ag1kmFeb 18
Mullvad VPN

The UK has announced plans to fast-track legislation requiring “age verification for VPN use”. The correct term, however, is not age verification but identity verification.

A law like this would require everyone to identify themselves in order to use a VPN. This would pose a risk to whistleblowers, violate human rights, and represent yet another step toward an authoritarian society.

Feb 17 at 5:05pmWeb
Show threadOmega   Feb 17
@mullvadnet "yet another step" indeed...
Show threadMike Taylor 🦕Feb 17
@mullvadnet We will all be outlaws soon.
Show threadГригорий КлюшниковFeb 17
Eventually you end up like Russia, where all commercial VPN servers have been blocked for years but everyone either knows someone who self-hosts a VPN, or uses some sketchy adware
Show threadAlexander DyasFeb 17
@mullvadnet How on earth is this even enforceable?
Show threadMichael GemarFeb 18
@alexanderdyas @mullvadnet Yeah, I don’t get it. How is the government going to prevent people from downloading VPN software?
Show threadAlexander DyasFeb 18

@michaelgemar @mullvadnet I guess they can hit the app market places, make VPN vendors comply by law. But that doesn’t cover side loading, non-mobile devices etc. Also as we’ve seen the identity verification systems are massively flawed and easily by-passed.

Like using a sieve to solve a leak.

Show threadZiege LightbocksFeb 20

@alexanderdyas

It's about the joy of Selective Enforcement and Elite Immunity.

@mullvadnet

Show threadElectroFetishFeb 17
@mullvadnet This is a struggle between commercial interests. Non-commercial projects are unlikely to be affected. VPNs are tools not only for bypassing blocks but primarily for creating your own network on top of the main one.
Show threadStefan 🧝Feb 17
@mullvadnet So everyone should use a VPN, always.
Show thread🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉Feb 17

@mullvadnet With all due respect. The UK government can go f… themselfes.

You folks are great tho ❤️ 💪 🙏

Show threadGreatLakeTroutFeb 17

@nemo @mullvadnet

This is exactly my point as well. The EU has done some great things in digital privacy laws and yet they still want to do dumb shit. I am appaled with the issues with CSAM and I agree something needs to be done. I also agree with the deplorable ways in which social media has infected society - howver, the answer is not to destroy privacy.

Show threadLeto FregarFeb 18

@greatlaketrout @nemo @mullvadnet I think a big issue here is, that politics are focusing far more on the M than on the CSA. However, the CSA does most of the harm, the M then adds insult to injury.

Problem is, actually fighting CSA takes time, requires a lot of effort, costs a lot of money and feels uncomfortable sometimes, as you sometimes need to intervene in family affairs.

Show threadOliver D. ReithmaierFeb 17
@mullvadnet lol. This is an admission of failure if I've ever seen one. Since their safety nonsense tanked due to VPN existence, they're now trying an arms race. Good luck with that.
Show threadSchrödiɲger's Enby :neocat_trans::neocat_flag_nb:Feb 17
@mullvadnet at this point i will just straight up not use the internet
Show threadPete Alex Harris🦡🕸️🌲/∞🪐∫Feb 17

@mullvadnet
They'll have to *really* fast track it if they want to pass it before we yeet them into the rubbish bin of history. Government by announcement only gets you so far when your polls are collapsing and your own guys are saying you should resign.

And even if they do, the next government can repeal it easily, because hasty legislation reactively banning things doesn't have any complicated infrastructure to tear down or budget gaps to cover. It can just go away.

Show threadColin H.Feb 17
@petealexharris @mullvadnet But do we think Nigel and Cruella will be so inclined?
Show threadPete Alex Harris🦡🕸️🌲/∞🪐∫Feb 17

@GlasWolf @mullvadnet
If they get in we all have worse problems. However, let's see.

If I had to predict, I'd say the vote will be so unprecedentedly split that there is no way for any one party to form a government without at least a confidence-and-supply deal including the Greens (or in the extreme case, the Greens+SNP+LibDem)

Deform UK Ltd simply *cannot* negotiate such a deal. So I don't think Farage's blackshirts are going to be forming the next government.

Show threadColin H.Feb 17
@petealexharris @mullvadnet I hope you're right, but I wouldn't count out Reform and the rump of the old Tory party getting over the line.
Show threadPete Alex Harris🦡🕸️🌲/∞🪐∫Feb 17

@GlasWolf @mullvadnet
The only reason I'd call that unlikely is the same reason there's any danger from Reform at all: we don't have PR.

In a first-past-the-post system, the two far right parties are going to be parasitising and splitting each other's votes in most constituencies.

Show threadPete Alex Harris🦡🕸️🌲/∞🪐∫Feb 17

@GlasWolf @mullvadnet

I'm setting myself up for the most naively optimistic prediction followed by the most crushing disappointment aren't I?

Anyway...

Show threadAmateur HumanFeb 18
@petealexharris @GlasWolf @mullvadnet just as the socialists have for the last 80 years
Show threadzbrownFeb 18

@petealexharris @GlasWolf @mullvadnet yeah it's important to remember that, whilst yes trending-down-from-30% polling figures are kinda terrifying, it really doesn't translate to 30% seats at all, especially when unlike the LibDems they don't ‘know how to play the game’.

It's still plausible enough they end up the largest seat bloc, or close to, but in practise an outright majority is unlikely — so it all come down to some sorta deal with the Tories most probably.

Show threadzbrownFeb 18
@petealexharris @GlasWolf @mullvadnet and yeah, one can only hope people will be sensible enough before or after the election to come together as a democratic alliance and beat them to the Palace.
Show threadNeil MoffattFeb 17
@mullvadnet So often, systems like government, sports clubs, businesses have such unscalable paths to the influencing of decision makers that they learn very fast that they can be authoritative and selfish with precious little interference.
Show threadKirill ChernyshovFeb 17
@mullvadnet curious timing. just about an hour ago I forged and verified my first zero knowledge proof that can tell the verifier that proof holder was born before a certain timestamp (aka. older than N years) at the same time reveling absolutely (!) nothing about proof holders, not even those who authorize it.
Show threadFluffy Kitty CatFeb 17
@dotfox @mullvadnet why are you working on tech to help the Nazis?
Show threadwojtekFeb 18
@fluffykittycat @dotfox @mullvadnet do you even grasp what "Nazi" is and what it entails?
Show threadFluffy Kitty CatFeb 18
@wojtek yes, they've taken over my country and are censoring the internet
Show threadKirill ChernyshovFeb 19
@fluffykittycat @wojtek This is a privacy tool - it protects people, not targets them. The whole point is that no one in the chain can be identified. A regime can't build a list of "undesirables" from a system that provably reveals nothing about who holds a credential. That's the opposite of what surveillance states want. Privacy tech exists precisely so that power can't be abused against individuals.
Show threadFluffy Kitty CatFeb 19
@dotfox @wojtek you forgot the part where moms for liberty types get unaccountable veto power over what certain people can see
Show threadwojtekFeb 19

@dotfox @fluffykittycat "vpn is a privacy tool" must be one of the dumbest takes ever (thank you nordvpn for pushin that dumb narrative).

you literally funnel all you traffic via single hole and in the same breath claims that "noone can identify you"… like "XD"

Show threadKirill ChernyshovFeb 19
@wojtek what are you talking about? I'm not building vpn nor claiming it is a privacy tool.
Show threadwojtekFeb 20
@dotfox shortcircuited the thread =,= and assumed "privacy tool" was about mullvad :D
Show threadwojtekFeb 19
@fluffykittycat I don't know what "your country" is (UK?) but last I checked majority of "western world" runs uncesored. Care to elaborate without using vocabulary that you seem to not grasp completely?
Show threadFluffy Kitty CatFeb 19
@wojtek age verification deanonimized people and in the USA, ICE is functionally above the law, explicitly profiling activists, and is building out concentration camps. None of these systems are gonna e built to use zero knowledge proofs because that would defeat the point. Discord switched from on-device AV to a theil company
Show threadFluffy Kitty CatFeb 19
@wojtek zero knowledge proofs talk just has the effect of legitimizing the while affair
Show threadKirill ChernyshovFeb 20
@fluffykittycat The age verification mandates are coming whether or not privacy tech exists - that's literally what the Mullvad VPN post that started this thread is about. The question is whether those mandates get implemented with systems that deanonymize people (which is what you're rightly worried about) or with systems where deanonymization is mathematically impossible.
Show threadKirill ChernyshovFeb 20
@fluffykittycat And here's the thing: the mere existence of a privacy-preserving alternative gives people a much stronger argument against invasive systems. Right now when governments push for identity verification, the response is just "don't do it." If a working ZK-based system exists, the argument becomes "there is no reason to collect identity data - you can verify what you need without it." That's a far harder argument for surveillance states to dismiss.
Show threadFluffy Kitty CatFeb 20

@dotfox "The age verification mandates are coming" because they're being pushed from on high. there's no reason we should accept this. why all of a sudden are we expected to hand over or IDs to use the internet? nothing good is intended here

furthermore, no one has ever rebutted the obvious flaw in any ZK-based system: how do you know that the ID belongs to the actual user and not someone handing out "Over 18" tokens en mass? I've asked this of people and no one's told me how they plan to stop this

discord promised up and down there were being super private and everything was all on device, and that lasted about a week and now your IDs go straight into Peter Thiel's ICE database. if we give in to "zero knowledge" how can we know that won't just happen?

no, we have to take a stand against this in it's totality

Show threadKirill ChernyshovFeb 20
@fluffykittycat How easy is it for you to get a fake identity that will be accepted as legit by some gov agency or even your local pub? My system does not reinvent the wheel here, it will be equally hard. But it solves a problem that to get to the pub you have to reveal your name, exact date of birth, address, etc. With this system, the verifier can't see that data even if they wanted to - it's never transmitted, not just "promised not to be stored".
Show threadFluffy Kitty CatFeb 20

@dotfox what's to stop me from verifying people who can't verify themselves? If you can't stop it, it's not effective. If you can, it's not anonymous. How do you square that circle?

Furthermore, who gets to decide what you need to AV for and what you don't? They've already admitted they want this for anti LGBT and pro Gaza genocide reasons explicitly. It's not innocent, not in the slightest

Show threadKirill ChernyshovFeb 20
@fluffykittycat Anonymity in my system is from the verifier, not from the issuer. The issuer (say, a gov agency) knows who you are - same as when they issue you a passport. But the website/service checking your age learns nothing about you. So: the issuer can stop fraudulent issuance (not anonymous to them), and the verifier can't track you (anonymous to them). No circle to square - these are two different relationships.
Show threadKirill ChernyshovFeb 20
@fluffykittycat and, as I said in another reply - If a privacy-preserving alternative exists, it's leverage to fight the invasive version. I'd rather have the option than not.
Show threadwojtekFeb 20
@fluffykittycat again, just because usania is a circurs run by oligarchs doesn't mean other solutions are bad/incorrect 🤷‍♂️
Show threadExit Code 1Feb 18
@dotfox @mullvadnet But I'm guessing the verification called home to let someone know which app/service you verified with, or is someone making an authorication service that doesn't need that? If so, which one?
Show threadKirill ChernyshovFeb 18
@paranormal_distribution No one. The presenter asks the verifier to publish their constraints — the trusted root authorities and the current revocation list (one way hashed). The presenter then forges two proofs locally: "I hold a valid capability delegated to me only" and "no intermediate delegator in my chain is revoked, and the delegation chain starts from a trusted root". The verifier checks both proofs against the published roots — no callback, no identity disclosure, no phone-home.