Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal's TLS Proxy Failed to Be Probing Resistant

github.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#21

Post by ryanlol »

wdb wrote: post #18
schoolornot wrote: post #2

Moxie deserves an ACM award for his contributions to crypto but he shouldn't be leading the project. Maybe posting on the Discourse forum was the right thing to do here. I just see a lot of hostility between Signal employees and those wishing to make the project a little bit better.

They have been ignoring or brushed off the importance of reported privacy related issues for years. Doesn't built trust to use Signal for me personally

Could you be more specific about the issues they’ve been ignoring or brushing off?

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#22

Post by wdb »

ryanlol wrote: post #21
wdb wrote: post #18

Earlier quoted context omitted.

They have been ignoring or brushed off the importance of reported privacy related issues for years. Doesn't built trust to use Signal for me personally

Could you be more specific about the issues they’ve been ignoring or brushing off?

For a year, they have been reporting reports of the issue wit the IME keyboards. See: https://community.signalusers.org/t/signal-should-warn-users...

If you are serious about privacy and secure messenger, you just can't brush off such issues.

[1] https://twitter.com/realsexycyborg/status/119769536810582425... [2] https://community.signalusers.org/t/signal-should-warn-users... [2] https://www.theverge.com/22249391/signal-app-abuse-messaging...

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#23

Post by nix23 »

iforgotpassword wrote: post #20
kelnos wrote: post #7

Earlier quoted context omitted.

That so-called hostility seems to be pretty one-sided IMO. The response from the Signal dev seemed pretty calm and reasonable, but OP seemed to take it as a personal insult for no reason. Some projects don't want to discuss issues on GitHub and prefer a forum they have control over; that's totally understandable.

That's those projects I don't report issues to and rather maintain local patches for. I'm not gonna sign up to the fivetrillionth forum or bug tracker for your special snowflake software. If you don't allow bug reports via github issues, you won't get mine.

From pure interpretation of your answer, i would say you are the snowflake human here.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#24

Post by meibo »

My experience with the Signal team in issues and their community has been about the same.

They're generally dismissive, especially so about design problems that cause a big amount of bugs that are strewn throughout Signal, like their handling of message timestamps/sync and dismissal of the IME concerns.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#25

Post by nix23 »

wdb wrote: post #22
ryanlol wrote: post #21

Earlier quoted context omitted.

Could you be more specific about the issues they’ve been ignoring or brushing off?

For a year, they have been reporting reports of the issue wit the IME keyboards. See: https://community.signalusers.org/t/signal-should-warn-users... If you are serious about privacy and secure messenger, you just can't brush off such issues. [1] https://twitter.com/realsexycyborg/status/119769536810582425... [2] https://community.signalusers.org/t/signal-should-warn-users... [2] https://www.theverge.com/22249391/sig…

That's not a problem of Signal but of insecure IME-Apps.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#26

Post by ryanlol »

wdb wrote: post #22
ryanlol wrote: post #21

Earlier quoted context omitted.

Could you be more specific about the issues they’ve been ignoring or brushing off?

For a year, they have been reporting reports of the issue wit the IME keyboards. See: https://community.signalusers.org/t/signal-should-warn-users... If you are serious about privacy and secure messenger, you just can't brush off such issues. [1] https://twitter.com/realsexycyborg/status/119769536810582425... [2] https://community.signalusers.org/t/signal-should-warn-users... [2] https://www.theverge.com/22249391/sig…

Of course they’re brushing this off, there’s simply nothing they can do to solve the problem of compromised platforms.

Signal should focus on problems they can realistically solve.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#27

Post by iforgotpassword »

nix23 wrote: post #23
iforgotpassword wrote: post #20

Earlier quoted context omitted.

That's those projects I don't report issues to and rather maintain local patches for. I'm not gonna sign up to the fivetrillionth forum or bug tracker for your special snowflake software. If you don't allow bug reports via github issues, you won't get mine.

From pure interpretation of your answer, i would say you are the snowflake human here.

I guess not wanting to sign up with my email adress on servers administered by god knows who with unknown security practices just to help you makes me a special snowflake then.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#28

Post by kevincox »

This seems like a relatively easy issue to fix. If they included a "password" to the proxy (and stuck it on the share URL) then the proxy can reject requests unless the password authentication passed. This way it would look like any other HTTPS site that was password protected. Only if you know the password would you get proof that the other end was connected to Signal.

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#29

Post by LinuxBender »

I still think they should have used layer 4 CDN endpoints that use generic names on several of the CDN providers that support L4. It would be endless whack-a-mole to block that. Not perfect, but not perfect is probably useful enough for those impacted by blocks as it would mean periodic latency vs. being locked out entirely. Moxie, if you are reading this, to mitigate some of the probing or fingerprinting, consider borrowing some of the code from sslh [1] and I acknowledge this would be an endless arms race.

[1] - https://github.com/yrutschle/sslh

Re: Signal's TLS Proxy Failed to Be Probing Resistant

#30

Post by realducksoft »

godelski wrote: post #12
tarkin2 wrote: post #3

How long did he wait for the signal forum to approve his account? The guy, or girl, seems rather aggressive. It's mentioned they've not slept in a while...

It got approved fairly quickly. It was a false positive (see my link in main thread) with their spam detection (DuckSoft copy pasted the post so flagged as "type too fast").

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

I am DuckSoft on GitHub and I prove my identity by GPG signing this message.

I am not typing too fast, nor pasting all my stuffs into the comment area. I just put a link to the GitHub issue. The discussion board even automatically extracted title and abstract for me, where I thought, 'pretty cool huh'.

Then I got banned. -----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE2H0QtOEy/6QN7CMrejqfpuT9So0FAmAdx9IACgkQejqfpuT9 So1KrQf+M8VzJBj4FgNZB/KZZ/suxNBF9DEkcfR66mwf/YzGGK9Gf2QDBqNoHUJs jJGvRai4ygqtZE3oX3GZmkjRT8LzEiNgmOM+B39SehL7F9rhMGz4lHMrRV5ZnSxp w5ALHSs3L6Gyg5hwNOQV73+STg9Vc2TsWSCS+Xr+BuNYbbLwiKWV9M1pxOynaWx0 J5+JswXaZkEONcKyGKbwc2FrgH1EXRgv+TipHucAkz+1HVMRd9NZ5W38vjASWEwO dEXXmCWyH8rQ69rLU+M7lXiKY0IBVrvVirzC97TpS22A74FDTdEG4xpGHSzPaDFp 3DRJvymGOlHDqhlotR8ox1ndFPzR9A== =ib+f -----END PGP SIGNATURE-----

Post reply on HN