Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

301–310 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#301

Post by caf »

zaroth wrote: post #267
collinmanderson wrote: post #246

Earlier quoted context omitted.

> I’m not sure why this doesn’t break SNI, or exactly when or how the certificate gets switched out over to Signal’s cert and private key. They way I understand it, the connection really _is_ using amazon’s cert+key, not Signal’s cert+key. Is signal (the server side) using amazons’s cert+key? Not technically.

Interesting. Reading their developer guide [1] pg 293 - CloudFront servers have all the private keys anyway, so it hardly matters—from a security perspective—which key is used to establish the TLS connection to the CloudFront endpoint. The connection between CloudFront and Signal’s own severs would be encrypted with Signal’s key. I also found this paper on domain fronting to be a very good read - Blocking-resistant c…

Exactly. This works because the point of TLS in this instance is for the Signal client to be sure it's talking to Amazon CloudFront. The certificate for an Amazon service also hosted on CloudFront is certainly good enough to prove this, provided the client knows to expect it, which it does.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#302

Post by caf »

CoryG89 wrote: post #112
gue5t wrote: post #102

Earlier quoted context omitted.

Hardly reasonable. Domains are (in reality, if not in legislative fantasy) property of ICANN and merely rented by everyone else.

So? If we qualify it to preventing unauthorized use of one of their rented domains does that make it any less reasonable?

The conceit here is that you must be "authorized" in order to write an app that puts the domain in question into the SNI field of a TLS connection that it initiates. I don't think that's reasonable.

It is of course up to Amazon what their servers then do when presented with such a connection, in particular whether they ensure the Host: header later presented matches the SNI data.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#303

Post by manigandham »

tony101 wrote: post #185
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

You've posted this (wiki page that you wrote) several times in this thread... but the issue is that all the unblocked companies are already unblocked. What do they stand to gain from this other than a near-term disruption (at best)? The only way collateral freedom works is when there is mutual need for everyone to be included, otherwise why take the risk to carry the designated targets? Also I wouldn't underestimate the economic power of regimes and nation-states that know what they're doing.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#304

Post by _g5q8 »

Operyl wrote: post #262
zzzcpan wrote: post #249

Earlier quoted context omitted.

I realize now, that it's possible to even dynamically deliver a bytecode of a domain generating algorithm itself or pretty much any circumvention logic by embedding a tiny interpreter into the app.

Doesn't Apple explicitly get irritated when you do this kind of thing?

Apple prohibits certain things but interpreters are not one of those. See Pythonista and OpenTerm as examples:

https://itunes.apple.com/us/app/pythonista-3/id1085978097?mt...

https://itunes.apple.com/us/app/openterm/id1323205755?mt=8

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#305

Post by HIPisTheAnswer »

According to the founder of matrix, him and Moxie had a meeting a few years ago to discuss federation where Moxie debated that it wasn't ideal to create a federated protocol, that somehow it would create too many problems. Now that Signal is unable to service everyone without federation, does Moxie still hold reservations on federated protocols?

On another tangent; the Host Identity Protocol would resolve this (and countless other) security issue by simply rendering all traffic impossible to analyze in such a way. Why a big tech company like google hasn't put their men on the idea is beyond words, especially since it also elegantly solves mobility.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#306

Post by tony101 »

qeternity wrote: post #286
mattigames wrote: post #211

Earlier quoted context omitted.

Exactly, free countries (or those who consider themselves as such) should make it fully illegal for private companies to aid in any kind of censorship in behalf of oppressive countries. But what we see in reality is the opposite, all companies trying to make it as cheap and as simple as possible to censor anything every government dislikes; meaning the liberal fantasy of allowing every private company to do as it ple…

As you note, private companies are typically free to do as they please in free countries...that's kinda the point. You have no right to use AWS, so this is not censorship in the legal sense. And free governments also tend to have strong laws respecting the sovereignty of other nations, whether or not their laws are similar. Your frustration is noble, but it's also internally inconsistent.

> "private companies are typically free to do as they please in free countries ... free governments also tend to have strong laws respecting the sovereignty of other nations"

Not always. For example, the Foreign Corrupt Practices Act prohibits U.S. companies from bribing foreign officials, even if the practice is accepted or prevalent in a foreign nation.[1] Just because another country has a particular policy does not mean we have to allow our companies to play along.

[1] https://en.wikipedia.org/wiki/Foreign_Corrupt_Practices_Act

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#307

Post by mattigames »

munificent wrote: post #247
mattigames wrote: post #211

Earlier quoted context omitted.

Exactly, free countries (or those who consider themselves as such) should make it fully illegal for private companies to aid in any kind of censorship in behalf of oppressive countries. But what we see in reality is the opposite, all companies trying to make it as cheap and as simple as possible to censor anything every government dislikes; meaning the liberal fantasy of allowing every private company to do as it ple…

> the liberal fantasy of allowing every private company to do as it pleases How is that a liberal fantasy? I thought the standard liberal belief is in heavy regulation of business? Or do you mean "liberal" in the general "lots of liberty" sense and not "in the liberal political camp"?

Sorry I should have been clear I meant "anti-regulation advocates"

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#308

Post by solotronics »

manigandham wrote: post #303
tony101 wrote: post #185

Earlier quoted context omitted.

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

You've posted this (wiki page that you wrote) several times in this thread... but the issue is that all the unblocked companies are already unblocked. What do they stand to gain from this other than a near-term disruption (at best)? The only way collateral freedom works is when there is mutual need for everyone to be included, otherwise why take the risk to carry the designated targets? Also I wouldn't underestimate…

The mutual need should be considering the freedom of communication that everyone should have as a human right. Like a lot of things when you think of it purely in terms of dollars you end up with an opressive authoritarian system like in China.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#309

Post by caf »

zzzcpan wrote: post #249
theintern wrote: post #244

Earlier quoted context omitted.

Given its an open source app, it should be reasonably easy for the censor to reverse engineer the algorithmically generated domains. Frequent tiny updates would be an interesting solution though. Now that most mobile apps can deliver just deltas to save bandwidth it'd be viable.

I realize now, that it's possible to even dynamically deliver a bytecode of a domain generating algorithm itself or pretty much any circumvention logic by embedding a tiny interpreter into the app.

You don't need to deliver bytecode, just a new seed for the algorithm. Even 64 bits is more than sufficient to ensure that they can't enumerate all possible seeds.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#310

Post by sulam »

incompatible wrote: post #275
zaroth wrote: post #186

Earlier quoted context omitted.

This important description of the actual implementation of domain fronting — namely that it’s implemented on the client side, and only as a cover for initializing the TLS channel — I think is very important and unfortunately missing from TFA. There is nothing on the server side which is masquerading as Amazon or Google. There is no impersonation or spoofing whatsoever. This is akin to making a DNS lookup for a differ…

Since Signal is open source, presumably anybody can fork it with a version that implements domain fronting.

Except as the article points out, both Amazon and Google have or intend to make domain fronting not work, regardless of the domain being fronted.
Post reply on HN