4 ms·

Doodles, stickers, and censorship circumvention for Signal Android

115 points by stablemap 10y ago

nickmccann 10y ago
I found this quick read describing domain fronting interesting: http://blog.attackzero.net/2015/11/domain-fronting-and-you.html?m=1 http://blog.attackzero.net/2015/11/domain-fronting-and-you.h...
- deleted 10y ago
  [deleted]
- duskwuff 10y ago
  Surely the real domain name of the service will appear in the server certificate?
  - temprature 10y ago
    The server returns the certificate of the name given in the SNI, which is the fronted domain, not the real one.
    - deleted 10y ago
      [deleted]
- NoGravitas 10y ago
  This article on [domain fronting][0] is very informative, though also quite long. [0]: https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/
subliminalpanda 10y ago
There are other countries in the MENA region that block signal as well due to te VoIP functionality; My native country of Oman comes to mind. Will the anti-censorship tech also work for users in this country? Country code is +968
- cpach 10y ago
  If you mail Whisper Systems on the address at the end of the blog post they might be able to fix that for you.
  - subliminalpanda 10y ago
    Thanks for that! I will.
  - deleted 10y ago
    [deleted]
- temprature 10y ago
  A very recent commit[0] added +968 as well, but that was made after this update was tagged. [0] https://github.com/WhisperSystems/Signal-Android/commit/748852564124f1c97f8f7b1ad79aff4c650fea7a https://github.com/WhisperSystems/Signal-Android/commit/7488...
ontoillogical 10y ago
Do they need google/fastlys cooperation for this, or is it possible to do by running a server in the google cloud, or via some redirect that fastly hosts?
- temprature 10y ago
  No, anyone can set up a server on appspot and do this with Google. The only cooperation needed from the host is apathy. They could take direct action to stop it working (Cloudflare did this a few years back by requiring that SNI matches the host header) or suspend the server running the reflector (Google did this to the meek reflector running on Appspot that Tor Browser used).
colordrops 10y ago
I posted this comment elsewhere but it was buried deep within a thread: I'm not sure what to think about Signal. It's got some great supporters like the EFF, but on Android, it requires about a dozen permissions, most unnecessary. It also requires your phone number to register, and uses a Twilio API at registration. WTF? What are peoples' thoughts on Silent Phone? It's written by the creator of PGP, only requests permissions when it needs them (at least on Android 6 and up), and stores encryption keys locally.
- dublinben 10y ago
  This conversation has been hashed and rehashed multiple times, here and elsewhere. If you're curious about people's thoughts on Signal, just read literally any thread about them. As far as Silent Phone goes, their app isn't open source, so it can't be trusted. That's really as far as the discussion goes.
  - JshWright 10y ago
    That depends on what you mean by 'open source'. It's not released under a permissive license (and the version on GitHub is a little behind), but the source is available. https://github.com/SilentCircle/silent-phone-android https://github.com/SilentCircle/silent-phone-android
    - MayeulC 10y ago
      The only thing I _really_ dislike about Signal is their CLA. If it included "... under a FSF-approved license" or something similar that would enforce a contaminative license instead of an OSI-approved license. That's the only thing that prevented me from contributing so far, I wonder if I am the only one.
- saycheese 10y ago
  Understand how you feel about the issue, but as been pointed out to me on other posts that were about Signal, your basically hijacking the thread to cover a topic that is largely unrelated to the post that's the subject of this thread. --- Per a HN mod: >> sctb comment: "Please stop harping about this, especially in unrelated threads. It distracts from the thoughtful kind of discourse that this site is for. https://news.ycombinator.com/item?id=13046683 https://news.ycombinator.com/item?id=13046683
agnivade 10y ago
Will it be able to circumvent the GFW of China ? Given the fact that they are doing active probing now ?

115 points by stablemap 10y ago

I found this quick read describing domain fronting interesting: http://blog.attackzero.net/2015/11/domain-fronting-and-you.html?m=1 http://blog.attackzero.net/2015/11/domain-fronting-and-you.h...

deleted 10y ago
[deleted]
duskwuff 10y ago
Surely the real domain name of the service will appear in the server certificate?
- temprature 10y ago
  The server returns the certificate of the name given in the SNI, which is the fronted domain, not the real one.
  - deleted 10y ago
    [deleted]
NoGravitas 10y ago
This article on [domain fronting][0] is very informative, though also quite long. [0]: https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/

subliminalpanda 10y ago

There are other countries in the MENA region that block signal as well due to te VoIP functionality; My native country of Oman comes to mind. Will the anti-censorship tech also work for users in this country? Country code is +968

cpach 10y ago
If you mail Whisper Systems on the address at the end of the blog post they might be able to fix that for you.
- subliminalpanda 10y ago
  Thanks for that! I will.
- deleted 10y ago
  [deleted]
temprature 10y ago
A very recent commit[0] added +968 as well, but that was made after this update was tagged. [0] https://github.com/WhisperSystems/Signal-Android/commit/748852564124f1c97f8f7b1ad79aff4c650fea7a https://github.com/WhisperSystems/Signal-Android/commit/7488...

ontoillogical 10y ago

Do they need google/fastlys cooperation for this, or is it possible to do by running a server in the google cloud, or via some redirect that fastly hosts?

temprature 10y ago
No, anyone can set up a server on appspot and do this with Google. The only cooperation needed from the host is apathy. They could take direct action to stop it working (Cloudflare did this a few years back by requiring that SNI matches the host header) or suspend the server running the reflector (Google did this to the meek reflector running on Appspot that Tor Browser used).

colordrops 10y ago

I posted this comment elsewhere but it was buried deep within a thread: I'm not sure what to think about Signal. It's got some great supporters like the EFF, but on Android, it requires about a dozen permissions, most unnecessary. It also requires your phone number to register, and uses a Twilio API at registration. WTF? What are peoples' thoughts on Silent Phone? It's written by the creator of PGP, only requests permissions when it needs them (at least on Android 6 and up), and stores encryption keys locally.

dublinben 10y ago
This conversation has been hashed and rehashed multiple times, here and elsewhere. If you're curious about people's thoughts on Signal, just read literally any thread about them. As far as Silent Phone goes, their app isn't open source, so it can't be trusted. That's really as far as the discussion goes.
- JshWright 10y ago
  That depends on what you mean by 'open source'. It's not released under a permissive license (and the version on GitHub is a little behind), but the source is available. https://github.com/SilentCircle/silent-phone-android https://github.com/SilentCircle/silent-phone-android
  - MayeulC 10y ago
    The only thing I _really_ dislike about Signal is their CLA. If it included "... under a FSF-approved license" or something similar that would enforce a contaminative license instead of an OSI-approved license. That's the only thing that prevented me from contributing so far, I wonder if I am the only one.
saycheese 10y ago
Understand how you feel about the issue, but as been pointed out to me on other posts that were about Signal, your basically hijacking the thread to cover a topic that is largely unrelated to the post that's the subject of this thread. --- Per a HN mod: >> sctb comment: "Please stop harping about this, especially in unrelated threads. It distracts from the thoughtful kind of discourse that this site is for. https://news.ycombinator.com/item?id=13046683 https://news.ycombinator.com/item?id=13046683

agnivade 10y ago

Will it be able to circumvent the GFW of China ? Given the fact that they are doing active probing now ?