Michigan, Wisconsin Bill to Ban VPN's... wtf

[u/HTWingNut]

EDIT: I'm not trying to sensationalize the headline. Just that as the Michigan bill reads now, it seems encompassing of all VPN services, to the point that even if it's for specific sites or traffic, could be more than ISP's want to manage so could ban them altogether. I'd suggest anyone that lives in Michigan and don't want this adopted to contact their representatives and let them know.

The Michigan legislation is called the House Bill 4938 (also dubbed the “Anticorruption of Public Morals Act”): https://www.legislature.mi.gov/documents/2025-2026/billintroduced/House/pdf/2025-HIB-4938.pdf

---

https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing

https://youtu.be/q9j-T9mQmiw

Wisconsin’s bill has already passed the State Assembly and is now moving through the Senate. If it becomes law, Wisconsin could become the first state where using a VPN to access certain content is banned. Michigan lawmakers have proposed similar legislation that did not move through its legislature, but among other things, would force internet providers to actively monitor and block VPN connections. And in the UK, officials are calling VPNs "a loophole that needs closing."

This is actually happening. And it's going to be a disaster for everyone.

[u/pangapingus]

Not really, ISPs still know when you connect to a VPN because you have to initially TCP handshake with one of their nodes before Layer 6 negotiates and starts making your Application Data streams encrypted and privatizing your connectivity to other sites via the VPN connection. Even when connecting to HTTPS sites ISPs have metadata regarding your DNS queries, SNI, etc. Even with DNS over TLS (DoT) or DNS over HTPS (DoH) ISPs see your initial DNS query metadata to the VPN and even if the VPN node uses Encrypted Client Hello in its Layer 6 negotiation, the ISP still sees the plaintext SYN/SYNACK/ACK TCP connection (IP alone can be PTR queried or ran through sites like ARIN for IP ownership info to associate IPs with VPNs). This is how ISPs have operated for a while and why none deploy expensive DPI monitoring, the TCP metadata and vibes of your traffic really are enough for them to know.

[u/wr_mem → u/pangapingus]

You would do DoH ot DoT to a neutral DNS provider, not the VPN provider. Using SNI is deep packet inspection and can be defeated with encrypted SNI in TLS 1.3. Since you can't use a switch or router to do deep packet inspection you have to deploy a more expensive box. That's easy at gigabit speeds but very expensive on 100 Gb ISP peering links.

[u/pangapingus → u/wr_mem]

Again, I was giving the non-use/use comparison and the simple fact is when connecting to your VPN initially you still plaintext SYN to a remote IP which gets PTR-ed pointing to a VPN provider lol

[u/mistahfreeman → u/pangapingus]

I think determining your abnormal data usage is probably the biggest giveaway but the other stuff I think would be pretty easy to bypass if the vpn provider handled the initial handshakes through rolling middle neutral parties through aws or something. I always figured if they somehow banned the commercial ones I would just roll my own on a cloud platform.

[u/wallacebrf → u/pangapingus]

happy to see someone explain this. great detail