" and also "do this in a way that basically could only work if you collect information that compromises privacy."

Most of the bills I've read ban companies from saving this data, but require them to collect it presumably in some way that's auditable? They also provide no real mechanisms for guaranteeing that data won't be stored or will be transmitted securely between services. In Louisiana's bill (https://legis.la.gov/legis/ViewDocument.aspx?d=1289498) there is no penalty for retaining data other than that users can sue for "damages". But historically, proving damages from retained data tends to be difficult to do.

Of course the laws do not clarify how age verification is supposed to work under these restrictions, just that documents will be verified somehow: Texas's "example" of age verification explicitly refers to digital identification as information "stored on a digital network" (https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F....). But sure, also make sure you don't store anything! /s

Presumably this all means that the information should be stored and transmitted until identification is done and then immediately deleted leaving no record of that identification other than that it happened (which hopefully will be sufficient evidence if the government ever accuses you of using a faulty verification method). But eventual deletion doesn't mean the information isn't still getting temporarily stored or that it's not passing between multiple hands, any of which could have rogue employees or leaks, or which could be storing "anonymized" data that turns out to later-on be identifiable.

----

One might argue that since the majority of these laws are proposed and backed by anti-porn organizations, the contradictions might kind of be advantageous to the goals of the backers -- if the law is functionally impossible to comply with and companies are forced to leave the state, well... that's exactly what these groups want anyway. Texas's AG is up-front about being pleased that porn companies are blocking the state. And despite the regular claim that this isn't about restricting porn generally, the vast majority of these bills have ties to religiously conservative groups that have public positions that porn should be banned for everyone.

But that's all besides the point: the point is it's just outright false to say that these laws don't require at least the transmission and collection of this data -- they just tack on "don't store it for too long, delete it afterwards." But that doesn't really mean anything: regular identity transmission over the web carries security and privacy risks even if companies could be trusted to reliably delete this data -- which in many cases, they can't. Advocates of these bills ignore that security researchers have an issue with collection and transmission of sensitive data in addition to storage, and so advocates point to narrow, non-specific language about long-term retention as if that solves all of the issues. It doesn't.

And to the extent that these laws include any real teeth like actual fines for data leakage, they don't really explain how companies can safely avoid those fines while still proving that their users aren't minors. It's a no-win situation.

Note as well, I'm leaving off the accusation I've seen online that this identification would need to be provided per-login/access, because I don't see any language in the bills that would suggest that to me. But of course if that were true, there would be obvious security risks from users providing that information repeatedly as part of regular access.

----

> That's a social media law, not a porn law

The law in question explicitly exempts art sharing sites unless they allow specifically porn (https://le.utah.gov/xcode/Title13/Chapter63/C13-63_202305032...):

> (H) a professional creative network for showcasing and discovering artistic content, if the content is required to be non-pornographic;

Notably, general content harmful to minors like gore, hate-speech, etc is included in that exemption. So your creative gallery site doesn't count as social media and isn't subject to these child-restrictions if you allow nazi emblems or violent imagery, it's only a problem if you allow porn.

I will concede on this that conflating the exact language of "change or bypass restrictions on access" is a straightforward misreading of the bill, bad on the article for that. But I think it's being a little coy to act like there's no overlap between Chapter 63 and SB 287. Chapter 63 clearly views pornographic content differently than it views other content that is similarly harmful to minors.

SB 287 includes language that seems (to me) to explicitly protect VPN and network providers from liability, but it is not clear whether that kind of language will continue to appear in future bills: the majority of these bills so far have been largely copy-paste templates of each other, and in other Internet restriction debates states have expressed interest in going after actors that they deem to be "enabling" illegal actions. Notably, the copy-paste template that most states have been using doesn't protect sites that allow VPN access, they just protect the VPNs themselves. It's not clear to me from the text of the bills that states wouldn't view a porn site refusing to block all VPN connections as a violation of the law if they were ever interested in pushing enforcement past state lines (which again, in other Internet speech debates states have expressed interest in pushing enforcement across state lines).

The article's example of VPN restrictions is misleading and misrepresents the bills it's talking about -- but the general concern that VPN restrictions might come in the future (most likely through targeting companies that do not block VPNs from accessing their services) is a real concern, just poorly presented in this article.

That is the problem with vice laws

Tough times

People really do control other people through not just coercion. We can see a modern way of doing this in governments and corporations, currently being called Public Relations.

Consider that control cannot be exercised completely arbitrarily. Most of the time, people who want to control have to use what they have available, so that other people don't resist as much. This means that whatever is there, it will be used for control, but it doesn't mean that the thing exists for the main purpose of control. This is circling back to liberation of all sorts - these don't happen because they want to control us, liberation is happening as a large-scale social change and people who want to control co-opt it for their own purposes. Since it's happening either way, it's an opportunity for them to further their own goals as well.