Prominent backbench MP Sarah Champion launched a campaign against VPNs previously, saying: “My new clause 54 would require the Secretary of State to publish, within six months of the Bill’s passage, a report on the effect of VPN use on Ofcom’s ability to enforce the requirements under clause 112.

"If VPNs cause significant issues, the Government must identify those issues and find solutions, rather than avoiding difficult problems.” And the Labour Party said there were “gaps” in the bill that needed to be amended.

top 100 comments

sorted by: hot top controversial new old
[–] 352 points 1 year ago (21 children)

Just to fast-forward this dumb cat-and-mouse thing, the next step is people go back to torrenting their porn and deeper down the rabbit hole of garbage "free" websites skirting the rules.

As always, the UK is useful on the international stage because sometimes you need to be able to point at some idiot trying dumb stuff to explain to people why dumb stuff is dumb.

  • source
  • hideshow 21 child comments
  • [–] 108 points 1 year ago (2 children)

    It does feel that way. UK bureaucracy is just one giant guinea pig stunting it's own commonwealth.

    Next someone will try enforcing paper umbrellas as a solution for climate action. We'll all say, "That won't work". They'll still do it; it won't work. We'll say, "We told you so", and it won't get reversed because they're already aiming at the next foot to shoot.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 62 points 1 year ago (5 children)

    100% Brexit quickly shut up similar movements when people saw how badly it went

  • source
  • parent
  • hideshow 5 child comments
  • [–] 27 points 1 year ago (2 children)

    Now if only Trumpism would have shut down extremist right wing idiology globally.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 17 points 1 year ago (8 children)

    I’m uninformed. What’s the reason for the porn ID thing? Is it just porn or more?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 170 points 1 year ago (1 child)
  • [–] 160 points 1 year ago (1 child)

    the Government must identify those issues and find solutions, rather than avoiding difficult problems

    The government: Parents have you tried being a parent to your children?

    Parents: Oh lord no that's too difficult can't you just, I don't know lol, ban it or something?

  • source
  • hideshow 1 child comment
  • [–] 147 points 1 year ago (3 children)

    This ends with just another war on encryption.

    When encryption is legal, they can't know what is going on between two points. They going to make is so we can only have encryption to nodes they trust?

    It is dangerously technologically illiterate to wage war on encryption.

  • source
  • hideshow 3 child comments
  • [–] 17 points 1 year ago (2 children)

    Jokes on you, e2e encryption is already banned in some cases in the uk afaik. Hence apple dropping some cloud services

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 1 year ago

    Easy enough to do when it's mega corps. They don't really care about anything but money. If everyone had self hosted services with e2e, be far harder. Encryption is everywhere now.

    So they will go after the end points. Which again, is a battle they can't win. All very Cory Doctorow's "Unauthorized Bread".

    If you care about this stuff:

    UK: https://action.openrightsgroup.org/make-one-donation US: https://www.eff.org/pages/donate-eff EU: https://my.fsfe.org/donate

    There will be others too, those are just in my head's cache.

    Some how we need to get governments to listen to us serfs instead mega corps and authoritarian police/spooks.

    The world they want is not only terrible for digital and political freedom, but competition, thus functioning markets. It's terrible for making developers and makers instead of dumb consumers, which in turn, is terrible for technology and progress.

  • source
  • parent
  • [–] 120 points 1 year ago (16 children)

    Best of luck with that, idiots. How are you planning to tell the difference between my personal VPN and my work VPN?

  • source
  • hideshow 16 child comments
  • [–] 27 points 1 year ago (8 children)

    Either just banning remote work or more realistically you'll need a permit for running a vpn server. Permit pricing starting at 100k a year

  • source
  • parent
  • hideshow 8 child comments
  • [–] 12 points 1 year ago (7 children)

    How many small businesses can afford such permit? Hell, I'd argue that even bigger companies will have a problem paying for that.

    Also, what if I just connect to a vps overseas and set my exit point there? Will they ban vps too? This is gonna be so much fun to see from the outside

  • source
  • parent
  • hideshow 7 child comments
  • [–] 19 points 1 year ago (5 children)

    How many small businesses can afford such permit? Hell, I'd argue that even bigger companies will have a problem paying for that.

    Feature, not a bug.

    They want people back in offices to help landlords and property prices. This way they can say that remote work is not banned and it's just companies choosing not to buy a permit and offer it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 11 points 1 year ago (4 children)

    I work from office and i regularly use a vpn at work to connect remotely to devices that are not physically with me. Not to talk about companies that provide remote assistance and use them to connect to their customers devices.

    Remote work is just a byproduct of vpns, but not the real reason why you use them at work.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 7 points 1 year ago (3 children)

    You think given how well thought through this online safety act has been that they'll understand that would be an issue and legislate accordingly?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 1 year ago (1 child)

    Absolutely not, of course. I'm just hoping they try to enforce this so a shitstorm of proportions only seen in the brexit will ensue.

    One thing we must acknowledge to these idiots is how much effort they put on showing the world the consequences of extremely stupid acts so the rest don't have to do it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 28 points 1 year ago (2 children)

    Well we just fire you, and the one you’re still using then must be your personal one!

  • source
  • parent
  • hideshow 2 child comments
  • [–] 79 points 1 year ago* (24 children)

    It would have been smarter for the UK to mandate that every ISP must provide a family filter for free as part of their service. Something that is optional and can be turned on or off by the account holder but allows parents to set filters (and curfews) if they want. They could even require that ISPs require new signups to affirm if they want it on or off by default so people with families are more likely to start with it enabled.

  • source
  • hideshow 24 child comments
  • [–] 32 points 1 year ago (18 children)

    The problem is that content filters don't work all that well in the age of https everywhere. I mean, you can block the pornhub.com domain, that's fairly straightforward ... but what about reddit.com which has porn content but also legitimately non-porn content. Or closer to home: any lemmy instance.

    I think it would be better if politicians stopped pearl clutching and realized that porn perhaps isn't the worst problem in the world. Tiktok and influencer brainrot, incel and manosphere stuff, rage baiting social media, etc. are all much worse things for the psyche of young people, and they're doing exactly jack shit about that.

  • source
  • parent
  • hideshow 18 child comments
  • They know. The "think of the children" angle is just cover to enrage the tabloid readers and to be used as a straw man against anyone criticisng the law ("you're a pedophile"). The real purpose is "let's enumerate the IDs of everyone who uses the internet for anything we don't like" and "let's censor anything we don't like starting with LGBTQ content"

  • source
  • parent
  • [–] 1 point 1 year ago (16 children)

    That's a problem is for ISPs and content providers to figure out. I don't see why the government has to care other than laying out the ground rules - you must offer and implement a parental filter for people who want it for free as part of your service. If ISPs have to do deep packet inspection and proxy certs for protected devices / accounts then that's what they'll have to do.

    As far as the government is concerned it's not their problem. They've said what should happen and providing the choice without being assholes to people over 18 who are exercising their rights to use the internet as they see fit.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 1 point 1 year ago (4 children)

    That’s a problem is for ISPs and content providers to figure out

    No, there are very good technical reasons why this approach can't work.

    ISPs ... deep packet inspection

    There is no deep packet inspection on properly encrypted TLS connections. I know TLS termination and interception and recertifying with custom certificates is a thing, but even if it were feasible to implement this on millions of client computers that you don't own, it is an absolutely god awful idea for a million reasons and much worse for privacy and security than the age-gate problem you're trying to work around.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (3 children)

    Actually it can be done and is being done. Software like Fortigate Firewall can do deep packet inspection on encrypted connections by replacing certs with their own and doing man in the middle inspection. It requires the browser has a root CA cert that trusts the certs issued by the proxy but that's about it. Filtering software could onboard a new device where the root cert could be installed.

    And if Fortigate can do it then any filtering software can too. e.g. a kid uses their filtered device to go to reddit.com, the filter software substitutes reddit's cert for their own and proxies the connection. Then it looks at the paths to see if the kid is visiting an innocuous group or an 18+ group. So basic filtering rules could be:

    1. If domain is entirely blocked, just block it.
    2. If domain hosts mixed content, deep packet inspection & block if necessary
    3. If domain is innocuous allow it through

    This is eminently possible for an ISP to implement and do so in a way that it ONLY happens when a user opts into it on a registered device while leaving everything open if they did not opt into it.

    And like I said this is an ISP problem to figure out. The government could have set the rules and walked away. And as a solution it would be far more simple that requiring every website to implement age verification.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (2 children)

    I know how it works, so spare me the explanation. It's not that as easy as you make it out to be. OS and browser companies are actively fighthing "rogue" root CAs and making it harder and harder to use custom CAs, especially on mobile devices.

    And for good reason, because by accepting a rogue root CA that's not your own, you're basically undermining the whole trust system that SSL is based on and surrendering all your online privacy and security to the government and your ISP. Whoever has control over that custom root CA has the keys to your online life.

    Rolling such a system out countrywide is utter madness.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (1 child)

    You obviously didn't know how it works if I had to explain it was already possible. And I am not aware of any mobile device that prevents you installing a new root CA.

    And it isn't "madness", it's a completely workable way to offer filtering for people who want it for kids and have no filtering or censorship for anybody else. It is a vastly better option than onerously demanding adults provide their identity to random and potentially adult themed websites where they could be victims of identity theft or extortion

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    You obviously didn’t know how it works if I had to explain it was already possible.

    If you read my comment properly, you'll see that I wrote: "I know TLS termination and interception and recertifying with custom certificates is a thing"

    And it isn’t “madness"

    Yes it is. TLS interception should never be normalized because it breaks the chain of trust upon which TLS is based. It can be useful in some situations, like the fortigate firewall where you control the certificate, but ISPs nor the government should be trusted to wield this power over virtually the whole country. It is a very slippery slope.

    I am not aware of any mobile device that prevents you installing a new root CA.

    On Android, apps can't install their own root CA. The user has to manually download it, then jump through a bunch of hoops and deeply nested menus to install it and in the process ignore all the scary warnings that their communication may be intercepted if they install and trust this certificate, and (at least on Pixel phones) they get a permanent warning in their notification tray that someone may be eavesdropping on them. Which is correct.

    It is a vastly better option than onerously demanding adults provide their identity to random and potentially adult themed websites where they could be victims of identity theft or extortion

    I'm strongly against government mandated age gates myself, but you're objecting for the wrong reasons. You're not providing your identity to the adult website. You're providing it to the third party identity verifier, who then certifies to the adult website that you are an adult without passing on your actual identity. Keep this in mind when you're arguing against it, because pro-age-gater puritans can use it to undermine your argument.

    I object to it first and foremost on principle. I shouldn't have to request permission from a third party or the government to do perfectly normal legal adult things in the privacy of my own home.

    Secondly, there is still a privacy problem at the "identity verifier". They may swear up and down that they do not store my identity data, but there is no way to prove that one way or another so I cannot trust that my data can't be leaked through them.

    Thirdly, when viewing adult content, I don't want there to be any association between my real identity and the adult content whatsoever, even through a third party, and I don't want there to be anything that uniquely identifies me.

    Finally, I object to the (re)demonization of all things sexual in our societies. We seem to be backsliding into puritanism under the guise of protecting the children, while we're doing nothing to protect them from real actually harmful online things that are damaging the younger generations beyond repair.

    I have a Gen Z stepson, and all the ways in which he is fucked up by the online world (no attention span, permanent online-ness, no real world friends, always seeking instant gratification, unrealistic expectations about life, an overly materialistic worldview, plenty of manosphere bullshit, ... ) have precious little do do with viewing porn.

  • source
  • parent
  • [–] 1 point 1 year ago* (10 children)

    @arc99 @SpaceCadet thats basically allowing the Government to force the ISP's to build a solution which is able to sensor every content. Sorry there is alot of reasons why you should be against it.PS: even your deep packet inspection falls short to end 2 end encryption / decryption ...

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 1 year ago (9 children)

    Deep packet inspection already happens on encrypted traffic (Fortigate Firewall) so it's eminently possible for filtering software to do the same.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 1 year ago* (8 children)

    @arc99 please inform yourself about end to end encryption and decryption. All i say is you haven't understand what is happening on this firewall and what this firewall can do and what the firewall can't do.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 year ago (7 children)

    I'm intimately aware about what it can and cannot do. And it can intercept and man in the middles any https traffic

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 year ago (6 children)

    @arc99 but end 2 end encryption is not by default https traffic ;) ssh / vpn are protocolls ( end 2 end encryption, decryptio) and this firewall can't deep inspect while this protocoll can easy tunnel other tunnels.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (5 children)

    I really do not know what you are saying. I have just told you that Fortigate Firewall can and does do deep packet inspection on https connections. It does so by man in the middle proxying. If one filter / proxy can do it then any other could too. There would be ways for kids to circumvent this, e.g via VPN but that is no different than with age verification.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (4 children)

    @arc99 I said (picture) your deep inspection falls short to real end 2 end. You said your firewall can break end 2 end ... nope they can't and never will and you exactly said this in your last post too. (Sidenote -> i can gpg a text and post it public even with https .. for 99% it will be giberish and only the person who got the right key material will be able to read it ) ... so using deep package inspection to identify something you want to protect kids from is just a lie ...

    your deep inspection falls short to real end 2 end (copy of a former post in this conversation )

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    I honestly do not know what you are saying. Deep packet inspection through a firewall that does mitm interception demonstrably happens. It is not up for debate.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago* (last edited 1 year ago) (2 children)

    @arc99 you still don't understand end 2 end encryption. Yes man in the middle decryption can be done. First for this to happen you need to accept the certificates of the firewall ( which in terms of a home PC you can't force anyone to do ). Second even if you can decrypt the https packets , you can still put an additional layer on top which only you and the reciever has the keys too. To give you an example you can easy write down a base64 encoded binary blob in any text field on a website. If this binary blob has been encrypted before noone will be able to tell what is inside.So breaking https is useless if someone really wants to hide informations. So no your deep packet inspection is totally useless. The only thing you know is that someone did put strange stuff in a text on a website.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago* (1 child)

    No, YOU don't understand end to end encryption, and you don't understand browsers. You say you could "write down a base64 encoded binary blob on a website". Yes you could and how do you decrypt it? The asnwer is with a key (asymmetric or symmetric) that the recipient must have in memory of the receiving software - the browser that the filter has already intercepted and compromised. So "moar layers" is not protection since the filter could inject any JS it likes to reveal the inner key and/or conversation. It could do this ad nauseum and the only protection is how determined the filter is.

    But this is also a nonsense argument just on a practical level. The problem is kids connecting to adult websites, or websites with some adult content. The filter doesn't need to do much - either block a domain outright, or do some DPI to determine from the path what part of the website the browser is calling. The government thinks it reasonable that every single website that potentially hosts adult content should capture proof of identity of adults. I contend that really the issue is kids having access to those websites at all, and that proxies can and would be a far more effective way to control the issue without imposing on adults. No solution is perfect, but a filter is a far more effective way than entrusting some random website with personal information. Only this week somebody found an app that was storing ids in a public S3 bucket compromising all those users. Multiply that by hundreds, thousands of websites all needing verification and this will not be the last compromise by any means.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    @arc99 the same way as you did encrypt it ??? with gpg ? stackoverflow.com/questions/35???? the needed certificate are exchanged by for example a matrix / telegram or personal ????And don't underestimate kids ... Or better asked yourself how did they get porn in the 80s and 90s ??? ( and yes they did )PS: and honestly imho this hole "protection talk" is totally nonesense or are parent's not anymore capable of protecting their kids? Tell my one reason why a kid < 16 should have access to internet without supervision ? An Emergency Call can still be done without internet. This hole discussion is like if you would had let a Porn VHS in the 80's unlocked in the living room and your kid unsupervised for hours in the living room. Would have someone called in the 80's to audit if your porn has been stored kids savely you would have gone crazy.PPS: Just because you don't have statistic's how many kids watched adult content in the 80's or 90's doesn't mean it didn't happen !!!

  • source
  • parent
  • [–] 22 points 1 year ago* (last edited 1 year ago) (1 child)

    The new Christian nationalist orders are not so patient. Even Charles X of France rolled back rights too speedily, sparking public outcry resulting in Parisian haircuts. (a bit off the top 🪟🔪)

    SCOTUS used to be sneakier, carving out sections of fourth- and fifth-amendment protections, but since Dobbs the Federalist Society Six have tossed subtlety and reason to the wind and now adjudicate away rights based on vibe and conservative rhetoric grievance.

    Hopefully the US and UK both will recognize why the French public was swift to act when manarchists took shears to the Napoleonic Code.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 20 points 1 year ago* (last edited 1 year ago)

    The problem is that they're not trying to protect kids. They're trying to be like China where every user has to identify themselves so they can be tracked across the internet.

  • source
  • parent
  • [–] 6 points 1 year ago

    Crazy because every (isp provided) router I have used has these options. They probably aren't 100% correct all the time, but it would be good enough for children (even though you shouldn't rely soley on filters to replace watching your kid).

  • source
  • parent
  • [–] 229 points 1 year ago (5 children)

    This kinda proves that it was never about the children. How many children have know how and the means to buy a VPN subscription?

  • source
  • hideshow 5 child comments
  • [–] 27 points 1 year ago

    All it takes is one big brother/sister that knows how to access a free or paid VPN and their 5 year old little sibling and all their friends will have it also. Despite the difficulty teaching them math or history, they DO learn very quickly and are fast to figure out new things that interest them.

    Do you know what's smarter and more talented the the UK government?

    14, 402, 544 kids............

  • source
  • parent
  • [–] 6 points 1 year ago

    I started using a VPN after my friends/classmates told me about them in my Sophomore year of HS, mostly to get around the Wifi banning us from accessing certain apps (social media). Now, like all the other dumb kids, I used whatever they recommended, which was some shitty "Free" VPN that was probably stalking my data. But by Senior year, I smartened up and learned about online privacy and got myself a Proton VPN subscription after using the free version for a bit.

    So yeah, I could totally believe middle-school and up are using VPNs, cause that's what we literally did.

  • source
  • parent
  • [–] 67 points 1 year ago

    "It has come to our attention that we haven't fascismed hard enough, nor in sufficient detail"

  • source
  • [–] 63 points 1 year ago (2 children)

    Maybe if they see significant issues with the populace adhereing to this law they should identify the solution of revoking the unpopular law.

  • source
  • hideshow 2 child comments
  • [–] 59 points 1 year ago (1 child)

    Come on UK, just skip all the boring parts and make unremovable collars for everyone fitted with GPS, cameras and miniature bombs that can be remotely detonated. After all, that's the only way to make sure nobody is doing bad, very bad illegal stuff and to PROTECT THE CHILDREN, isn't it? Fucking hell, these fucks really are trying to create a bloody dystopia...

  • source
  • hideshow 1 child comment
  • [–] 55 points 1 year ago (2 children)

    I’d email my MP to ask why this Labour Government is using the BBC to promote Reform talking points and implementing brain dead Reform policies, but I don’t expect anything other than the blandest party line response.

  • source
  • hideshow 2 child comments
  • [–] 107 points 1 year ago (11 children)

    If they outlaw VPNs then all internet-connected businesses will flee and everyone will just move to the dark net. Then you’ve got a whole other problem.

    These ancient tyrants are in over their heads.

  • source
  • hideshow 11 child comments
  • [–] 4 points 1 year ago (2 children)

    If they do outlaw it will likely be banned solely for non-business use for this reason alone.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 1 year ago (6 children)

    Honest question but what makes you think that would happen? Do most businesses use VPNs?

  • source
  • parent
  • hideshow 6 child comments
  • [+] 32 points 1 year ago (1 child)
  • [–] 10 points 1 year ago

    Not only that, but they are crucial for network security. VPNs allow all network traffic (with a few necessary exceptions) to be routed through the company's network and benefit from its security measures, mainly monitoring traffic for suspicious and malicious behaviour. Without it, finding compromised PCs is much harder and enforcing company policies regarding web use would be impossible outside the office.

  • source
  • parent
  • load more comments
    view more: next ›
    29 comments in c/technology@lemmy.zip view that post