Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

201–210 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#201

Post by jlund »

manigandham wrote: post #160
jlund wrote: post #131

Earlier quoted context omitted.

The loss of domain fronting as a viable strategy means that it will be possible to censor Signal in areas where the service was previously working.

It's a warning to not break terms of service. The strategy still works, but it's against TOS of most hosts so it was never really viable. Time to look for another option then, like any other technical challenge. I support Signal's work here but unfortunately we can't just enlist every other business to help (otherwise censorship wouldn't be much of a problem in the first place).

> Time to look for another option then

That's the plan. This is covered briefly in the second-to-last paragraph.

> so it was never really viable

Signal remained running for more than a year and a half in several countries that were actively trying to censor the service.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#202

Post by wildfire »

mvanbaak wrote: post #191

I really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic. While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do. They could have simply have sent the question to the ow…

If this would "seriously mess up the stats", then arguably the CDN is doing it wrong.

It should bill on the inner (encrypted) domain and not what is outside.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#203

Post by nerpderp83 »

mpartel wrote: post #171
mpartel wrote: post #149

Earlier quoted context omitted.

Amazon and Google are certainly within their rights to refuse this. Allowing domain fronting is likely to put quite a lot of their money at risk, so this outcome is unsurprising, but it's still the less ethical one. This might be the only possible outcome given a corporation's legal responsibilities to its shareholders etc, I don't know all that well enough, but I think it's still justified to lower my opinion of Goo…

I realized I glossed over the fact that this would put other AWS/GAE customers's money at risk too. This complicates matters somewhat, and some (I believe a negligible number of) customers might switch to an unblocked competitor. Personally this weakens my view a little, but is not enough to change it substantially.

The ethical choice is for AWS and Google to collude and both allow signal to continue to using domain fronting.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#204

Post by dragonwriter »

jessaustin wrote: post #195
dragonwriter wrote: post #154

Earlier quoted context omitted.

> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.

What does "innocent" mean in this context? You seem to be using the word to distinguish between people who use the app and other people who don't, but that can't be right. Is it unethical to use a communications app?

> What does "innocent" mean in this context?

Innocent of whatever violation if local law the regime is targeting the app for.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#206

Post by thefifthsetpin »

textmode wrote: post #175

"Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need." Does this mean that endpoints that require SNI are potentially contributing to censorship? Facts: SNI is optional. Not all websites require it. For example, https://signal.org does not require SNI; cl…

Sure, but the censor can just censor requests that omit SNI.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#207

Post by keane »

mi100hael wrote: post #170
maxerickson wrote: post #92

Earlier quoted context omitted.

Capitulating to foreign censors for business reasons has something to do with censorship.

Amazon has a ton of customers, at least a few of which like https://preemptivelove.org/ are also doing good things in these countries. It's not just Amazon that suffers, but Amazon's customers and everyone else downstream.

Preemptive Love is one of the most fearless organisations on the planet operating in the most dangerous places on the planet with little regard for their own safety. They constantly surprise me with the risks they are willing to take so that others might love.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#208

Post by mvanbaak »

wildfire wrote: post #202
mvanbaak wrote: post #191

I really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic. While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do. They could have simply have sent the question to the ow…

If this would "seriously mess up the stats", then arguably the CDN is doing it wrong. It should bill on the inner (encrypted) domain and not what is outside.

Still, the initial package is meant for the infra of the outer domain. Sure, the real payload will be billed to the inner domain owner, but not the initial handshake (and usage of keys etc)

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#209

Post by balls187 »

smileysteve wrote: post #50
QuinnyPig wrote: post #7

Sorry, I'm not on board with using an Amazon owned domain for this. That's got the potential to get Amazon itself blacklisted in some places, so they're absolutely not going to be okay with it.

Or it forces oppressive regimes to realize that they are being an oppressive regime. Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.

I'm from the US, sometimes self referred as the land of free, and it's not easy for me to move to a different country.

Imagine how much worse it would be if it was under an oppressive regime, with strict internet censorship.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#210

Post by RockyMcNuts »

I feel like Amazon has a moral obligation to name the country that is forcing them to do this under penalty of having their entire IP block black-holed.

I assume Amazon would not take this step unless that was going to happen otherwise, or at least I don't see why they would.

They don't need to make a political statement about it, just say they did it to comply with law / order of 'X'. Russia

Post reply on HN