Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

It's not quite that hard. Hypothetically, you have a digital certificate, signed by the government, for your VPN provider with a list of VPN endpoints. Your client presents that certificate to the ISP, unblocking ports in that specific instance, to those endpoints. Otherwise, all common ports are blocked, and anything that smells VPN-y gets throttled.

Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed.

Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?

View on HN

As a dad of teenagers, I can confidently tell you every single school will quickly have at least one enterprising kid who will set up wireguard on an Oracle free tier box and charge other kids to use it. The government is essentially incentivising kids to dip their toes into criminality.

When VPNs design to hide themselves, which they will do as this law spreads, this problem becomes a lot harder.

Countries like Iran and China have been trying to block VPNs for years, and all they are doing now is heuristics.

For example I can tunnel traffic over a TLS tunnel. How do you distinguish that with everything else?

Heuristics again. 99% of your traffic is going to one endpoint... and it's hundreds of gigabytes, both up and down. Obvious red flag. Even an automated system could throttle it.

That step of the cat and mouse game is over a decade obsolete.

If I spent a week setting up a VPN provider, I’d start with this: 99% is spread across 100 endpoints, 55% are cloudflare, and 45% are amazon/azure/google.

A special client mode would check for non-blocked IPs in your country and have those bypass the VPN.

The government doesn't care... because no 16 year old is doing that or can afford that. And if one VPN provider did that, that specific VPN provider can have all their endpoints manually blocked by the government. In which case, the objection is irrelevant.

Also, heuristics again: 99%+ of your traffic is going to the same two or three companies only. The owners of the endpoints are not very diverse, which is statistically extremely unlikely. Throttle you to 0.5mbps, so you won't be watching anything, and call it a day.

None of this does anything to mitigate people from trading flash drives with their peers.

This is all political theater to bootstrap censorship.

16 year olds are in fact doing this.

> The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?

Speaking from personal experience, never underestimate a bored 16 year old with access to YouTube and a generous AWS free tier.

Considering Gen Z is one of the least tech-savvy generations right now, even less tech-savvy than Boomers, and unable to use anything that isn't an app; yes, I don't think it's possible to underestimate them.

A man can tear down mountains for a pussy. After these bans UK Gen Alpha and Gen Z are going to be the most skilled hackers in Western world.

Yes, the most incel/prudish generation in history is going to suddenly turn into l33t hackers?

The anglo mind loves to be subjugated. They are the ultimate bootlickers.

...most skilled wankers, you meant to say?

Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless.

They could start whitelisting money / credit card transfers, I guess. However, reputable VPN providers already accept envelopes full of cash and crypto, so I guess the UK would need to start reading all international mail, and block crypto.

At that point, people could just use tor to bootstrap the VPN account + payments.

History says teenagers will figure this stuff out before adults (due to infinite free time and infinite bragging rights for knowing how to do it).

> Those rules would only apply to VPN providers in the UK, so the whole mechanism would be pointless.

Did you miss the part where every VPN port is blocked, and all other ports have heuristics in place to detect and throttle VPN-like patterns (e.g. 99%+ of traffic going to less endpoints than you can count on one hand), unless you're specifically whitelisted?

> Did you miss the part where every VPN port is blocked

Many protocols can use https ports and packet envelope. Also, there's special censorship resistant VPN protocols, which work even in China despite its nigh-infinity money to block it via DPI

You've never been on a red team.

Reply on news.ycombinator.com