Could the Iranian government also run a Signal proxy? Can they then read said proxy traffic since it’s on their machine?
No, Nobody even signal can't, that's the whole point of e2e
Help users in Iran reconnect to Signal
101–110 of 417 posts
Re: Help users in Iran reconnect to Signal
#102In the long run, starlink will make it even harder for autocrat regimes to censor the internet. Russian authorities already try to ban connections to Starlink.
Unfortunately, it's easy for governments to criminalise owning Starlink terminal equipment. Also, Starlink may be legally forced to deny service to users in certain geographical regions.
Unless the government can seize Starlink's assets, or shut down/harm their operations, they can't really tell Starlink to do anything. E.g. if they can shoot down satellites, they'd have influence.
This is especially true for economies that are as disconnected from the US as the Iranian one is.
The only thing a state has control over is payments from users. But if smuggling in transceiver equipment with pre paid traffic isn't that hard.
Re: Help users in Iran reconnect to Signal
#103Damn, I've read the code. This won't work against an active probe. Censors just use signal domains and non-signal domains to test your proxy. If signal domains get passed and non-signal domains got denied, you are fucked. Besides, TLS in TLS is highly identifiable by simple packet length dpi. I'd hope there's better plan.
> Censors just use signal domains and non-signal domains to test your proxy. If the censor already knows about your proxy they would have no reason to test it... The whole point is that there isn't a central list of proxies for them to easily block.
This is the very same problem that Tor faced when Tor bridge use started to pick up in China around the late 2000s / early 2010s. You only needed a single Chinese user to connect to your server for it to be probed by the Chinese censors. Older versions of the obfs Tor bridge protocol could be detected by active probes and thus blocked very much like these Signal proxies. This is a cat and mouse game that Signal could very easily lose should Iran start to care about probing all new active connections that leave Iran.
Re: Help users in Iran reconnect to Signal
#104Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing signal/moxie/no federation/whatever...
Just spin up a server if you can spare the expense and help some people out.
Action > inaction.
edit: you can get the connection details via @appliedlambdas on twitter!
Re: Help users in Iran reconnect to Signal
#105Could the Iranian government also run a Signal proxy? Can they then read said proxy traffic since it’s on their machine?
They could certainly do this, but they would only see which local IP is trying to communicate with Signal (and thus trace the user). The traffic itself is end to end encrypted so they cant read it.
Re: Help users in Iran reconnect to Signal
#106If Iran is blocking Signal but not other apps, namely Whatsapp, does this mean Iran has access to Whatsapp data? I fully expect the US govt to have access to fb/whatsapp data (at least the metadata), but it's a bit surprising to me that Iran would too.
Iran blocks every major foreign messaging app, except WhatsApp. Signal escaped it until now only because they had so few users. Also keep in mind that while WhatsApp claims to use the Signal protocol, they installed a backdoor that allows them to MITM conversations. So yes, I’d say it’s virtually guaranteed that WhatsApp is sending unencrypted message data to Iran, and of course to the US too.
Re: Help users in Iran reconnect to Signal
#107How would you let users know about this proxy without letting their government know about it? Instead of platforms like twitter, how about randomly giving out random proxies in some header that the app could query on cloudflare or google or akamai? Does Signal already make use of any CDN's for out-of-band signalling and fail-over? If the Signal proxy could expose an obfuscated load metric, then the CDN could pick ano…
That's the trick isn't it: having an entire population know something an oppressive government doesn't. Even if you teach everyone how to deploy their own servers, then that's the knowledge the government will start targeting. You can make blocks expensive, i.e. blocking other major, useful services that would disrupt society too much for them to want to deal with, but this of course has its own costs. It's censorshi…
That is precisely why I am suggesting using a CDN. Old school CDN that is. Back in the day, if you had Akamai, your site would just use one (or many) of their generic names. Nowadays you can use your own domain to front their network, but you don't have to. If Signal was using a few CDN's and cycled through many generic end-point names, then Iran would have to block all the CDN's which would be nearly the same as shutting off the internet. This would not have to be the default mode of Signal. It could be an option that the client suggests. "Hey, it appears we are blocked. Use alternate proxies?" Then cycle through many different CDN's using many generic end-point names. Some of the CDN's can also do layer 4 vips and not have to decrypt anything. They can just act as a TCP tunnel if need be, just costs more.
Re: Help users in Iran reconnect to Signal
#108I created an HAProxy configuration that should be equivalent to the nginx configuration within the Signal-TLS-Proxy repository:
https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7...
I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.
Re: Help users in Iran reconnect to Signal
#109Everyone complaining this is just a cat-and-mouse game, it’s not a game these people choose to play. They either play it or their movement dies.
Of course it's a cat and mouse game.
That doesn't mean it's unwinnable. That means you create a lot of evasive mice and win.
Perfect is the enemy of the good. This is the kind of thing where winning is more important than a perfect strategy.
Be water.
Re: Help users in Iran reconnect to Signal
#110What is the state of the art on censorship resistance right now? This cat-and-mouse proxy fight never seems to go great for the good guys. My last in-depth reading on it was the excellent 2016 SoK paper “Towards grounding censorship circumvention in empiricism” ( http://www.cs.umd.edu/class/fall2018/cmsc818O/papers/sok-cen... ) The high level takeaway then seemed to be that researchers were not focusing efforts on me…
Telegram got around Russian censors by constantly pushing new IPs for their servers with Google Cloud. Of course this is a cat and mouse game as well, but it worked out well for them, since Russia didn't want to block all of Google/AWS.