Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Help users in Iran reconnect to Signal

signal.org

Post reply on HN
Print view View original

331–340 of 417 posts

Re: Help users in Iran reconnect to Signal

#331

Post by lmm »

acct776 wrote: post #326
lmm wrote: post #307

Earlier quoted context omitted.

The same is true of Signal in most practical ways. You can only run it on platforms that are fundamentally closed-source (either iOS or Google Play Services), so there's no reason to believe the RNGs it uses (and therefore all your session keys) are not backdoored. And you can only install it through official app stores where it's difficult or impossible to inspect what binary you have or "pin" a given version. So I…

I run Signal on GrapheneOS and find this comment incorrect and borderline offensive.

I see that Signal no longer depends on Google Play Services specifically. However it's still the case that it depends on proprietary Google code (it just includes that code in its own APK now) and still can't practically be installed without auto-update (again, it just includes that in its APK).

Re: Help users in Iran reconnect to Signal

#333

Post by GranPC »

rhplus wrote: post #332

> Your proxy is now running! You can share your proxy with friends and family using this URL format: " rel="nofollow">https://signal.tube/# Won't the censors just block DNS for `signal.tube` immediately?

It looks like the Android app has an intent filter to present itself as an option to handle signal.tube links, so DNS resolution isn't necessary: https://github.com/signalapp/Signal-Android/blob/master/app/...

Re: Help users in Iran reconnect to Signal

#334

Post by sudosysgen »

gruez wrote: post #70
lacker wrote: post #26

Earlier quoted context omitted.

Iran is already blocking Tor. In general, if Signal provides some central way to use Tor together with Signal, the Iranian government can just run it on their machine, and block every IP address that it tries to connect to. Iran can block these proxies, too, but this way there isn't any centralized listing of proxies. This proxy setup is simple enough that a single person could run a proxy for a few dozen of their fr…

there are public and private bridges.

If I remember correctly from what my Iranian friends told me not long ago, there are indeed working bridges in Iran.

Re: Help users in Iran reconnect to Signal

#335

Post by sudosysgen »

smnrchrds wrote: post #131
agnosticmantis wrote: post #113

Earlier quoted context omitted.

I believe telegram itself is blocked in Iran, though.

It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress,…

Telegram blocking in Iran is theoretical. There are still a great many Iranians successfully using Telegram (via proxies or modified versions of the app).

Re: Help users in Iran reconnect to Signal

#336

Post by 319e82aff522 »

stunt wrote: post #238

So their government is blocking Facebook, Twitter, Youtube, Telegram, Signal, BBC, CNN, Netflix, and probably many other social and media platforms. Meanwhile we are blocking Iranians to access Docker, Slack, Gitlab, Google Code, Github(Github until recently), Paypal, Apple Store, Play Store, AWS, Coursera, Adobe, Nvidia, AVG, Avast, Symantec, McAfee, Matlab!!, Oracle and many more. It should be really fun to use Int…

Spot on! This is the 21st century's version of being born into a poor African American family.

Jokes aside it's truely painful. I was lucky to have a job that got me out easily. Though it felt embarrassing when I was seeing everyone uses Docker and AWS extensively at my new job while I had never used them properly not because I wasn't smart enough but just because of where I born :(

Re: Help users in Iran reconnect to Signal

#338

Post by greysonp »

josephg wrote: post #246
2cb wrote: post #190

Earlier quoted context omitted.

They could literally have a hidden function in WhatsApp that scoops up all your chat history and sends it to Facebook if the government ask them to. It’s closed source. No one has a clue what it’s doing. To be clear I’m not suggesting this is absolutely happening. I’m merely pointing out it’s entirely possible from a technological perspective given it’s closed source software owned by Facebook. That’s not a recipe fo…

To be clear about the threat vector, there's also nothing stopping signal from doing the same if they wanted to. Its impossible to tell if the version of signal you download from the app store is unmodified from the code you can find on github. I trust signal more than I trust facebook, but if you use signal, even though its opensource you still have to trust them not to put anything funky in the binary they upload t…

Hi there, Signal Android dev here. We have reproducible build steps, so you actually can verify the code is the same :)

https://github.com/signalapp/Signal-Android/tree/master/repr...

Re: Help users in Iran reconnect to Signal

#339

Post by tga_d »

lmm wrote: post #331
acct776 wrote: post #326

Earlier quoted context omitted.

I run Signal on GrapheneOS and find this comment incorrect and borderline offensive.

I see that Signal no longer depends on Google Play Services specifically. However it's still the case that it depends on proprietary Google code (it just includes that code in its own APK now) and still can't practically be installed without auto-update (again, it just includes that in its APK).

The "proprietary Google code" is a library with a well defined API, you can see what it has access to. I agree that Signal should take it out, but it's not an especially big deal from a security perspective.

The auto update functionality just tells you that an update is available, you can choose not to install it. You can also independently verify that the sha256 sum matches the one given on the website, and that the binary that sha256 sum corresponds to is produced via the reproducible build instructions. There are occasional bugs (I'd estimate a couple times a year, though it's less and less frequent) that causes the reproducible build to not match the provided build, and it's quickly noticed by someone and an issue opened in the issue tracker. If there were no explanation or no quick resolution, people would publicly raise a stink about it.

Re: Help users in Iran reconnect to Signal

#340

Post by mercora »

lucb1e wrote: post #256
realducksoft wrote: post #163

This proxy failed to be probing resistant. The PoC code is released by studentmain: https://github.com/signalapp/Signal-TLS-Proxy/issues/3#issue...

That's the sort of PoC that should be PGP encrypted to the Signal authors instead of publicly posted. Iran will have a field day with it being posted like this. Except, of course, that posting public keys is too 1990s for him https://moxie.org/2015/02/24/gpg-and-me.html (which contains some good arguments but offers no solutions, so whatcha gonna do, post a phone number and trust the signal servers to give you the ri…

it is pretty trivial though and an obvious deficit easily visible by just looking at the "code" or nginx config in this case... it is even trivial to come up with this without knowing any of the setups details...
Post reply on HN