Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

261–270 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#261

Post by dnautics »

munificent wrote: post #247
mattigames wrote: post #211

Earlier quoted context omitted.

Exactly, free countries (or those who consider themselves as such) should make it fully illegal for private companies to aid in any kind of censorship in behalf of oppressive countries. But what we see in reality is the opposite, all companies trying to make it as cheap and as simple as possible to censor anything every government dislikes; meaning the liberal fantasy of allowing every private company to do as it ple…

> the liberal fantasy of allowing every private company to do as it pleases How is that a liberal fantasy? I thought the standard liberal belief is in heavy regulation of business? Or do you mean "liberal" in the general "lots of liberty" sense and not "in the liberal political camp"?

in defense of the parent, it would have been helpful if the quoted phrase said "classical liberal" since the definition of liberal has drifted over the past 100 years, and there's a continental difference depending on if you're in north america vs europe.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#262

Post by Operyl »

zzzcpan wrote: post #249
theintern wrote: post #244

Earlier quoted context omitted.

Given its an open source app, it should be reasonably easy for the censor to reverse engineer the algorithmically generated domains. Frequent tiny updates would be an interesting solution though. Now that most mobile apps can deliver just deltas to save bandwidth it'd be viable.

I realize now, that it's possible to even dynamically deliver a bytecode of a domain generating algorithm itself or pretty much any circumvention logic by embedding a tiny interpreter into the app.

Doesn't Apple explicitly get irritated when you do this kind of thing?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#263

Post by smsm42 »

unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

But effectively that is the case. If major providers like AWS and Google ban domain fronting, it is effectively dead - nobody needs domain fronting when you have three domains, three domains can be banned the same way as one.

AWS and Google could throw their considerable weight on the side of anti-censorship and openness. They instead chose - as businesses frequently do - to play along with oppressive dictatorial regimes so it won't cost them a couple of bucks extra. That is pretty sad.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#264

Post by peteretep »

non_sequitur wrote: post #232
mattigames wrote: post #211

Earlier quoted context omitted.

Exactly, free countries (or those who consider themselves as such) should make it fully illegal for private companies to aid in any kind of censorship in behalf of oppressive countries. But what we see in reality is the opposite, all companies trying to make it as cheap and as simple as possible to censor anything every government dislikes; meaning the liberal fantasy of allowing every private company to do as it ple…

"in a world where every important event you can't find in Google for all practical matters never happened" Except Google isn't in China, and least I heard important events still happen there...the world isn't as FANG centric as western media would want us to believe.

> FANG

Stands for Facebook, Amazon, Netflix, Google, apparently.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#265

Post by pishpash »

tony101 wrote: post #185
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

Or, you actually get the whole internet shut off for people who need it. It's not unprecedented and nothing is "expensive" when shutting out Google entirely is not considered "expensive".

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#266

Post by tanderson92 »

adventured wrote: post #219
jessaustin wrote: post #196

Earlier quoted context omitted.

Yeah if this were the case the private jet market would crater.

Berkshire Hathaway could have never existed if it were actually a legal requirement. For decades they've constantly passed on doing things that could have easily juiced shareholder value, including hostile actions in regards to takeovers. It's why nearly all of their acquisitions come to them instead: an extraordinary reputation. Further, the fiduciary myth is silly as a premise upon any inspection: legally who gets…

Fiduciaries are allowed to differ in their advice and action taken in that role. I know what you're saying but it's a bit subtler than that.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#267

Post by zaroth »

collinmanderson wrote: post #246
zaroth wrote: post #186

Earlier quoted context omitted.

This important description of the actual implementation of domain fronting — namely that it’s implemented on the client side, and only as a cover for initializing the TLS channel — I think is very important and unfortunately missing from TFA. There is nothing on the server side which is masquerading as Amazon or Google. There is no impersonation or spoofing whatsoever. This is akin to making a DNS lookup for a differ…

> I’m not sure why this doesn’t break SNI, or exactly when or how the certificate gets switched out over to Signal’s cert and private key. They way I understand it, the connection really _is_ using amazon’s cert+key, not Signal’s cert+key. Is signal (the server side) using amazons’s cert+key? Not technically.

Interesting. Reading their developer guide [1] pg 293 - CloudFront servers have all the private keys anyway, so it hardly matters—from a security perspective—which key is used to establish the TLS connection to the CloudFront endpoint. The connection between CloudFront and Signal’s own severs would be encrypted with Signal’s key.

I also found this paper on domain fronting to be a very good read - Blocking-resistant communication through domain fronting [2]

[1] - https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...

[2] - https://www.bamsoftware.com/papers/fronting/

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#268

Post by stale2002 »

analognoise wrote: post #172
andrepd wrote: post #153

Earlier quoted context omitted.

Morally, it's still the right thing to do, even though I guess it's in amazon's best interests not to allow it.

How is it moral for Amazon to shirk their fiduciary duty to shareholders for the sake of a political battle it isn't theirs to wage? I counter it would be more immoral to put, say, the retirement funds of firefighters and teachers arty risk to achieve what is the responsibility of, say, the State Department?

I don't know, was it moral for IBM to work with the Nazis to build their concentration camp databases? (yes, this happened)

I mean, that made the shareholders money, right?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#270

Post by smsm42 »

ucarion wrote: post #214
dice wrote: post #157

Earlier quoted context omitted.

>You can't use TLS and load balancing hacks to pretend to be us in oppresive countries They're not pretending to be Amazon, they're pretending to initiate a connection to an Amazon domain. The "conversation" goes like so: Clear text request: "Hello, I would like to speak TLS with souq.com" Clear text response: "Why yes, let us do that with these parameters" Encrypted request: "Please give me the page for signal.org/a…

They may not be impersonating Amazon, but they are using Amazon's services to circumvent the intent of policies (laws) that Amazon wants to comply with. Amazon has decided to stop be an unwitting participant in this particular mechanism of circumventing oppression. For the record, I'm of the opinion that the US should insist that American companies not help dictators abroad in their censorship efforts. But it's hardl…

Reasonable, but cowardly and disgusting.
Post reply on HN