181–190 of 519 posts
I took away two important messages: 1. Amazon is paying more attention to the TLS handshake than I thought. 2. Censorship-bypassing software is getting popular enough that it's hitting the news.
0. Amazon is paying more attention to HackerNews than I thought.
I mean: Yesterday AWS became aware of your Github and Hacker News/ycombinator posts [ ... ] General Manager, Amazon CloudFront
For most of us, this is "somewhere else", right now. But it will be "coming to a theater near you", real soon now.
Clearly they need to create a free iPhone/Android game that becomes wildly popular in these countries so that they can use their own domain to front their 'secret' packets.
See Russia banning millions of AWS and Azure IPs to block Telegram, damaging a lot innocent applications by the way.
Earlier quoted context omitted.
Morally, it's still the right thing to do, even though I guess it's in amazon's best interests not to allow it.
How is it moral for Amazon to shirk their fiduciary duty to shareholders for the sake of a political battle it isn't theirs to wage? I counter it would be more immoral to put, say, the retirement funds of firefighters and teachers arty risk to achieve what is the responsibility of, say, the State Department?
They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective deterrent against many oppressive regimes. This concept is known as collateral freedom.[1]
Instead of shutting this down, Amazon could have let Signal continue. In fact, all companies should collaborate to make censorship as expensive as possible. Someone here at HN pointed out that it is very difficult for someone under an oppressive regimes to speak out; this makes it all the more important for those of us who can to assist dissidents and support freedom of expression.
They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
>You can't use TLS and load balancing hacks to pretend to be us in oppresive countries They're not pretending to be Amazon, they're pretending to initiate a connection to an Amazon domain. The "conversation" goes like so: Clear text request: "Hello, I would like to speak TLS with souq.com" Clear text response: "Why yes, let us do that with these parameters" Encrypted request: "Please give me the page for signal.org/a…
There is nothing on the server side which is masquerading as Amazon or Google. There is no impersonation or spoofing whatsoever.
This is akin to making a DNS lookup for a different domain to find the IP of a service which you know is hosted on the same machine.
While it seems to me that this is clearly not actually violating Amazon ToS, I can understand why Signal must give up on this approach.
As an aside, I’m not sure why this doesn’t break SNI, or exactly when or how the certificate gets switched out over to Signal’s cert and private key. The whole point of putting the domain in the ‘Client Hello’ is to get hooked up to the right cert for the rest of the negotiation when there isn’t a 1:1 mapping of IP->Cert so to switch the GET domain/path later on would, I assume, require restarting the key agreement, which I’m surprised doesn’t blow up the TLS session and require a new clear text ‘Client Hello’.
This is why we have built stealthy.im on a decentralized and censorship resistant platform.
Earlier quoted context omitted.
>You can't use TLS and load balancing hacks to pretend to be us in oppresive countries They're not pretending to be Amazon, they're pretending to initiate a connection to an Amazon domain. The "conversation" goes like so: Clear text request: "Hello, I would like to speak TLS with souq.com" Clear text response: "Why yes, let us do that with these parameters" Encrypted request: "Please give me the page for signal.org/a…
They're arguably impersonating Amazon on the server side by hosting their service behind Amazon's proxies and using a trick to pretend that they're talking to some Amazon service instead of their own.
Earlier quoted context omitted.
It's a warning to not break terms of service. The strategy still works, but it's against TOS of most hosts so it was never really viable. Time to look for another option then, like any other technical challenge. I support Signal's work here but unfortunately we can't just enlist every other business to help (otherwise censorship wouldn't be much of a problem in the first place).
> "unfortunately we can't just enlist every other business to help" But we should! Telex[1] and other solutions based on collateral freedom[2] have huge potential to disrupt censorship from the outside. [1] https://telex.cc [2] https://en.wikipedia.org/wiki/Collateral_freedom
They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…
> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.