Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Help users in Iran reconnect to Signal

signal.org

Post reply on HN
Print view View original

281–290 of 417 posts

Re: Help users in Iran reconnect to Signal

#281

Post by tgragnato »

baxtr wrote: post #240
shervin01 wrote: post #134

Hi, from Iran with love! First of all, thank you moxie and signal team for this proxy. Until 2018, many Iranians used telegram but Iran's regime after Russia blocked this messenger. telegram released mtproxy and this proxy was helpful. Russia lifted the ban on telegram but this app is still blocked on my country. but with VPNs, many iranians still use this app. after 2018, second most popular messaging app in iran wa…

Thx Sherwin! Just out of curiosity: is iMessage working ok in Iran?

I’m not Iranian, but I spent a lot of time over this for a friend. iMessage works ok once you are able to activate it. But Apple insists on contacting “init-p01md.apple.com” with plaintext HTTP, this sometimes connects successfully, but often it doesn't.

Re: Help users in Iran reconnect to Signal

#282

Post by olah_1 »

jb775 wrote: post #251

Ironic how people want to help de-censor what's considered to be an enemy nation (by the media), but are ok with censoring half their next-door neighbors based on politics.

They’re already discussing what to do when “fascists” (read: Christian rednecks) start posting signal group links.

> One employee pointed out that fascists are often quite public about their activities, as the recent insurrection in broad daylight at the Capitol showed

https://www.theverge.com/22249391/signal-app-abuse-messaging...

Re: Help users in Iran reconnect to Signal

#283

Post by damnyou »

praseodym wrote: post #235
aftbit wrote: post #220

Earlier quoted context omitted.

Gross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well. We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.

Probably malware using domain fronting techniques for C2 traffic played a role in that decision. E.g. https://threatpost.com/apt29-used-domain-fronting-tor-to-exe...

In general there are many things that are beneficial when used by good actors and harmful when used by bad actors. That's just the nature of power.

I'm really bothered by blanket policies that prevent beneficial uses of a tool because it can also be used to cause harm. Google and Amazon need to figure out how to disambiguate the two.

Re: Help users in Iran reconnect to Signal

#284

Post by 2cb »

hutzlibu wrote: post #248
2cb wrote: post #190

Earlier quoted context omitted.

They could literally have a hidden function in WhatsApp that scoops up all your chat history and sends it to Facebook if the government ask them to. It’s closed source. No one has a clue what it’s doing. To be clear I’m not suggesting this is absolutely happening. I’m merely pointing out it’s entirely possible from a technological perspective given it’s closed source software owned by Facebook. That’s not a recipe fo…

Reverse engeneering is a thing, though. I would think, there is fame to be gained to show such a behavior from whatsapp, so some hackers could feel motivated to do this from time to time.

Absolutely. Of course hackers are reverse engineering WhatsApp, that's how all those nasty exploits it has keep getting sold to governments by the NSO Group.

But reverse engineering is a skill in itself and modern day smartphone OS's use a lot of code obfuscation when apps are compiled. This effectively means even those talented hackers are going through the reverse engineering process pulling at threads until they get lucky.

Reverse engineering (in this context, at least) doesn't just show you the code as the developer wrote it. And FB hires a lot of very clever people including cybersecurity experts who could sneak these things in using innocent looking code scrambled around the app. Even open source projects are at risk of having backdoors put in that pass review and simply look like innocent bugs if they get discovered, let alone closed source apps that have to be reverse engineered.

Again not going conspiracy nut and saying that's what FB is doing. Just saying it'd be very easy for FB to hide it if they were doing it.

To me the biggest confirmed weakness of WhatsApp is the cloud backups. E2EE is pointless when the message database is synced up to iCloud or Google Drive. WhatsApp even tells you this itself. When you enable cloud backups (and they keep bugging you until you do it) it literally tells you the backups aren't secured by E2EE. [1] Because, well, of course they aren't.

[1] https://faq.whatsapp.com/iphone/chats/how-to-back-up-to-iclo...

"Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in iCloud."

Re: Help users in Iran reconnect to Signal

#286

Post by hanniabu »

capableweb wrote: post #230
rzz3 wrote: post #195

Earlier quoted context omitted.

What about Cloudflare?

Answer from Cloudflare team seems to be "No" - https://community.cloudflare.com/t/could-cloudflare-support-...

Surprised by that considering their willingness to work with ethereum on resolving .eth domains through .eth.link domains.

Re: Help users in Iran reconnect to Signal

#287

Post by ryanlol »

2cb wrote: post #190
k3j45hkj34hkj wrote: post #157

Earlier quoted context omitted.

I think you mean the phone vendors, as they are the ones holding the unencrypted chat history in the users cloud storage. Facebook themselves do not have access to the chat logs (unless they are compelled to inject keys).

They could literally have a hidden function in WhatsApp that scoops up all your chat history and sends it to Facebook if the government ask them to. It’s closed source. No one has a clue what it’s doing. To be clear I’m not suggesting this is absolutely happening. I’m merely pointing out it’s entirely possible from a technological perspective given it’s closed source software owned by Facebook. That’s not a recipe fo…

> It’s closed source. No one has a clue what it’s doing

This is just bullshit. If you have access to the binaries you can find out what the software does.

Re: Help users in Iran reconnect to Signal

#288

Post by powersnail »

aftbit wrote: post #220
windthrown wrote: post #150

Earlier quoted context omitted.

Correct, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/

Gross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well. We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.

I don't know.

In the grand scheme of things, I don't like how much infrastructure technology giants control.

In this specific case, however, domain fronting is basically saying "if you want to ban me, you have to ban all of us", without asking if the rest of "us" consent to be put on the same boat.

It would be cool if they are, but it's perfectly understandable for them to disagree.

Re: Help users in Iran reconnect to Signal

#289

Post by hanniabu »

2cb wrote: post #271
josephg wrote: post #246

Earlier quoted context omitted.

To be clear about the threat vector, there's also nothing stopping signal from doing the same if they wanted to. Its impossible to tell if the version of signal you download from the app store is unmodified from the code you can find on github. I trust signal more than I trust facebook, but if you use signal, even though its opensource you still have to trust them not to put anything funky in the binary they upload t…

This is very true. Reproducible builds for mobile apps would be far superior. You can build Signal from source for Android if you wish, although obviously this is a massive pain to do for each update, there’s absolutely nothing stopping you from doing it. On iOS it's a lot more difficult to get the required certificates from Apple but you can run your own build in Xcode and deploy it to your personal device if you ar…

Are there any instructions to build the app yourself for signal?

Re: Help users in Iran reconnect to Signal

#290

Post by contravariant »

windthrown wrote: post #150
sigmar wrote: post #119

Earlier quoted context omitted.

That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way

Correct, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/

There has to be a cleverer way to solve the problem of having several domain names on the same IP than just sending the desired domain name in plaintext.
Post reply on HN