Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

321–330 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#321

Post by DEFCON28 »

tony101 wrote: post #190
dragonwriter wrote: post #154

Earlier quoted context omitted.

> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.

That's the entire point of domain fronting and collateral freedom: to make censorship as expensive as possible for oppresive regimes.

So if you're throwing grenades and Molotov cocktails over a sovereign border, stand inside a crowd of children so they have to shoot them, too. Am I understanding you correctly?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#322

Post by krallja »

geofft wrote: post #122

Why can you not run load-balancers on AWS using randomly-selected subject names of other certificates on other AWS machines? Or just design your protocol so it looks like TLS session resumption and no SNI hostname is in the clear at all?

The load balancers will have to have a public IP address, controlled by Signal, which is trivial to block.

The whole reason this hack works is because CloudFront is the one terminating the TLS connection with a misleading SNI header. Blocking CloudFront means nobody can use CloudFront for any purpose.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#323

Post by trumped »

mvanbaak wrote: post #191

I really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic. While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do. They could have simply have sent the question to the ow…

Can't amazon use different domain names for different customers to avoid this issue?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#324

Post by nojvek »

dbasedweeb wrote: post #312
solotronics wrote: post #308

Earlier quoted context omitted.

The mutual need should be considering the freedom of communication that everyone should have as a human right. Like a lot of things when you think of it purely in terms of dollars you end up with an opressive authoritarian system like in China.

On one hand I agree with you, but on the other... why is this Amazon’s place? I don’t agree with how China censors, but what gives a private US entity the right to try and override that in this way? Their place is to choose to, or not to do business with China, not what amounts to a political operation. I think it’s fair to say that it’s the job of governments and intelligence agencies, and some things shouldn’t be p…

A lot of companies have to bend to China, Brazil and others. They want to make money, they have to follow by their rules.

Google was ballsy to exit from China, but I doubt others are the same.

Wall Street judges a company by how much money it makes. GDP is how countries and govts are judged. The metric is delivering the result.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#325

Post by toast0 »

bscphil wrote: post #103
manigandham wrote: post #22

This is nothing to do with censorship. AWS has many clients and does not want its network to be blocked because of a single customer. Tough for Signal but that's how it is when dealing with businesses (especially one that so many others rely on). The same thing just happened with Telegram in Russia which explains the preemptive messages: https://arstechnica.com/information-technology/2018/04/in-ef...

I wonder if that means AWS, Google, etc oppose measures like encrypted SNI, since it's more likely to get their entire IP range banned by authoritarian governments.

They are more likely to oppose encrypted SNI on the grounds it's not really possible.

How do you encrypt SNI for cold start? For a future connection, I could see how, but at that point you may as well simply do a resumption.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#326

Post by krallja »

textmode wrote: post #175

"Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need." Does this mean that endpoints that require SNI are potentially contributing to censorship? Facts: SNI is optional. Not all websites require it. For example, https://signal.org does not require SNI; cl…

The process listening to IPs that resolve as signal.org must not have alternative hosts on it, since the web server can’t choose a certificate based on anything but IP. Now the censor can just block your IP.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#328

Post by Operyl »

_g5q8 wrote: post #304
Operyl wrote: post #262

Earlier quoted context omitted.

Doesn't Apple explicitly get irritated when you do this kind of thing?

Apple prohibits certain things but interpreters are not one of those. See Pythonista and OpenTerm as examples: https://itunes.apple.com/us/app/pythonista-3/id1085978097?mt... https://itunes.apple.com/us/app/openterm/id1323205755?mt=8

Yeah, but as far as I know, loading code into said interpreters in a way that bypasses their code review process is a grey area.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#329

Post by nebulous1 »

collinmanderson wrote: post #246
zaroth wrote: post #186

Earlier quoted context omitted.

This important description of the actual implementation of domain fronting — namely that it’s implemented on the client side, and only as a cover for initializing the TLS channel — I think is very important and unfortunately missing from TFA. There is nothing on the server side which is masquerading as Amazon or Google. There is no impersonation or spoofing whatsoever. This is akin to making a DNS lookup for a differ…

> I’m not sure why this doesn’t break SNI, or exactly when or how the certificate gets switched out over to Signal’s cert and private key. They way I understand it, the connection really _is_ using amazon’s cert+key, not Signal’s cert+key. Is signal (the server side) using amazons’s cert+key? Not technically.

That would mean that Amazon was supplying Signals content as authentic Souq traffic, something that I doubt was happening.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#330

Post by jsjohnst »

Why can’t they use raw HTTP vs HTTPS and use an encrypted payload? That handles the SNI front as they outlined as the detection mechanism hindering them. I’m sure there’s more to it because this seems pretty basic, but curious the reason why this was ruled out.
Post reply on HN