Amazon threatens to suspend Signal's AWS account over censorship circumvention • Hacker News Board

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#221

Post by Arathorn » Tue, May 01, 2018, 10:37 PM UTC

mmahmad wrote: post #66

Promarged wrote: post #29

It seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.

They say it doesn't solve the problem - "Would adding federation to Signal help with users behind country-wide blocks? Seems like a distributed service would be harder to censor than a centralized one." - "It's trivial to block several distributed hosts simultaneously. An aspiring censor would simply find the most common federated endpoints for a given service and block all of them. Only the users of that software wo…

I'm not sure this holds water, really - all you need to solve this is to allow identity to migrate between servers (by linking it to a keypair held by the user), or for that matter go the whole hog and go p2p rather than federated.

Matrix is currently working towards transparent migration (account portability) between servers with p2p as a longer term target - and meanwhile projects like Status are going all the way to p2p today.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#222

Post by hakanensari » Tue, May 01, 2018, 10:37 PM UTC

tony101 wrote: post #185

unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

> Collateral freedom

Wow. Is this not but a new form of political asylum[1]?

[1]: https://en.wikipedia.org/wiki/Right_of_asylum

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#223

Post by dingaling » Tue, May 01, 2018, 10:37 PM UTC

tony101 wrote: post #167

RIMR wrote: post #79

Earlier quoted context omitted.

You think oppressive regimes don't already realize what they are? They simply don't care.

They would care if there are financial consequences. https://en.wikipedia.org/wiki/Collateral_freedom

One of the common characteristics of an oppressive regime is that they already suffer financial consequences for their actions; sanctions, overseas account seizures, trade embargoes.

Hoping that they'll throw their hands in the air and give-up instead of blocking AWS etc is naive. The people making the decision don't suffer the consequences as do their subjects.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#224

Post by bluefox » Tue, May 01, 2018, 10:42 PM UTC

"If you put a spoonful of wine in a barrel of sewage, you get sewage. If you put a spoonful of sewage in a barrel of wine, you get sewage." -- Schopenhauer

Unencrypted server name indication is sewage.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#225

Post by jessaustin » Tue, May 01, 2018, 10:44 PM UTC

notyourday wrote: post #198

jessaustin wrote: post #81

Earlier quoted context omitted.

That's a real problem, but I don't think it's related to this situation. We have to assume that censors can inspect apps, and can inspect some app traffic before it gets encrypted. This means that they'll know all about your servers and their IP addresses.

It takes longer to inspect applications that it takes to deploy into yet another VM provider and do push notifications or discovery. If censors had enough skills to handle it those countries would have been producing innovations leaving US and Western companies in the dust.

Push notifications? How do these work, when the app can't rely on access to any particular domain or IP? Your posts in this thread seem to include a great deal of hand-waving.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#226

Post by toomuchtodo » Tue, May 01, 2018, 10:45 PM UTC

nerpderp83 wrote: post #203

mpartel wrote: post #171

Earlier quoted context omitted.

I realized I glossed over the fact that this would put other AWS/GAE customers's money at risk too. This complicates matters somewhat, and some (I believe a negligible number of) customers might switch to an unblocked competitor. Personally this weakens my view a little, but is not enough to change it substantially.

The ethical choice is for AWS and Google to collude and both allow signal to continue to using domain fronting.

Great PR opportunity for Cloudflare to pickup the torch.

EDIT: Not supported by Cloudflare.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#227

Post by _2d30 » Tue, May 01, 2018, 10:47 PM UTC

tony101 wrote: post #190

dragonwriter wrote: post #154

Earlier quoted context omitted.

> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.

That's the entire point of domain fronting and collateral freedom: to make censorship as expensive as possible for oppresive regimes.

I think it's quite clear what the point is from Signal's attempt at implementation of the theory as well as your freshly minted wiki page.

That doesn't change the dubious nature of it. Putting other valuable services at risk for a single service's gain is clearly dubious.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#228

Post by stordoff » Tue, May 01, 2018, 10:48 PM UTC

notyourday wrote: post #33

pyre wrote: post #8

Earlier quoted context omitted.

How do you propose that they implement domain-fronting to circumvent censorship from their own servers?

Boatload of VMs with constantly migrating IP addresses.

Which then has the problem of how do users find them (if by DNS, you can block the DNS record).

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#229

Post by adventured » Tue, May 01, 2018, 10:50 PM UTC

tony101 wrote: post #167

RIMR wrote: post #79

Earlier quoted context omitted.

You think oppressive regimes don't already realize what they are? They simply don't care.

They would care if there are financial consequences. https://en.wikipedia.org/wiki/Collateral_freedom

That premise has a very mixed bag of results historically. It works on some regimes, and fails entirely on others.

Cuba defied an aggressive embargo by the US for ~50 years, which is partially responsible for Cubans typically having present incomes of about $20 per month. [1] By contrast, Haiti, which is one of the poorest nations on earth, has a higher median income than Cuba. The Castro brothers were simply unmoved by the extreme financial consequences (and the people of Cuba also did not topple them across more than half a century).

Similarly it didn't work against North Korea across 60 years. Even while the North watched South Korea develop and grow into one of the 20 or so richest nations.

It also didn't work very well against the USSR. The West heavily limited its trade and economic cooperation with the USSR across the entire post WW2 era until their collapse. The West rapidly developed advanced technological economies, the USSR did not, their people suffered extraordinary poverty and backwardness. The regimes in Moscow didn't care. What finally brought down the USSR, was the collapse of the price of oil brought on by a strong dollar shock in the late 1980s (by contrast they were doing far better economically in the 1970s and early 1980s as the price of oil was very high).

[1] https://www.brookings.edu/blog/brookings-now/2015/07/17/10-e...

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#230

Post by tony101 » Tue, May 01, 2018, 10:54 PM UTC

_2d30 wrote: post #227

tony101 wrote: post #190

Earlier quoted context omitted.

That's the entire point of domain fronting and collateral freedom: to make censorship as expensive as possible for oppresive regimes.

I think it's quite clear what the point is from Signal's attempt at implementation of the theory as well as your freshly minted wiki page. That doesn't change the dubious nature of it. Putting other valuable services at risk for a single service's gain is clearly dubious.

> "your Signal"

Just to be clear, I am not affiliated with Signal in any way. I am just a user.

> "your freshly minted wiki page"

I am a regular contributor to Wikipedia, and I created the article on "collateral freedom" in January 2017[1] when I came across the topic because it satisfied Wikipedia's notability guidelines.[2]

[1] https://en.wikipedia.org/w/index.php?title=Collateral_freedo...

[2] https://en.wikipedia.org/wiki/Wikipedia:Notability