Here is an interesting discussion: https://github.com/signalapp/Signal-TLS-Proxy/issues/3
Help users in Iran reconnect to Signal
81–90 of 417 posts
Re: Help users in Iran reconnect to Signal
#82I'm a big fan of the idea of independently-run proxy servers. Caddy has a secure forward proxy plugin born out of a research project at Google that does something similar, but works with any clients that let you configure HTTP proxies, and doesn't terminate TLS: instead it tunnels it over TLS. The proxy server itself can also be probe-resistant, i.e. difficult to detect that a website is acting as a proxy. I'm hoping…
Does this use TCP over TCP (painful in the face of packet loss[1]) or can you do something like using QUIC for the forward proxy to try to avoid breaking the tunneled TLS connection's retry timers?
Re: Help users in Iran reconnect to Signal
#83What happens when Iran's government itself runs a bunch of these proxies?
If all the traffic going via the proxies is e2e encrypted is there much that can happen?
But the fact that you are in Iran and using Signal may get you added to a watchlist. They can trace the IP addresses connecting to the proxy server back to a household or phone, no?
Re: Help users in Iran reconnect to Signal
#84Is there a similar project to help Trump reconnect to twitter?
/s
Re: Help users in Iran reconnect to Signal
#85Earlier quoted context omitted.
if they block can block tor what makes you think they can't block these proxies? furthermore if you use tor you can use the existing network of bridges/relays as well as their pluggable transports protocol to avoid DPI/traffic analysis.
They can block these proxies. Thats why in the #IRanASignalProxy section they say to share in more discrete ways if you can.
Which to me is bad. They should run a service like Tor does to get private bridges. I don't know anyone in Iran but I have a server I could use for this. However I know zero people in Iran.
Re: Help users in Iran reconnect to Signal
#86Doesn't this chip away at the benefits of Signal not being federated? Say the proxies need to be updated?
Re: Help users in Iran reconnect to Signal
#87What happens when Iran's government itself runs a bunch of these proxies?
Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.
That’s awful.
Re: Help users in Iran reconnect to Signal
#88Earlier quoted context omitted.
I think Signal is clearly recognising that nearly sny server or system they create will be blocked, which is why they recommended this being done on an individual layer. From the article: > A more discrete approach would be to only send the link via a DM or a non-public message. You can post something like this on your favorite social network: > * #IRanASignalProxy Reply to this thread if you want the connection deta…
No good; people working for the Iranian state will DM. Signal didn't think this through. No one should announce proxies via social media. Tell people how to set one up for friends and family.
There are plenty of people that don't have friends of family in Iran but would still like to help.
Re: Help users in Iran reconnect to Signal
#89Earlier quoted context omitted.
You're welcome to either use such a decentralised service or fork signal and add decentralisation / federation. Centralised services get more users by having a lower threshold of adoption.
> You're welcome to either use such a decentralised service or fork signal and add decentralisation / federation. It's called XMPP. It predates Signal by ~15 years.
And the clients for XMPP still suck, 15 years later. You might find a good one on one OS after trying out several (install, test for a few days, repeat), but then when you want a client on your phone or another OS, you have to try the install/test cycle all over again.
In my experience, most of the clients just don’t do WEll everything a modern IM client needs.... group chat without needing to know a FQDN address, alerting on new messages/mentions, image and attachment support, encryption without wonky key management, multisession support (connecting simultaneously from multiple devices not leading to problems), on and on...
I used XMPP for years on iOS, android, Mac, windows, and linux. Hated it every day.
Re: Help users in Iran reconnect to Signal
#90Doesn't this chip away at the benefits of Signal not being federated? Say the proxies need to be updated?
Not really. There's not much Signal-protocol-specific technology involved on the proxy, other than dropping traffic that doesn't go towards the Signal server itself.