Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Help users in Iran reconnect to Signal

signal.org

Post reply on HN
Print view View original

111–120 of 417 posts

Re: Help users in Iran reconnect to Signal

#111

Post by vineyardmike »

sergiosgc wrote: post #62

Signal should be federated. This censorship problem would not exist, or would be organically routed around, were the service federated. Without federation, Signal is just another stepping stone in the long path of eventually abandoned instant messengers, all the way back from ICQ. We will get to an SMTP-like protocol, and email-like service, at some point. If not Signal, some other one.

> organically routed around

Do any SMTP servers still allow organic routing? I was under the impression that all modern servers have extremely cumbersome auth/dkim and its hard to not be GMail and still send a real msg and have it arrive

Re: Help users in Iran reconnect to Signal

#113

Post by agnosticmantis »

nrvn wrote: post #95

Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave u…

I believe telegram itself is blocked in Iran, though.

Re: Help users in Iran reconnect to Signal

#114

Post by gspr »

IncludeSecurity wrote: post #66
superkuh wrote: post #33

What happens when Iran's government itself runs a bunch of these proxies?

Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.

I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not).

[1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6

Re: Help users in Iran reconnect to Signal

#115

Post by mholt »

theptip wrote: post #82
mholt wrote: post #3

I'm a big fan of the idea of independently-run proxy servers. Caddy has a secure forward proxy plugin born out of a research project at Google that does something similar, but works with any clients that let you configure HTTP proxies, and doesn't terminate TLS: instead it tunnels it over TLS. The proxy server itself can also be probe-resistant, i.e. difficult to detect that a website is acting as a proxy. I'm hoping…

Does this use TCP over TCP (painful in the face of packet loss[1]) or can you do something like using QUIC for the forward proxy to try to avoid breaking the tunneled TLS connection's retry timers? [1]: http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

Http3 support is being talked about in an issue (am mobile so no link for you right now) but the first priority -- pending dev resources -- is to merge the v2 PR and vet for bugs.

Re: Help users in Iran reconnect to Signal

#116

Post by rthomas6 »

WookieRushing wrote: post #74
sergiosgc wrote: post #62

Signal should be federated. This censorship problem would not exist, or would be organically routed around, were the service federated. Without federation, Signal is just another stepping stone in the long path of eventually abandoned instant messengers, all the way back from ICQ. We will get to an SMTP-like protocol, and email-like service, at some point. If not Signal, some other one.

I’m not so sure. Moxies reasons about how federation leads to protocol development slowing and then freezing are solid. It’s why we re not using smtp for chat. SMTP can’t be extended enough so replacements are built instead. Similarly if signal federated, eventually it would freeze and a few years later users would move to wherever they could get new features. Federation is a good thing but only when the protocol is…

I don't see what prevents updating as long as you don't care about fragmentation. You probably can't compile all brand new software on a very old Linux kernel, but who cares. I mean yeah, you'll have to care more about fragmentation, but it's not all or nothing. You'll still be able to update the protocol, you just have to make breaking changes less often.

I think XMPP is a better comparison than SMTP. In its heyday, XMPP had several clients, some with different proprietary extensions, and all the core functionality basically worked across all the clients. Though it turns out some of the messengers I thought were XMPP were actually different protocols that XMPP could work with. Imagine that. People still use it too, though it's not as popular as it was in the 2000s.

Re: Help users in Iran reconnect to Signal

#117

Post by sschueller »

AndrewBissell wrote: post #59
est31 wrote: post #41

In the long run, starlink will make it even harder for autocrat regimes to censor the internet. Russian authorities already try to ban connections to Starlink.

Yes I'm sure Starlink would never do something like censor traffic at some regime's behest. Elon Musk is famously independent and not at all beholden to funding from the U.S. and China.

/sarcasm

Re: Help users in Iran reconnect to Signal

#118

Post by boomboomsubban »

not2b wrote: post #50
cmroanirgo wrote: post #4

Earlier quoted context omitted.

I think Signal is clearly recognising that nearly sny server or system they create will be blocked, which is why they recommended this being done on an individual layer. From the article: > A more discrete approach would be to only send the link via a DM or a non-public message. You can post something like this on your favorite social network: > * #IRanASignalProxy Reply to this thread if you want the connection deta…

No good; people working for the Iranian state will DM. Signal didn't think this through. No one should announce proxies via social media. Tell people how to set one up for friends and family.

People working for the Iranian state generally would be discernible from their Twitter account, and by controlling the information you hand out you can also flag the hidden accounts that aren't easily recognized.

You also overestimate how committed Iran is to stopping this. Doing this in public risks the state finding out, but outside of times of crisis the state is usually pretty slow to respond. Keeping it private tanks participation rates.

Re: Help users in Iran reconnect to Signal

#119

Post by sigmar »

nrvn wrote: post #95

Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave u…

That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way

Re: Help users in Iran reconnect to Signal

#120

Post by oarsinsync »

twhb wrote: post #106
djl0 wrote: post #69

If Iran is blocking Signal but not other apps, namely Whatsapp, does this mean Iran has access to Whatsapp data? I fully expect the US govt to have access to fb/whatsapp data (at least the metadata), but it's a bit surprising to me that Iran would too.

Iran blocks every major foreign messaging app, except WhatsApp. Signal escaped it until now only because they had so few users. Also keep in mind that while WhatsApp claims to use the Signal protocol, they installed a backdoor that allows them to MITM conversations. So yes, I’d say it’s virtually guaranteed that WhatsApp is sending unencrypted message data to Iran, and of course to the US too.

> [WhatsApp] installed a backdoor that allows them to MITM conversations

Citation?

Post reply on HN