Pondering routing more of my traffic via nodes outside the UK

It's either that or I just consider the internet dead and move on. It's nothing like it was 20 years ago anyway. There are other things to do. Many books to read and places to go. We had something really cool and we were lucky to experience it while it lasted, but it's gone now.

1. Nginx Proxmox LXC container with domains that require digital ID such as X. I can easily add or remove domains to it via Ansible.

2. Mullvad VPN server/client setup on OPNSense

3. OPNSense Firewall rules with aliases from the local lists from step 1

4. Every time I access X or whatever, OPNSense firewall rule redirects that traffic via the Mullvad VPN Gateway bypassing the digital ID enforcement

5. I host Pihole + Unbound recursive DNS so I have full control over my DNS. Recursive DNS uses the 13 root nameserver, I do not use public DNS such as Google or whatever, in fact, they are all blocked.

My data under my control.

I wrap the outbound sock5 traffic in mTLS, so it should look "normal" to anyone packet sniffing (not obvious proxy/VPN traffic), even though stealthiness isn't part of the threat model at the moment.

If the government blocks Mullvad then I’ll just switch to Wireguard on a Helsinki based VPS via Hetzner.

-- John Gilmore (probably https://quoteinvestigator.com/2021/07/12/censor/)

https://psyonik.tech/posts/a-guide-for-wireguard-vpn-setup-w...

For this particular use case, I would probably suggest something like OVH/Scaleway as they have nodes in France so physical distance between UK and "somewhere else" is low which will affect latency. If you're willing to wait longer and go further, I recommend Infomaniak (Switzerland - they have nodes in Geneva I think/Zurich). Hetzner (a crow favorite) hasn't been that good for me while I was in the UK, I was getting dropped packets even after switching a few VPSes, but might've just been something temporary.

VPNs are trivial to ban, the IP space is well known, Wireguard is easily to fingerprint and block.

It will be a cat and mouse game, if the government looses this they'll simply make it illegal to be caught using a VPN including Tor. Which is on the table.

The only way this changes is a less crap party, but almost all including Reform are in favour of more censorship.

Good luck, it will probably impossible as admins fed up with AI scraper bots increasingly choose to outright blanket ban anything not being a residential or business line. There's a reason why there are so many "ethically sourced proxies" aka people installing software on their smart TVs and whatnot that comes with an "monetization SDK" by one of the numerous VPN providers. That's the dirty secret behind a lot of the "bypass youtube/netflix/whatever region lock" VPNs.

New labour certainly have an authoritarian streak. I remember when they tried to introduce ID cards but there was a load of push back. But they are also somewhat friendlier to 'the youf' but this seems squarely aimed at the Daily Mail brigade.

It just seems like they're trying to out conservative, the Conservatives.

Maybe I'm trying to make sense out of something that isn't?

The current UK government don't actually care about children, if they did then they would actually investigate the child SA gangs, or holding people to account on the Epstein lists. We have seen other countries such as Australia [1] "magically" have the same idea at the same time, so this is likely a global group influencing this push.

> The current proposal to ban people under 16 - who also have the rights to freedom of expression and privacy - from some (as yet not fully delineated) social media services is likely to result in wide-spread verification.

This is the real objective, it will be just like the UK porn verification [2]. To express yourself online, you will soon need to associate your activity with your real identity. With the discussion of clamping down on VPNs, it won't be long before you need to verify your ID just to connect to the internet.

This has been a long time coming. Years ago you could buy a sim card with money already on it, use it, and then throw it away. Now you need to associate some credit card or ID with the sim card and perform some verification process.

> And so, for the first time, I am considering locating something (perhaps a WireGuard node, or a SOCKS proxy, or a recursive DNS server / DNS proxy, or perhaps all of them) somewhere on the Internet outside the UK, so that I can route some traffic through that, as needed, to maintain my access to the web.

It won't be enough. At some point the UK government will just mandate that they should be allowed to perform deep packet inspection, and then there will be nowhere left to hide. These changes are also being rolled out everywhere - which Country do you trust to run your data through?

I remember the New Zealand Christchurch attack on a mosque, and how multiple governments around the world pressured Facebook to remove it entirely [3]. They were more worried about people seeing and sharing the attack, than the attack itself. The manifesto was entirely banned [4], and people were left entirely dependent on the state to convey a narrative about the attack.

I have a feeling that this all fell out of the "Christchurch Call" [5]. I don't think this recent push spearheaded by them, but I believe it had a large influence on the efforts now ongoing.

[1] https://www.bbc.com/news/articles/cwyp9d3ddqyo

[2] https://www.ofcom.org.uk/online-safety/protecting-children/a...

[3] https://www.bbc.co.uk/news/business-47620519

[4] https://www.theguardian.com/world/2019/mar/24/censor-bans-ma...

[5] https://www.christchurchcall.org/

I've felt this slide in the UK for a long period of time. I route _all_ of my traffic through Mullvad with DAITA [1] because I think it's the only the likes of chaffing and winnowing [2] that can defeat traffic analysis. The endpoint changes. I have a high-end SBC router. For the moment, I do not obsfucate the fact that the tunnels exist and are wireguard. Mullvad can disguise them effectively with QUIC / SNI obsfucation, or even vless / xray / vmess. They're quite good at that.

I also have an Amsterdam VPS and it runs wireguard. My phone has a wireguard client to it. It's a reputable VPS provider from a major cloud hosting company. It has a reverse WG tunnel to my house not through mullvad (I have a public IPv6 address range, but not IPv4); my phone (and partner, friends etc phones) get access to my local servers and resources and then all traffic goes out anonymously through mullvad. I also have another VPS, paid for in cryptocurrency (XMR) that I mine in the winter (the waste heat is cheaper than gas heating where I live, if you assume the compute is paid for...). This acts as a port forwarding host and it connects via another WG tunnel or two to my server, doing tunnel-in-tunnel, but essentially is a reverse proxy host.

I naturally run a recursive resolver _and_ dnscrypt on the ISP connection for bootstrapping.

This gives me _some_ degree of anonymity, I feel, online: I've inspected the traffic going through the ISP router and you see remarkably little, especially with QUIC SNI spoofing turned on. The volume of traffic is quite large and probably idiosyncratic – the endpoints are known – which is the biggest problem amongst all of this. But I have _privacy_ and for me that matters a lot.

I think this age verification, KYC, show your faces stuff is organised internationally on two very simple predicates:

1) Disinformation or political interference provided by Russia and possibly China have affected national election results in many democracies (Brexit, likely Trump, probably more). Controlling the narrative is increasingly viewed as absolutely required by the political class. This is difficult with social media, and strong identity verification makes it more obvious where at least your enemies are.

2) Online actions are increasingly having real world consequences and the establishment wants to be able to more easily _punish_ those people who have broken "the law". This is related to, but distinct from, point 1. There are plenty of examples of this in the UK – but more widely spread worldwide. Having strong identity verification makes it easy to catch people, and if you do that enough, change behaviour (the single biggest determinant of which is shortening the time between "offending" and being caught).

Minor points I think behind this are:

1) A fear of a large-scale war and worries about information security, population influence, and associated military shadowy figures saying things

2) A fear (or fact) of encryption making any sort of content dragnet much harder. Most large web presences undoubtedly have backdoors but genuine p2p without exposed metadata is a fear of the spook community because they kill people on the basis of metadata and machine learning state-of-the-art...as it was in 2014 [3] -- I am sure they do the same now. The reason for metadata is that it is accessible, by design, everywhere. VPN ± tor usage is probably ubiquitous amongst some genuinely bad actors, and they will have spent considerable resources being able to unmask those actors. Depending on the technique, it may genuinely make it much harder if there is a large fraction of the population actually using those tools.

3) Some genuine transnational rise in avoidable harm, like CSAM; some genuine transnational rise in political harms, like the (oft-religious) right.

[1] https://mullvad.net/en/vpn/daita [2] https://en.wikipedia.org/wiki/Chaffing_and_winnowing [3] https://arstechnica.com/information-technology/2016/02/the-n...

"who also have the rights to freedom of expression and privacy", plenty of outlets for people to be expressive in the UK (more so than in the US for example, where the right wing will obviously attack any social media restrictions) that don't involve being fed junk divisive content from mainly US tech companies.

Privacy != anonymity.

Feel free to route your traffic via Wireguard. As long as it is not setup as a service for the mass evasion of age gates by children.