Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

61–70 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#61

Post by jakebasile »

goatsi wrote: post #25
jakebasile wrote: post #13

What was it that convinced Google and Amazon to no longer allow this particular censorship evasion?

Russia made it clear that they would block AWS and Google Cloud if domain fronting was allowed to continue. https://arstechnica.com/information-technology/2018/04/in-ef... As moxie says in the blog post >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan.

Ah, that's right. I forgot about that development.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#62

Post by therealmarv »

organicmultiloc wrote: post #45

This doesn't seem like a good solution from any angle. Do we need to change TCP/IP/whatever to actually allow network traffic to be secure again?

AFAIK There was some effort to make this TLS 1.3 SNI header encrypted but some influential groups blocked that (I think I read something about ability to route and control traffic easily). Really sad :(

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#63

Post by johnwheeler »

icebraining wrote: post #44
johnwheeler wrote: post #27

You want to use the resources and influence of a large corporation to acheive your organizations goals. They don’t have to be on board with your mission, and it’s arrogant to think so IMO. Why should they let you do it, when they won’t allow it for others? Seems like you feel entitled because you think by default people should support what you’re trying to do. The flipside of free speech you’re ignoring is that peopl…

What part of the post shows they feel entitled to it?

The fact that they posted the e-mail from Amazon, so readers could direct the blame at them. You can’t read that blog post and say it’s the most unbiased and objective way they could have presented this, especially if they want to remain on good terms with Amazon, who has done nothing wrong at all.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#65

Post by notyourday »

monochromatic wrote: post #54
notyourday wrote: post #31

Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.

If they were self-hosted, it would be even easier for Iran to block them.

If they hosted on VMs they would simply hop from one place to the other. The problem is that all of this stuff is "difficult" and no one would be writing stories about how great signal is if it could switch between thousands of companies that provide VMs to masses.

We do not have these thousands of companies because AWS/GCS/Azure are the go to. Well, guess what? That means that objectively there are three kings of the world and the lieutenants of those kings get to decide what is and is not allowed.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#66

Post by mmahmad »

Promarged wrote: post #29

It seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.

They say it doesn't solve the problem

- "Would adding federation to Signal help with users behind country-wide blocks? Seems like a distributed service would be harder to censor than a centralized one."

- "It's trivial to block several distributed hosts simultaneously. An aspiring censor would simply find the most common federated endpoints for a given service and block all of them. Only the users of that software would be affected. There wouldn't be any collateral damage. If the censors somehow didn't hit every single worthwhile federated endpoint, users would still be left wondering why they couldn't communicate with most of their friends. Moving between federated hosts would also necessitate an entirely new identifier, so users would need to rebuild their social graph again.

In addition to being ineffective against censorship, there are several other properties and trade-offs that make federation a difficult proposition for an application like Signal: https://signal.org/blog/the-ecosystem-is-moving/"

src: https://news.ycombinator.com/item?id=16868564

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#67

Post by criley2 »

smileysteve wrote: post #50
QuinnyPig wrote: post #7

Sorry, I'm not on board with using an Amazon owned domain for this. That's got the potential to get Amazon itself blacklisted in some places, so they're absolutely not going to be okay with it.

Or it forces oppressive regimes to realize that they are being an oppressive regime. Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.

Amazon isn't in the business of forcing oppressive regimes to realize they are oppressive regimes, they are in the business of selling goods and services regardless of the oppressiveness of the regime governing the region where the currency comes from.

If you want Amazon to stop doing business with oppressive regimes, contact your politicians about sanctions.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#68

Post by apendleton »

dsl wrote: post #36
pyre wrote: post #16

Earlier quoted context omitted.

The part you're missing is: ... to third parties. They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties creating the SSL connection are not lying to each other, though.

But they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.

Are you? It looks like the Amazon load balancers don't actually care what your SNI domain is when routing traffic. They terminate your TLS connection, and then use the domain in your actual HTTP request to route it, which is not Amazon's domain. Amazon's ability to allow these two domains to differ, and to mostly ignore the former, is the crux of this whole trick.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#69

Post by jlund »

Promarged wrote: post #29

It seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.

Unfortunately, federation is not an effective tactic against censorship: https://news.ycombinator.com/item?id=16871352
Post reply on HN