Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Statement on Recent Events Between Signal and the Anti-Censorship Community

github.com

Post reply on HN
Print view View original

31–40 of 290 posts

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#31

Post by edent »

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerability highlighted by Naomi Wu and others.

I remember back when it was TextSecure - I tried to raise some usability and security issues. First I was ignored, then dismissed, then - a few years later - they implemented some of the changes.

I still use Signal. But the way the project is run is, dare I say, arrogant and dismissive.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#32

Post by nexthash »

sneak wrote: post #23
nexthash wrote: post #19

Earlier quoted context omitted.

This isn't putting anybody's life in danger - to my rough understanding the only thing detection of a proxy allows for is its takedown. I doubt the Iranian government has the resources or will to trawl their entire net for these proxies and trace their physical locations. What I meant by resolving the situation in a more productive way entails taking a step back and considering the situation outside this Twitter and…

> I doubt the Iranian government has the resources or will to trawl their entire net for these proxies and trace their physical locations. The proxies are necessarily run outside of Iran, as Signal is blocked inside of Iran. I think the (tenuous) argument is that the government could see that user X is connecting to proxy host Y (outside of Iran), and then themselves connect to proxy host Y to verify it's a Signal pr…

> classic hallmarks of sockpuppets

I doubt it, the two main researchers behind it both have an extensive history of contributions on Github. The correct explanation is most likely the simplest: egos mixed with typical programmer idealism proved to be a Molotov cocktail that flared into drama.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#33

Post by La1n »

sneak wrote: post #29
La1n wrote: post #27

Earlier quoted context omitted.

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Signal is end-to-end encrypted. The only thing the network surveillance would be able to determine is that you were connecting to Signal via an open Signal proxy, not the people you were talking to, or the content of your messages.

Yes? To some people just that fact would be revealing of needing to use Signal, it could be used in prosecution. Especially in the case where most people would not be using it at the moment.

Revealing the fact that one uses Signal can be an issue on itself.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#34

Post by yorwba »

La1n wrote: post #27
sneak wrote: post #23

Earlier quoted context omitted.

> I doubt the Iranian government has the resources or will to trawl their entire net for these proxies and trace their physical locations. The proxies are necessarily run outside of Iran, as Signal is blocked inside of Iran. I think the (tenuous) argument is that the government could see that user X is connecting to proxy host Y (outside of Iran), and then themselves connect to proxy host Y to verify it's a Signal pr…

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Did they draw the government's attention because they were connecting to banned websites or because they were running a high-profile news outlet?

It's seems unlikely to me that the Iranian government would be able to prosecute even a small fraction of instances of the former, whereas there's only a small number of high-profile news outlets at any given time.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#35

Post by nexthash »

edent wrote: post #31

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerability highlighted by Naomi Wu and others. I remember back when it was TextSecure - I tried to raise some usability and security issues. First I was ignored, then dismissed, then - a few years later - they implemented some of the changes. I still use Signal. Bu…

Maybe, but I think that the way these researchers reacted when their criticism wasn't heard doesn't benefit anybody. By ratcheting up the tension and participating in an internet catfight against the Signal team, a net loss occurs for the anti-censorship community.

If the Signal team does indeed have a real problem with taking feedback and criticism, a better approach might've been to gather support and enter into long-term negotiation over Signal's future relationship with the community. This would make its development a lot smoother and prevent anger and bruised egos from building in the future.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#36

Post by henearkr »

sneak wrote: post #29
La1n wrote: post #27

Earlier quoted context omitted.

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Signal is end-to-end encrypted. The only thing the network surveillance would be able to determine is that you were connecting to Signal via an open Signal proxy, not the people you were talking to, or the content of your messages.

The whole point is that, in countries in which Signal is forbidden, the mere fact to connect to it can lead to big troubles.

However I acknowledge that the problem solved here by Signal team is orthogonal to the one of hidding the users.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#37

Post by La1n »

yorwba wrote: post #34
La1n wrote: post #27

Earlier quoted context omitted.

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Did they draw the government's attention because they were connecting to banned websites or because they were running a high-profile news outlet? It's seems unlikely to me that the Iranian government would be able to prosecute even a small fraction of instances of the former, whereas there's only a small number of high-profile news outlets at any given time.

Some where jailed just for being Instagram "influencers". So it doesn't seem to be just high-profile news outlets.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#38

Post by fmajid »

La1n wrote: post #18
FDSGSG wrote: post #16

Earlier quoted context omitted.

>If their issues are closed (and Signal does not seem interested in discussing this) Signal merely asked that they post on community.signalusers.org instead of Github. >they feel like this is actively putting peoples lives in danger That's obviously bullshit though, this can't possibly put peoples lives in more danger than using signal without a proxy a week ago would've.

> this can't possibly put peoples lives in more danger than using signal without a proxy a week ago would've. I see one reason it could, it filters out people who do "need" to use it. It could even be people who did not use it before, but think it's undetectable now. Signal implies it can't be detected, at least to non-technical readers. >Unlike a standard HTTP proxy, connections to the Signal TLS Proxy look just lik…

If the mere use of Signal is banned, traffic analysis tools an DPI can be used to identify users and bring them the unwelcome attention of the regime’s well-staffed secret police. I’m sure the Chinese are selling them surveillance tech, and if not Iranians are quite capable of developing it themselves.

It’s not a simple issue to resolve. WireGuard is better in that it only establishes a flow if authenticated, but UDP traffic is a giveaway.

The bug reporters reacted immaturely to being asked to submit the report on the Signal forum instead of GitHub, but Signal hiding before a CoC to avoid discussing substantive issues is not a good look.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#39

Post by tlb »

sneak wrote: post #29
La1n wrote: post #27

Earlier quoted context omitted.

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Signal is end-to-end encrypted. The only thing the network surveillance would be able to determine is that you were connecting to Signal via an open Signal proxy, not the people you were talking to, or the content of your messages.

When proxying, who you're talking to can be determined from large-scale network surveillance. You look for patterns of messages sent from your device and messages of the same size received by another device immediately after.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#40

Post by nexthash »

ralfn wrote: post #21
nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

It's more important how we all feel about each other and our drama than the fact there isn't a currently easily available obvious way to have private secure conversations. Your "they are not being constructive enough" is actually very unconstructive, because it drags the conversation into more drama. The tone is not more important than the facts. It never is. Im not suggesting you have some alternative motive to defl…

I think we are both talking about tone. While you are saying that expressing emotions and the drama is important in a discussion over Signals' future, I believe that such conduct only drives a wedge into it. These issues are emotional and affect important freedoms, but while expressing them is important doing it in such a high-profile, damaging way can only bruise egos and create even more tension. Instead, both parties should sit down and take a long, serious look at their grievances and how they will address them.
Post reply on HN