1337
VPN only with ID check in UK? (thelemmy.club)
submitted 6 months ago by to c/privacy@lemmy.world
164 comments fedilink hide all child comments
 

https://mastodon.online/@mullvadnet/116087059413472819

you are viewing a single comment's thread
view the rest of the comments
[–] 121 points 6 months ago (9 children)

So...what's the point in even using a VPN, if you have to identify yourself just to use it? The whole point is to browse the web anonymously.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 58 points 6 months ago (3 children)

    It's not the only use. VPNs can be used to access local servers remotely, for example your jobs server while WFH.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 16 points 6 months ago* (last edited 6 months ago) (2 children)

    I'd take it a step further and say it's not even a use of a VPN at all. If you want to browse the web anonymously a VPN doesn't provide that guarantee: it only affects your source IP, which most services probably understand is unreliable for tracking purposes anyway.

    Even for changing your IP to aid in being anonymous on the web, TOR is the network layer tool to use, because you will have a much wider range of source IPs than the single one you'll get from the VPN, but there is still so much work to do to "browse the web anonymously".

    I think a lot of people don't understand VPNs. They're great privacy tools if you don't trust the local network or your ISP, as all traffic is typically encrypted and headed for the same server, but being anonymous on the web is way more involved because you are much more than your IP address.

    Btw I'm not replying here thinking you don't understand all that; just expanding on the conversation

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 14 points 6 months ago* (last edited 6 months ago) (1 child)

    First: VPNs are also used by businesses to allow access for remote workers and sites to the company's internal network. In fact, this used to be their most common use and maybe still is.

    Second: what's stopping a foreign VPN provider from offering a VPN service to UK customers without forcing them to identify themselves? If such a company doesn't have UK owners, workers or assets all that the UK authorities could do to enforce a court judgement against them is force British ISPs to block the IP addresses of that provider's VPN servers, which would easilly turn into an a whack-a-mole situation, more so if VPS providers started selling "easy personal VPN server setup" facilities for their virtual personal servers which would make that an insane whack-a-mole situation.

    The "VPN server on a rented VPS" situation could easilly turn trully insane to try to block - there are A LOT of VPS providers outside the UK selling pretty cheap services good enough to run a personal VPN server and even without the VPS providers leaning into it by providing an out-of-the-box option (and merelly supporting Turnkey Linux images means having two linux server images that work as VPN servers out of the box), step by step instruction of how to make it work with normal server distros will soon emerge and become common knowledge amongst Britons with even just basic technical skills.

    In summary, the UK is a pigmy trying to look like a giant when it comes to how much their laws will influence foreign VPN providers in a market which is pretty competitive and were there is no one dominant market participant which can be pressured to have an implementation "for UK customers only", and even if they found a way to enforce that law on all foreign VPN providers, that's not enough at a technical level to stop people altogether from having access to no-authentication VPN service since anybody can rent a VPS anywhere and run their own VPN server in it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 6 months ago

    I agree that technically, this is almost impossible to implement. To begin with, traffic can be tunneled through a variety of protocols. I used to evade my school's filtering by tunneling over https, which was a form of VPN for the purposes of this discussion. It would be a game of whack-a-mole at best in order to identify 'rogue' VPN traffic out of the giant pile of normal encrypted sessions. Duration, maybe, but then the VPN software could just establish a new session to a new endpoint every random amount of time; VPNs become more expensive and slower, but don't go away.

    Outlawing encrypted traffic altogether would break so much of the internet that it will never happen.

    I'm a little tin-foil-hat about this right now, but I think this could be an anti-worker policy at least as much as it is anti-privacy. We keep talking about how all companies are using VPNs. What if this is being pushed to force all remote workers give up their privacy as a way to urge people back into offices. Company XYZ says, "You can still work remote, but the law says you'll have to do a biometric scan of your face every time/week/month in order to use the VPN."

    And if companies get exempted somehow... then I've got a great idea for a new startup: "EnVeePee is a company which pays literally nothing to our contractors, and we expect them to be online for hours a day working really hard for us. We also expect them to contribute to the monthly pizza party."

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 6 months ago

    what’s the point in even using a VPN, if you have to identify yourself just to use it?

    Having to identify doesn't mean they can see inside the tunnel or that your VPN IP can be traced back to you.

  • permalink
  • fedilink
  • source
  • parent