Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Help users in Iran reconnect to Signal

signal.org

Post reply on HN
Print view View original

131–140 of 417 posts

Re: Help users in Iran reconnect to Signal

#131

Post by smnrchrds »

agnosticmantis wrote: post #113
nrvn wrote: post #95

Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave u…

I believe telegram itself is blocked in Iran, though.

It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress, Facebook, YouTube, etc. and made their jobs much easier.

Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.

Re: Help users in Iran reconnect to Signal

#132

Post by remram »

TimWolla wrote: post #108

I created an HAProxy configuration that should be equivalent to the nginx configuration within the Signal-TLS-Proxy repository: https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7... I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.

Their proxy seems to just be nginx, I'm surprised they didn't just share nginx or apache configurations. Most people with a box suitable for running this are probably already running a web server, so there's no reason they should be proxying from their existing web server to this dockerized server which just proxies to Signal.

Looking into their repo, they also appear to be building an nginx image from docker.io/ubuntu:20.04 instead of using docker.io/nginx. They are also running two separate nginx processes. I wonder how they ended up with this weird intricate setup.

I would be glad to help if they offered straightforward instructions.

Re: Help users in Iran reconnect to Signal

#133

Post by dijit »

isoprophlex wrote: post #104

Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing signal/moxie/no federation/whatever... Just spin up a server if you can spare the expense and help some people out. Action > inaction. edit: you can get the connection details via @appliedlambdas on twitter!

How flippant.

“Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing hospitals/insurance/medical bankruptcy/whatever...

Just donate to a charity if you can spare the expense and help some people out.

Action > inaction.”

Healthcare and communication aren’t comparable. But my point is that you can criticise institutions for their (contested) faults.

If you place yourself on the mantle of non-federation, then availability and censorship resistance are your cross to bear, frankly.

The notion that I should help them workaround their architectural failure when it’s been widely criticised (and criticism openly dismissed) multiple times is a little wild.

Re: Help users in Iran reconnect to Signal

#134

Post by shervin01 »

Hi, from Iran with love!

First of all, thank you moxie and signal team for this proxy.

Until 2018, many Iranians used telegram but Iran's regime after Russia blocked this messenger. telegram released mtproxy and this proxy was helpful. Russia lifted the ban on telegram but this app is still blocked on my country. but with VPNs, many iranians still use this app. after 2018, second most popular messaging app in iran was whatsapp, until facebook's new privacy policy, like all of you, many iranians switch from whatsapp to signal. mullah's regime removed signal app from the iranian app stores and started blocking all signal traffic in the country, but they don't block whatsapp. I'm not a paranoid but it is difficult to understand for me why they didn't block whatsapp after 2018? can they break whatsapp encryption?

I have a suggestion for signal team: please put tor in the signal, tor is better than any proxys or vpns.

Re: Help users in Iran reconnect to Signal

#135

Post by 2Gkashmiri »

f430 wrote: post #125
2Gkashmiri wrote: post #31

hey. i just thought of something. is it not possible for india or iran in this case to check your phone number and see if it is active on signal? if you are online means you are somehow bypassing their blocks. isnt then just a matter of tracking your cellphone and relevant xkcd applies ? https://xkcd.com/538/ this is looking like a zero sum game unless signal account is delinked from phone numbers because the govt ca…

all they need to do is be in the approximate region of the cell signal through triangulation to figure out the phone numbers / unique identifiers attached to the phone. then its a matter of time before they link real identity to the phone. With the wide availability of femtocells, all they need to do is get lucky once. This puts operators of Signal proxies at potential harms way! Absolutely irresponsible for people o…

oh. you are not joining all the dots here. an offensive govt already has KYC on cellphones. they can pull your details in a second. My reasoning. they have a list of say 100 users. every govt has lists. they check that list against signal users as "social graph" and voila, they know you are online or not. second, kyc documents show who you are so you are good as toast

Re: Help users in Iran reconnect to Signal

#136

Post by sporksmith »

milofeynman wrote: post #27
gruez wrote: post #20

Earlier quoted context omitted.

if they block can block tor what makes you think they can't block these proxies? furthermore if you use tor you can use the existing network of bridges/relays as well as their pluggable transports protocol to avoid DPI/traffic analysis.

Tor has a very similar proxy setup that can be used to get around blocks like this. https://2019.www.torproject.org/docs/bridges.html.en#Pluggab...

Yup. I just tested ~~the fdroid~~ signal (the non-google-play apk from signal's web site) with orbot (a tor VPN for android) and verified it works correctly for text messaging. As you say, using a bridge should make it difficult for iran to block. I wouldn't be surprised though if voice/video was too high latency or doesn't work at all. https://mobile.twitter.com/sporksmith/status/135738175783478...

Re: Help users in Iran reconnect to Signal

#138

Post by circularfoyers »

pmlnr wrote: post #61

There was an article in 2014: "Imagining a Rebel Firefox" ( https://medium.com/@efrensandoval/imagining-a-rebel-firefox-... ) which played with the idea if every firefox node would become tor(ish) gateway. Is there no way to build this in the Signal clients themselves? Eg. on is on a wifi, try to upnp, ask the user if they'd wish to help.

Similar to the Tor Project's Snowflake[1] Firefox addon?

[1] https://addons.mozilla.org/en-US/firefox/addon/torproject-sn...

Re: Help users in Iran reconnect to Signal

#139

Post by 2Gkashmiri »

f430 wrote: post #122
2Gkashmiri wrote: post #24

this is fine and dandy but when you have a state actor operating with such offensive tactics like india is currently engaged in kashmir, there isnt much these "proxies" can do. sorry. the idea of these proxies is all fun and nice but when a government can just whitelist the entire fucking internet and none of these nonsense works https://www.theguardian.com/world/2020/jan/15/internet-parti... https://thewire.in/right…

its weird that all the criticisms of the technique in this article is being downvoted without any rebuttal people underestimate the security intelligence service of countries in this region. They have far more capacity than people in the West estimate. It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and…

yes. back after 5 august, i think i got my first crack at internet in february 2020 with 2G internet and a whitelist of "allowed websites". i found out in my own tests that ssh tunneling over random ports used to work. i had managed to set up a server on amazon aws, and i did a dirty ssh tunnel to that to get access to blocked websites. even that failed after some tries and changing networks.

>It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and access to internet.

yes. shocked pikachu face gets a random HN reader nothing but people can die as a result of this. heck i have records of people who are locked up since last year because of "social media misuse" aka dissent

Re: Help users in Iran reconnect to Signal

#140

Post by twhb »

kolmogorov wrote: post #130
twhb wrote: post #106

Earlier quoted context omitted.

Iran blocks every major foreign messaging app, except WhatsApp. Signal escaped it until now only because they had so few users. Also keep in mind that while WhatsApp claims to use the Signal protocol, they installed a backdoor that allows them to MITM conversations. So yes, I’d say it’s virtually guaranteed that WhatsApp is sending unencrypted message data to Iran, and of course to the US too.

https://signal.org/blog/there-is-no-whatsapp-backdoor/

HN discussion of that post: https://news.ycombinator.com/item?id=13394900

I guess I'm coming down hard on one side of a controversial question, but in my mind, if it allows the server to intercept messages without users knowing about it under the default configuration, it's a backdoor.

Post reply on HN