What if political dissidents don't want to give their phone numbers to the former head of Twitter security on the eve of President Biden's re-engagement with the Islamic theocracy of Iran?
Help users in Iran reconnect to Signal
171–180 of 417 posts
Re: Help users in Iran reconnect to Signal
#172Doesn't this chip away at the benefits of Signal not being federated? Say the proxies need to be updated?
Not really. There's not much Signal-protocol-specific technology involved on the proxy, other than dropping traffic that doesn't go towards the Signal server itself.
Fair enough.
Re: Help users in Iran reconnect to Signal
#173What happens when Iran's government itself runs a bunch of these proxies?
Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.
You'd be building and running these outside of Iran for them to work, which would limit the Iranian government's ability to perform the attack you describe.
Re: Help users in Iran reconnect to Signal
#174How would you let users know about this proxy without letting their government know about it? Instead of platforms like twitter, how about randomly giving out random proxies in some header that the app could query on cloudflare or google or akamai? Does Signal already make use of any CDN's for out-of-band signalling and fail-over? If the Signal proxy could expose an obfuscated load metric, then the CDN could pick ano…
Yup, I would run one but I don't know any Iranians...
Re: Help users in Iran reconnect to Signal
#175Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave u…
That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way
And this new way, while less convenient, is arguably superior due to its decentralisation. They’re not just going after one service they’re now going after people all around the world running these proxies.
Just set one up myself took 15 minutes and that includes setting up a fresh VPS.
Just thinking what the best way to share it is.
Re: Help users in Iran reconnect to Signal
#176i hope this doesn't work.
Re: Help users in Iran reconnect to Signal
#177I created an HAProxy configuration that should be equivalent to the nginx configuration within the Signal-TLS-Proxy repository: https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7... I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.
Their proxy seems to just be nginx, I'm surprised they didn't just share nginx or apache configurations. Most people with a box suitable for running this are probably already running a web server, so there's no reason they should be proxying from their existing web server to this dockerized server which just proxies to Signal. Looking into their repo, they also appear to be building an nginx image from docker.io/ubun…
The Nginx configs use modules that are not compiled by default, so most preexisting Nginx binaries in mainstream distros won't work.
Re: Help users in Iran reconnect to Signal
#178I'd be happy to run this, but I don't really feel like spreading this (for everyone I know) useless info into my social network (which would be via email for me?)
I would gladly sent a link to Signal for my proxy though so they can forward it to people that need it? Hmm, I'm beginning to see the problem now..
Re: Help users in Iran reconnect to Signal
#179Earlier quoted context omitted.
People working for the Iranian state generally would be discernible from their Twitter account, and by controlling the information you hand out you can also flag the hidden accounts that aren't easily recognized. You also overestimate how committed Iran is to stopping this. Doing this in public risks the state finding out, but outside of times of crisis the state is usually pretty slow to respond. Keeping it private…
There are about 700,000 people of Iranian descent in the Los Angeles area alone (the largest such community in the US). Most of them are in the US to escape the regime, and most of friends and family in Iran who they keep in touch with. The people in Iran also have their own networks. So a down-low friends and family approach could reach a lot of people.
If you just filter the amount of those 700,000 down to how many are aware Signal exists, I bet we'd already be at a low enough number to see the problem with your plan.
Re: Help users in Iran reconnect to Signal
#180Earlier quoted context omitted.
As if it was that simple; no it's not as simple as decentralization > centralisation. You might not agree with everything (I don't) but this video provides some good points https://www.youtube.com/watch?v=Nj3YFprqAr8 I trust Signal to try their hardest to solve communication, spitting on them is not the solution.
I didn't watch the video but his article with the same title is almost entirely bad points.[1] Email is end to end encrypted for people who make it a priority. It would be end to end encrypted for everyone if Google or Microsoft made it a priority. The difference between XMPP and Signal is funding. Signal supports video on all platforms because Open Whisper Systems hired people to work on it. XMPP didn't because the…
Signal's been "moving away from using phone numbers" for almost as long as it's been developed. They've burned tens of millions of dollars and have nothing to show for it on that front.
Also they insist of making piece of shit bloatware clients and actively kill every attempt for someone to fix it. Because Moxie is always right apparently.
I really hope the situation is just due to incompetence and hubris.