Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

191–200 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#191

Post by mvanbaak »

I really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic.

While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do.

They could have simply have sent the question to the owner of the domains (google and amazon) explaining what they wanted to do, and only think about implementing it when the owner agreed.

And last but not least to answer those: 'why would they even care, the traffic goes to cloudfront anyways?' ... It will seriously mess up the stats (and billing, yes, amazon owned companies pay internal bills to aws for usage, it's a very normal way of doing business and get your taxes right).

It's sad that tricks like these are being considered/needed to have access to internet services in some parts of the world, but simply doing it without all parties involved knowing about it and agreeing on it is _NOT_ the way to do it.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#192

Post by majewsky »

Boulth wrote: post #159
Paul-ish wrote: post #151

Earlier quoted context omitted.

How do you ensure the censor doesn't block the major c2s connections? I suspect most techniques are too technical for your average user.

Modern clients can connect via port 443. There is also support for XMPP via WebSockets, that looks like regular HTTPS traffic.

Sure, but they can just block the IP.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#193

Post by tony101 »

marme wrote: post #177
smileysteve wrote: post #50

Earlier quoted context omitted.

Or it forces oppressive regimes to realize that they are being an oppressive regime. Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.

china did this and it just caused every major service to be recreated for chinese users on their side of the internet

China is huge compared to those other oppressive regimes out there.

Also, AFAIK, China hasn't been able to recreate GitHub. Since GitHub is HTTPS-only and China needs it enough to not block it, a lot of censorship circumvention tools are available in China through GitHub.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#194

Post by pm90 »

icebraining wrote: post #140
RIMR wrote: post #95

Earlier quoted context omitted.

Good, go ahead and pass those laws and I'll use Cloudfront to impersonate Amazon.com and steal credit card info, and Amazon will be legally unable to stop me.

You've misunderstood how the trick works. Nobody is impersonating anybody. To make an analogy, they're like a guy who tells the building security guard that they're going to apartment 5 (the Souq servers), but when they're in they actually go to apartment 8 (Signal's servers). Except the censors can only see the conversation with the guard, but they can't see where he actually goes, so they can't distinguish him from…

This is a nice analogy. The problem here is that the visitor has logged in that he is visiting apartment 5 in the guestbook. So if he ends up breaking something, security would hold apartment 5 liable (and not apartment 8). So it makes sense that apartment 5 does not want to be responsible.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#195

Post by jessaustin »

dragonwriter wrote: post #154
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.

What does "innocent" mean in this context? You seem to be using the word to distinguish between people who use the app and other people who don't, but that can't be right. Is it unethical to use a communications app?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#196

Post by jessaustin »

tanderson92 wrote: post #184
analognoise wrote: post #172

Earlier quoted context omitted.

How is it moral for Amazon to shirk their fiduciary duty to shareholders for the sake of a political battle it isn't theirs to wage? I counter it would be more immoral to put, say, the retirement funds of firefighters and teachers arty risk to achieve what is the responsibility of, say, the State Department?

There is no fiduciary duty to shareholders of a public company. This is known as the shareholder value myth -- myth because it is false.

Yeah if this were the case the private jet market would crater.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#197

Post by kombucha2 »

mabbo wrote: post #116
kombucha2 wrote: post #101

Couldn't they ask people to donate their AWS instances or a portion of their webserver (or domain) resources to running a small outward facing webserver as a dummy, making the domain look like its a real website (eCommerce etc) and then passing Signal data through a Shadowsocks (or something similar) proxy? Couldn't they develop an AMI that they hold the keys to that people could deploy with ease?

Those who wish to suppress Signal would just play whack-a-mole. They'd login to Signal, find what domains it was connecting to and then block those. To update Signal with new addresses constantly, you'd need a server hosting those updates- which would in turn be blocked immediately. The idea of using Souq.com or Google.com as the domain name in the TLS header was that even oppressive regimes won't block Google or Sou…

oh derrr

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#198

Post by notyourday »

jessaustin wrote: post #81
notyourday wrote: post #31

Well, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.

That's a real problem, but I don't think it's related to this situation. We have to assume that censors can inspect apps, and can inspect some app traffic before it gets encrypted. This means that they'll know all about your servers and their IP addresses.

It takes longer to inspect applications that it takes to deploy into yet another VM provider and do push notifications or discovery.

If censors had enough skills to handle it those countries would have been producing innovations leaving US and Western companies in the dust.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#199

Post by tony101 »

goatsi wrote: post #25
jakebasile wrote: post #13

What was it that convinced Google and Amazon to no longer allow this particular censorship evasion?

Russia made it clear that they would block AWS and Google Cloud if domain fronting was allowed to continue. https://arstechnica.com/information-technology/2018/04/in-ef... As moxie says in the blog post >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan.

AWS and Google Cloud should have refused to cooperate. Let Russia block them and bear the economic costs of censorship.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#200

Post by iforgotpassword »

kempbellt wrote: post #53
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.

the problem I'm having is that I'm not even sure this qualifies as 'use' really. sure they're putting the domain name in the tls handshake from the client side instead of their own. the handshake itself works the same, everything that happens after is the same. the tls enpoint on googles/amazons servers just makes sure the domain is in its list of known domains, nothing else depends on it.
Post reply on HN