Amazon threatens to suspend Signal's AWS account over censorship circumvention • Hacker News Board

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#371

Post by textmode » Wed, May 02, 2018, 4:36 AM UTC

apendleton wrote: post #68

dsl wrote: post #36

Earlier quoted context omitted.

But they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.

Are you? It looks like the Amazon load balancers don't actually care what your SNI domain is when routing traffic. They terminate your TLS connection, and then use the domain in your actual HTTP request to route it, which is not Amazon's domain. Amazon's ability to allow these two domains to differ, and to mostly ignore the former, is the crux of this whole trick.

Does this mean that Cloudfront does not actually require (correct) SNI?

Example: Sending HTTP request for signal.org over TLS to Cloudfront IP address with SNI as "allergan.com" returns signal.org web page, not allergan.com web page.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#372

Post by ForHackernews » Wed, May 02, 2018, 4:43 AM UTC

illumin8 wrote: post #339

zaroth wrote: post #186

Earlier quoted context omitted.

This important description of the actual implementation of domain fronting — namely that it’s implemented on the client side, and only as a cover for initializing the TLS channel — I think is very important and unfortunately missing from TFA. There is nothing on the server side which is masquerading as Amazon or Google. There is no impersonation or spoofing whatsoever. This is akin to making a DNS lookup for a differ…

A couple important things to note: - This most definitely is against the CloudFront terms of service. See the linked article if you disagree - the ToS is quoted there. - One direct impact to the owners of the SOUQ.COM domain is that their DNS query volume will increase drastically. They have to pay for those queries. Would you like it if your side project all of a sudden got a 6 figure DNS bill because Signal decided…

> Would you like it if your side project all of a sudden got a 6 figure DNS bill because Signal decided they want to piggy back on your domain to route around censorship?

In this hypothetical example, is my side project doing $178,000,000,000 of annual revenue like Amazon.com? If so, I'd like to think I'd be honored help subvert censorship by oppressive regimes.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#373

Post by cryptonector » Wed, May 02, 2018, 4:50 AM UTC

nebulous1 wrote: post #329

collinmanderson wrote: post #246

Earlier quoted context omitted.

> I’m not sure why this doesn’t break SNI, or exactly when or how the certificate gets switched out over to Signal’s cert and private key. They way I understand it, the connection really _is_ using amazon’s cert+key, not Signal’s cert+key. Is signal (the server side) using amazons’s cert+key? Not technically.

That would mean that Amazon was supplying Signals content as authentic Souq traffic, something that I doubt was happening.

Amazon was supplying Signal's content as souq.com but with the request making it clear it was for Signal.

How might this be noticeable? Like so:

     - (irrelevant) the SNI and certificate presented by the server don't match the request -- only the hoster can see this, so what might they care?
     - (serious) metering: if the hoster uses SNI for metering... then Signal would be stealing the fronter's bandwidth
     - (mild) DNS metering: the fronter's domains will see more DNS lookups not related to serving the fronter's content

Nothing that couldn't be addressed contractually. Signal could pay the costs that would otherwise be unfairly born by the fronter, and whatever makes the hoster comfortable with the whole thing (if making the fronter good is insufficient for that).

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#374

Post by smsm42 » Wed, May 02, 2018, 5:02 AM UTC

czardoz wrote: post #273

smsm42 wrote: post #263

Earlier quoted context omitted.

But effectively that is the case. If major providers like AWS and Google ban domain fronting, it is effectively dead - nobody needs domain fronting when you have three domains, three domains can be banned the same way as one. AWS and Google could throw their considerable weight on the side of anti-censorship and openness. They instead chose - as businesses frequently do - to play along with oppressive dictatorial reg…

AWS and Google are companies. It's not their job to push for societal changes really. In fact, I hope they don't push for those. I'd prefer them to steer clear of pushing for any higher objectives, that's best left to governments and lawmakers.

> It's not their job to push for societal changes really.

Somehow dozens of companies are discussing pushing for societal changes every day. Just recently a bunch of companies discussed severing ties with NRA (which didn't hurt a single living soul) and stopping selling firearms (which would not, indeed, lead to any societal change but at least the declared goal, even if unattainable, is to do exactly that). In another topic, there's a link on political manifesto by SO leadership. Social activism is everywhere in the business world. But when it's about something that may save somebody's life in Iran but cost some $$ to the company, it's suddenly "not their job". Nope, you can't do both. If companies avoided social activism altogether and were completely neutral and apolitical - I could accept that. They are not and haven't been for a long time. You can't just turn on one place and say "we do social activism everywhere but not where it can offend Iran". Or, you can, but that would be, as I said, cowardly and disgusting.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#375

Post by dsl » Wed, May 02, 2018, 5:02 AM UTC

ballenf wrote: post #106

dsl wrote: post #36

Earlier quoted context omitted.

But they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.

How is Amazon "one of the two parties" to my Signal message to a friend? An infrastructure provider, a carrier maybe, but a party to ? I'm not against Amazon's decision, but I disagree with anyone framing this as Signal trying to deceive its users. What they're doing isn't too far removed from me using a VPN to deceive Comcast regarding my use of "their" services. That is, if we're going to get loose with our metapho…

I think you are misunderstanding what is going on here.

The Signal client on your phone is connecting to a load balancer that Amazon owns. In the initial handshake it lies about what website it is trying to contact, claiming to be looking for an Amazon shopping site. Once the connection is fully established it says "just kidding I am actually trying to reach the Signal server hosted in AWS."

They are abusing a bug in Amazon's front end load balancers, having them route traffic in a way that wasn't intended. This is a warning to knock it off, while Amazon works on fixing that bug.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#376

Post by dsl » Wed, May 02, 2018, 5:06 AM UTC

foobarbazetc wrote: post #295

dsl wrote: post #48

Earlier quoted context omitted.

Fixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header. The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).

I’ve used every major CDN on the market and none of them do this. Some don’t even check that the Host header host is a customer and just proxy it anyway.

I said the fix was easy, not that people were actually fixing it. :/

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#377

Post by TeMPOraL » Wed, May 02, 2018, 5:11 AM UTC

andrepd wrote: post #338

analognoise wrote: post #172

Earlier quoted context omitted.

How is it moral for Amazon to shirk their fiduciary duty to shareholders for the sake of a political battle it isn't theirs to wage? I counter it would be more immoral to put, say, the retirement funds of firefighters and teachers arty risk to achieve what is the responsibility of, say, the State Department?

To put it bluntly: fuck the shareholders. The question being asked shouldn't be "are the capital owners getting paid", but "is this company improving lives and delivering benefit". It's after all, what they're here for, not just to make money. No matter how much money I can make selling heroin, they're not gonna let me because, you guessed it, I'm doing damage by doing it.

What about countless of other, not censored, services delivered from the same network? Do they not "improve lives" and "deliver benefit"? Collateral freedom is akin to placing your guerilla command center in a hospital, in a gamble that the other side will leave you alone instead of risking extra harm to innocent civilians. In this case, the hospital decided to disallow guerillas to use it as cover.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#378

Post by TeMPOraL » Wed, May 02, 2018, 5:13 AM UTC

tony101 wrote: post #190

dragonwriter wrote: post #154

Earlier quoted context omitted.

> The cause is noble The cause is noble, but the mechanism is dubious: it can be viewed as, in effect, saying to oppressive regimes “to harm me, you must harm a bunch of innocent bystanders, too”.

That's the entire point of domain fronting and collateral freedom: to make censorship as expensive as possible for oppresive regimes.

Collateral freedom is like using human shields. You unilaterally decide to involve other innocent people in your fight, and risk their well-being.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#379

Post by TeMPOraL » Wed, May 02, 2018, 5:17 AM UTC

yndoendo wrote: post #216

unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

Real work example would be a re-mailer. Outside of the envelope shows one address it goes to but inside where others cannot look actually has the true address? Since the plain text has the fake address while the encryption has the true address, I see no issue with this.

A real world example would be an automated postal sorting/routing center with a bug that lets it be exploited as a remailer. By doing domain fronting, a single party is betting that this postal center is important enough not to get shut down/bombed. Obviously, the postal center isn't happy that you just put it at risk of getting shut down, because they deliver lots of other mail, none of which is obviously less important than your shenanigans. So instead, they opt to patch the bug that allows them to be unwittingly used as a remailer.

The core point being: Signal isn't using Amazon as a shield - it's using every single customer of Amazon as a shield.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#380

Post by xtat » Wed, May 02, 2018, 5:18 AM UTC

crazypyro wrote: post #293

tony101 wrote: post #185

Earlier quoted context omitted.

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

My first thought is "How is it in the interest of Amazon's stockholders to prevent censorship in countries ruled by dictatorial regimes?" and secondly, "How does consenting to being a front for services that are strictly forbidden in certain countries benefit our company?"

Shareholders still come first if they do the right thing here. Letting reputable people do good with your product rises the tide for the ecosystem. Good for the Internet is good for AWS.