Earlier quoted context omitted.
TFA explains it in detail.
What's TFA?
the fucking article
Amazon threatens to suspend Signal's AWS account over censorship circumvention
51–60 of 519 posts
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#52Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#53They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#54Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.
If they were self-hosted, it would be even easier for Iran to block them.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#55Can someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what? EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org"). Also how can they possibly…
They aren't serving content on that domain. They just make requests look like they are going to that domain in the outer layer (by using it as the TLS server name), but the actual request inside the encryption is for a different domain they own. The load-balancer in front of the cloud service accepts the connection for souq.com (since it is responsible for that too it has the matching server certificate), decrypts th…
Oh so this works because of TLA SNI?
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#56Clearly they need to create a free iPhone/Android game that becomes wildly popular in these countries so that they can use their own domain to front their 'secret' packets.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#57They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
Am I missing something, or is anyone using a CDN domain fronting?
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#58Earlier quoted context omitted.
They aren't serving content on that domain. They just make requests look like they are going to that domain in the outer layer (by using it as the TLS server name), but the actual request inside the encryption is for a different domain they own. The load-balancer in front of the cloud service accepts the connection for souq.com (since it is responsible for that too it has the matching server certificate), decrypts th…
Oh so this works because of TLA SNI?
yes.
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#59I'm thinking of a legislative, not technological solution to this, which seems to be pretty straightforward: make it unlawful for US companies to refuse service simply for Domain fronting. That way, none of the big companies could lawfully refuse service to Signal; neither could they be faulted by these other regimes for "letting Signal use their domain".
Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention
#60Their AWS wasn't threatened, only their ability to use CloudFront. We will immediately suspend your use of CloudFront if you use third party domains without their permission to masquerade as that third party.
The relevant text is in the subject line of the email: "Notification of potential account suspension regarding AWS Service Terms"