Amazon threatens to suspend Signal's AWS account over censorship circumvention

Post by fwn » Tue, May 01, 2018, 11:13 PM UTC

ucarion wrote: post #214

dice wrote: post #157

Earlier quoted context omitted.

>You can't use TLS and load balancing hacks to pretend to be us in oppresive countries They're not pretending to be Amazon, they're pretending to initiate a connection to an Amazon domain. The "conversation" goes like so: Clear text request: "Hello, I would like to speak TLS with souq.com" Clear text response: "Why yes, let us do that with these parameters" Encrypted request: "Please give me the page for signal.org/a…

They may not be impersonating Amazon, but they are using Amazon's services to circumvent the intent of policies (laws) that Amazon wants to comply with. Amazon has decided to stop be an unwitting participant in this particular mechanism of circumventing oppression. For the record, I'm of the opinion that the US should insist that American companies not help dictators abroad in their censorship efforts. But it's hardl…

Post by geofft » Tue, May 01, 2018, 11:17 PM UTC

icebraining wrote: post #142

geofft wrote: post #130

Earlier quoted context omitted.

What do you encrypt the header to ? Options include: - Start an encrypted unauthenticated conversation with the server first: that adds at least one extra round-trip, so most people won't do it, so it's easy to block all connections that do - Encrypt it to a key you have from the previous connection: doesn't help the initial connection and you already have session resumption for the rest - Encrypt it to a well-known…

that adds at least one extra round-trip, so most people won't do it Eh, people will do whatever the TLS libraries have as default. Optimizing for an extra RT is way above what most app developers do.

Post by vioyul » Tue, May 01, 2018, 11:22 PM UTC

Post by munificent » Tue, May 01, 2018, 11:23 PM UTC

mattigames wrote: post #211

tony101 wrote: post #185

Earlier quoted context omitted.

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

Exactly, free countries (or those who consider themselves as such) should make it fully illegal for private companies to aid in any kind of censorship in behalf of oppressive countries. But what we see in reality is the opposite, all companies trying to make it as cheap and as simple as possible to censor anything every government dislikes; meaning the liberal fantasy of allowing every private company to do as it ple…

Post by zzzcpan » Tue, May 01, 2018, 11:27 PM UTC

theintern wrote: post #244

zzzcpan wrote: post #110

Telegram has some pretty interesting ideas wrt censorship circumvention. I.e. you can still use Amazon, Google, Microsoft as an unblockable side channel to deliver proxy settings, same way domain fronting relies on them. And you can sponsor other people to setup proxies, making it hard to detect and suspend accounts used for censorship circumvention on Amazon and other hosting companies. As a side channel dns over ht…

Given its an open source app, it should be reasonably easy for the censor to reverse engineer the algorithmically generated domains. Frequent tiny updates would be an interesting solution though. Now that most mobile apps can deliver just deltas to save bandwidth it'd be viable.