Amazon threatens to suspend Signal's AWS account over censorship circumvention • Hacker News Board

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#511

Post by smsm42 » Thu, May 03, 2018, 12:53 AM UTC

gspetr wrote: post #423

czardoz wrote: post #273

Earlier quoted context omitted.

AWS and Google are companies. It's not their job to push for societal changes really. In fact, I hope they don't push for those. I'd prefer them to steer clear of pushing for any higher objectives, that's best left to governments and lawmakers.

What do you think Google is doing on Youtube? It already has considerable skin in the game. Even something seemingly innocuous like Google search's front page doodles are chosen and curated.

Also there's recent story of Google removing shopping results containing "gun" which went hilariously wrong (yes, you couldn't search for Burgundy for a while :) : https://news.ycombinator.com/item?id=16474102

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#512

Post by exabrial » Thu, May 03, 2018, 2:26 AM UTC

computerfriend wrote: post #470

exabrial wrote: post #445

Kinda a misleading headline. Amazon is stating the don't want their domain name used as a circumvention measure. I think that's reasonable. Signal is the one hijacking it and Amazon is taking the risk if it gets blocked.

No, the fact that Amazon owns the souq.com domain is irrelevant here.

Can you elaborate? I'm not sure I understand why.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#513

Post by manigandham » Thu, May 03, 2018, 6:13 AM UTC

smsm42 wrote: post #502

manigandham wrote: post #349

Earlier quoted context omitted.

Yes. It's called war. What's confusing here? If a citizen of a nation thinks that another nation is not behaving as they would like (whichever country or whatever behavior that is), the proper channels to enact change are through government action, either diplomatic or militarized. Asking a private corporation to be international police is not good for anyone, as well intentioned as it may seem.

War is an ultimate and extremely costly measure. Just as inter-personal violence should be reserved for extreme cases - if you don't like a mayor in your city, you vote against him, campaign against him, write letters, go to protests - but you do not assassinate him. The same way, inter-national war is a measure of last resort and should not be resorted to due to mere disagreement about cultural norms and such. > Ask…

Yea, that's why I said: "government action, either diplomatic or militarized". Any reasonable person will choose diplomacy first.

Nobody is talking about cultural norms here. The story is about Signal being used to help those in oppressive societies with active censorship, not some differing cultures. And "police" is a form of expression, not literally a police department.

Asking Amazon to do anything political is absurd because it's a corporation that should be focused on its paying customers, none of whom would appreciate unwillingly being affected by Signal intentionally breaking their terms of service. Do they suddenly not matter?

It's morally despicable to just expect and force others to help you in your causes, no matter how noble (you think) it is.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#514

Post by sakarisson » Thu, May 03, 2018, 7:56 AM UTC

tony101 wrote: post #185

unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

> "They're spoofing identity" That's the entire point. By making it impossible for censors to distinguish Signal traffic from other web traffic going to AWS, domain fronting forces the government censors to either 1) stop censoring, or 2) censor many important websites that people rely upon. The associated economic cost has the tendency to discourage censors, and as shown by Signal, is actually quite an effective det…

But isn't Amazon risking that Souq itself might get banned in these countries if they allow this to happen? Or am I understanding it wrong?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#515

Post by StudentStuff » Thu, May 03, 2018, 8:50 AM UTC

idonotknowwhy wrote: post #364

StudentStuff wrote: post #318

Earlier quoted context omitted.

Three companies I don't use, and one that has lost nearly all of my search traffic due to terrible results for really simple queries. It will be interesting to see in what form they persist over the next few decades!

> don't use > nearly So you do use it for search. And two of these companies are probably hosting some of the websites you visit.

I haven't been using Google much as of late, basic queries come back with crap results. Its as though they've screwed up their indexing so bad that large chunks of forums and (fairly static) support docs just aren't showing up or are ranked multiple pages back.

Perhaps some of the sites I visit are hosted on Google, but since I stopped visiting reddit (the awful redesign was the last straw), I see very little traffic hitting AWS or GCP IP ranges. Part of that is probably uBlock Origin doing its thing though!

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#516

Post by [deleted] » Thu, May 03, 2018, 6:26 PM UTC

computerfriend wrote: post #453

cryptonector wrote: post #373

Earlier quoted context omitted.

Amazon was supplying Signal's content as souq.com but with the request making it clear it was for Signal. How might this be noticeable? Like so: - (irrelevant) the SNI and certificate presented by the server don't match the request -- only the hoster can see this, so what might they care? - (serious) metering: if the hoster uses SNI for metering... then Signal would be stealing the fronter's bandwidth - (mild) DNS me…

The metering isn't based o he SNI header, so the second point doesn't apply. And since the frontier's domains are presumably using the CDN's DNS servers anyway, it's not an issue either.

[deleted]

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#517

Post by yungchin » Thu, May 03, 2018, 8:05 PM UTC

apatters wrote: post #436

crazypyro wrote: post #293

Earlier quoted context omitted.

My first thought is "How is it in the interest of Amazon's stockholders to prevent censorship in countries ruled by dictatorial regimes?" and secondly, "How does consenting to being a front for services that are strictly forbidden in certain countries benefit our company?"

Perhaps it's not. AMZN is a for-profit entity. Their shareholders come first. Profit comes first. The more interesting question is, how does this influence our engagement with Amazon, as members of the tech community and the business community? From hackers to founders to dev leads to CEOs we're all individuals with some degree of influence. Most of us hopefully value the idea of a free society to a great degree, bec…

> Perhaps it's not. AMZN is a for-profit entity. Their shareholders come first. Profit comes first.

The good news is that that's a myth, apparently: https://www.nytimes.com/roomfordebate/2015/04/16/what-are-co...

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#518

Post by joombaga » Fri, May 04, 2018, 7:18 PM UTC

icebraining wrote: post #509

joombaga wrote: post #482

Earlier quoted context omitted.

> only a custom app like Signal can perform domain fronting. Or curl, or openssl s_client. I'm still trying to understand domain fronting, and exactly what is being disallowed now. Do all of my CDN requests have to have identical Host headers and TLS server name indicators now? What if they're mismatched? Does the TLS handshake still succeed, and the traffic just doesn't get passed through the CDN server?

Or curl, or openssl s_client Sure. I'm still trying to understand domain fronting, and exactly what is being disallowed now. Do all of my CDN requests have to have identical Host headers and TLS server name indicators now? What if they're mismatched? Does the TLS handshake still succeed, and the traffic just doesn't get passed through the CDN server? Well, the current conflict is with Amazon; your CDN might or might…

> Well, the current conflict is with Amazon; your CDN might or might not object to domain fronting.

Yeah, understood, I meant CloudFront specifically.

> I don't think their infrastructure can actually block it

If I terminate TLS at CloudFront they can certainly compare SNI with the Host header and block on any mismatches. This is silly of course, since there are legit reasons to do this.

You answered my question though. Thanks!

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#519

Post by textmode » Sun, May 06, 2018, 3:15 AM UTC

thefifthsetpin wrote: post #206

textmode wrote: post #175

"Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need." Does this mean that endpoints that require SNI are potentially contributing to censorship? Facts: SNI is optional. Not all websites require it. For example, https://signal.org does not require SNI; cl…

Sure, but the censor can just censor requests that omit SNI.

"According to our communication with the International Computer Science Institute's certificate notary, which observes on the order of 50 million TLS connections daily, 16.5% of TLS connections in June 2014 lacked SNI, which is enough to make it difficult for a censor to block SNI-less TLS outright."

Fifield et al. Proceedings on Privacy Enhancing Technologies 2015(2):1-19 at 2.