Amazon threatens to suspend Signal's AWS account over censorship circumvention • Hacker News Board

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#491

Post by thecrash » Wed, May 02, 2018, 3:48 PM UTC

tripzilch wrote: post #476

tony101 wrote: post #185

Earlier quoted context omitted.

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

Isn't the first problem that mr Marlinspike has been holding off federation of the Signal protocol? If anyone could run a server and join the Signal network (like Riot/Matrix, who got it right), the problem of circumventing censorship would be a lot easier. Any one of these federated servers could use whatever tricks they like to circumvent censorship, and yes they'd risk getting banned themselves if their circumvent…

Federation significantly complicates usability, and Signal's approach tends to prioritize usability. This is probably its most significant difference from other open source crypto tools.

Your argument is that Signal should erase its differences and become like other open source crypto tools. But as you pointed out, the tool you're asking for already exists! If Matrix is already doing it right, then what's the problem? Surely everyone will switch over to the superior infrastructure and not look back.

I have a different explanation: Signal is successful specifically because of controversial decisions like refusing federation, and the reason other tools do not enjoy the same success is because of the usability compromises they have made.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#492

Post by insensible » Wed, May 02, 2018, 4:02 PM UTC

sterlind wrote: post #242

insensible wrote: post #111

Earlier quoted context omitted.

I have looked into the Russia/Telegram war thoroughly due to personal interest, and to my knowledge that situation hasn't involved domain fronting. Rather, Russia is blocking by IP and Telegram is hopping to IPs all over the cloud. Russia is on record as wishing to go a different path than the Great Firewall of China. From statements I read including Putin, they're saying they want to avoid a deep packet inspection r…

Russia's butting heads with Telegram under a law that requires all service providers to yield their public keys to FSB. Telegram isn't being banned over access to a particular someone's messages, it's over handing them everything. Considering that Russia has banned all of Wikipedia in the past, among numerous others, it's a little naive to take Putin at his word here.

In this case the naivete is in taking press reports at their word.

When Telegram sued, the court proceedings were published by zona.media: https://zona.media/online/2018/03/20/tlgrmvs . I have read them in full (in translation, but it was specifically addressed and crystal clear with regard to this matter). The transcript firmly establishes that it is factually incorrect that this matter is "over handing them everything". That was reported by some outlets, but the zona.media reporter covering the court proceedings complained that it was immediately misreported. There was a bombing that claimed fatalities, it was established that Telegram was able to provide the decrypted chats of the suspects, the FSB got a lawful order for those conversations, and I believe the relevant keys. (If Telegram really doesn't key its users' conversations using separate derived keys, their crypto is even worse than we thought!) Russia has a law specifically protecting the privacy of private conversations, and the FSB specifically acknowledged this right in court and specified that their order was lawful and narrow.

The hugely broad blocking is precisely because they are not getting into wholesale deep packet inspection. These episodes are embarrassing for them, as confirmed by recent statements by two of Putin's advisers, but they do it to pursue the rule of law. I am a fan of less government intervention in general, but if the government intervenes, I want it to be transparent and follow due process. At least in this case, Russia is doing that...it's just ridiculously heavy-handed.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#493

Post by thecrash » Wed, May 02, 2018, 4:13 PM UTC

manigandham wrote: post #300

fwn wrote: post #241

Earlier quoted context omitted.

It is perfectly understandable why Amazon did that and siding with oppressive regimes is of course not unreasonable at all. Just unethical, hence the discussion.

AWS is not siding with oppressive regimes, what's with the misleading political slant? They don't want customers breaking terms of service, whatever those terms are, and especially when it means the rest of their customers are affected. It's not a single company involved here and they're looking out for everyone else they serve.

In this case, enforcing their Terms of Service does constitute siding with oppressive regimes. You could argue that it's not AWS' goal to help oppressive regimes, but in the struggle against censorship, that is the side they have put themselves on in practice. On one side, there are people all over the world who want to communicate freely. On the other, there are authoritarians who want to suppress and surveil that communication. AWS policy used to help the former, and now helps the latter.

I think maybe you're trying to express that under a free market ethical framework, AWS has done nothing wrong here. Which is true, and an insightful indictment of the free market as an inherently liberatory force.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#494

Post by cjbprime » Wed, May 02, 2018, 4:13 PM UTC

kombucha2 wrote: post #101

Couldn't they ask people to donate their AWS instances or a portion of their webserver (or domain) resources to running a small outward facing webserver as a dummy, making the domain look like its a real website (eCommerce etc) and then passing Signal data through a Shadowsocks (or something similar) proxy? Couldn't they develop an AMI that they hold the keys to that people could deploy with ease?

Amusing idea: use Bitcoin's blockchain as a peer announce mechanism. Does your country want to be involved in cryptocurrencies less than they want to censor?

On second thought, the countries most interested in censoring are probably also the countries most interested in blocking people from using Bitcoin? :)

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#495

Post by thecrash » Wed, May 02, 2018, 4:24 PM UTC

dragonwriter wrote: post #381

TeMPOraL wrote: post #378

Earlier quoted context omitted.

Collateral freedom is like using human shields. You unilaterally decide to involve other innocent people in your fight, and risk their well-being.

The name even hints at that: it's freedom that rests on the targets unwillingness to inflict collateral damage. Which, questions of morality in the abstract and consent aside, seems to gamble pretty heavily on sensitivity the regimes of concern are decidedly not known for.

They are sensitive to collateral damage, though, otherwise they could just turn off internet access. It's actually pretty easy for a state-level actor.

Why do you think they don't?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#496

Post by toast0 » Wed, May 02, 2018, 4:27 PM UTC

tialaramex wrote: post #417

toast0 wrote: post #325

Earlier quoted context omitted.

They are more likely to oppose encrypted SNI on the grounds it's not really possible. How do you encrypt SNI for cold start? For a future connection, I could see how, but at that point you may as well simply do a resumption.

https://datatracker.ietf.org/doc/draft-ietf-tls-sni-encrypti... ... is the current state of work on this problem. It's true that encryption (within the desirable parameters discussed in that ID) costs us a round trip, but it might be worth it for most of us most of the time. Keep in mind the TLS you're using today for most sites has 2RTT setup, and we put up with that (if you have a modern browser and go to some majo…

Modern browsers (send ALPN) to sites with decent TLS 1.2 stacks (respond to ALPN, even if it's just to say http/1.1) get a 1RTT handshake on TLS 1.2 with TLS false start. TLS 1.3 is nice, but it's not required to get 1RTT.

The doc you sent is titled SNI encryption, but is really about tunneling a client hello through a proxy, and provides for the proxy to not send its own server hello, but only send the origin server's server hello. That's interesting, and should be useful for domain fronting and as a general purpose TLS proxy with fewer layers, but it's not really encrypted SNI.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#497

Post by ryangee » Wed, May 02, 2018, 5:00 PM UTC

tripzilch wrote: post #476

tony101 wrote: post #185

Earlier quoted context omitted.

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

Isn't the first problem that mr Marlinspike has been holding off federation of the Signal protocol? If anyone could run a server and join the Signal network (like Riot/Matrix, who got it right), the problem of circumventing censorship would be a lot easier. Any one of these federated servers could use whatever tricks they like to circumvent censorship, and yes they'd risk getting banned themselves if their circumvent…

> I haven't heard a single reason for holding off federation from Moxie (and the "best" reason I currently can come up with is that he has issues letting go of "his baby", other reasons being more nefarious).

I mean, there's no need to speculate here. There's an entire blog post on signal written about why they chose not to federate just a quick google search for 'signal federation' away, and the reasons, whether you agree with them or not, are pretty solid and sound.

https://signal.org/blog/the-ecosystem-is-moving/

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#498

Post by dang » Wed, May 02, 2018, 5:38 PM UTC

tony101 wrote: post #407

dang wrote: post #394

Earlier quoted context omitted.

You posted that Wikipedia link 4 times in this thread. That's a bit much, and also kind of dodgy to do without mentioning that you wrote it.

> "4 times in this thread. That's a bit much" Point taken, I'll be more careful in the future. > "kind of dodgy to do without mentioning that you wrote it" The article is completely neutral, cites reliable sources, has been reviewed by another editor[1], and abides by all Wikipedia policies. I do not personally gain anything from posting it here. I didn't think the fact that I initially created the article was releva…

I see your point, though it still feels a bit dodgy to me, and I suspect to many other HN readers. Fortunately it's a rare and borderline case so we don't need to worry about it too much.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#499

Post by manigandham » Wed, May 02, 2018, 5:42 PM UTC

latch wrote: post #474

manigandham wrote: post #450

Earlier quoted context omitted.

It's an option, and if it comes to war then the legality of whether it should've been declared is usually not a priority. Also in the context of oppressive regimes, the "aggression" in this case wouldn't be unwarranted, nor is it unprecedented. Regardless, what actually isn't proper is expecting major corporations to do police duty. That never ends well.

A war of aggression has nothing to do with whether or not it was declared (in fact, declaring such a war is, by itself, considered a war of aggression and is illegal and is a war crime). Are you sure you still feel that committing a war crime and doing what philosophers and statesmen and lawyers consider the "supreme" crime is really worse than "expecting major corporations to do police duty" ? I think part of your a…

What? You've seemed to have lost all context here:

1) As noble as the cause may seem, it would be better for everyone if massive corporations just focused on business instead of politics. It's reasonable, predictable, and safer. Signal is not affected by this, it just means picking a better option than breaking terms of service.

2) The correct process for citizens of a country is through government diplomatic and military action, especially when concerning other foreign states. That's all I said, and another posted specifically asked about the military in which case the option is called war. This entire story is about oppressive powers, most of which are disabled through military action, so it's not a strange concept and nowhere is a war of aggression mentioned.

Perhaps take a step down from your moral high ground and try to comprehend the entire conversation before telling someone that they are advocating for war crimes, that would be much more helpful if you want a meaningful discussion.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#500

Post by manigandham » Wed, May 02, 2018, 6:23 PM UTC

thecrash wrote: post #493

manigandham wrote: post #300

Earlier quoted context omitted.

AWS is not siding with oppressive regimes, what's with the misleading political slant? They don't want customers breaking terms of service, whatever those terms are, and especially when it means the rest of their customers are affected. It's not a single company involved here and they're looking out for everyone else they serve.

In this case, enforcing their Terms of Service does constitute siding with oppressive regimes. You could argue that it's not AWS' goal to help oppressive regimes, but in the struggle against censorship, that is the side they have put themselves on in practice. On one side, there are people all over the world who want to communicate freely. On the other, there are authoritarians who want to suppress and surveil that c…

That's not what "siding with" means. AWS is remaining neutral to politics as a company, which is a very good thing. Why do you want multinational corporations to get more involved in geopolitics? Do you think that will somehow lead to a better outcome?

Signal had an strategy, but it involves breaking the terms of service, so that vendor has no reason to comply and put the other customers at risk. Signal just needs to figure out another option. It's a technical issue and nobody is stopping Signal itself. AWS will still host them just fine as long as they follow the terms.

By the way, the free market is what allowed companies like AWS and Signal to exist in the first place, and lets you contributed effort and money if you'd like, so perhaps you should widen your context before throwing around indictments.