9 ms·
Egypt blocks the encrypted messaging app Signal as it continues cyber crackdown
- pg_is_a_butt 10y agotrump will bomb egypt so you crying pussies don't have to. keep crying. you're all idiots.
- pwnna 10y agoThe article seems to be scarce on details... I'm not sure if this is about the blocked access after signal deployed its "domain fronting"[1] mitigation technique (Dec 21) as the original reported cited by the article[2, 3] is from before the mitigation technique is deployed (Dec 17). Are there more details about if domain fronting can be blocked as well? [1]: https://whispersystems.org/blog/doodles-stickers-censorship/ https://whispersystems.org/blog/doodles-stickers-censorship/ [2]: https://twitter.com/ircpresident/status/810148053952892928 https://twitter.com/ircpresident/status/810148053952892928 [3]: https://twitter.com/NoraYounis/status/810268132187242497 https://twitter.com/NoraYounis/status/810268132187242497
- altendo 10y ago[1] answers it clearly: > With today's release, domain fronting is enabled for Signal users who have a phone number with a country code from Egypt or the UAE. When those users send a Signal message, it will look like a normal HTTPS request to www.google.com. To block Signal messages, these countries would also have to block all of google.com. (emphasis added) It can be blocked, but doing so will block google.com. Basically Open Whisper Systems is making a block that much more costly to implement, since Google is ubiquitous in so many different areas. EDIT: forgot how to add the emphasis, is fixed now.
- kylehotchkiss 10y agoShould have made it the website of the government :D
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it.
- philfrasty 10y agoWhy isn't all HTTPS traffic being declared this way (hiding the real endpoint)? Is there any downside doing this?
- firloop 10y agoSNI requires the hostname to be sent over the wire as plaintext. The reason why SNI is useful is because it allows one server to host many HTTPS domains. Perhaps some innovation to SNI would fix this problem. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- endymi0n 10y agoThis. The current advent of the encrypted web would not have been possible without SNI - the costs for exclusive IPv4 addresses (especially when using a CDN) would have been prohibitive. SNI isn't as much as a security risk if you consider that before resolving, you usually need a DNS request too - which would expose the endpoint to your ISP anyway.
- tedunangst 10y agoThe server doesn't know which certificate to present to the user unless the user provides some hint as to which endpoint is desired.
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. I couldn't hide my website behind facebook, because my website and facebook are not behind the same TLS terminator.
- eugeniub 10y agoHow did they manage to accomplish this? Did they need cooperation from Google to do this, and to what extent?
- subliminalpanda 10y agoThey're hosting a proxy on appspot.
- closeparen 10y agoCan you really not draw a distinction between appspot and google.com? They run googleusercontent.com to maintain that separation for Google Cache, after all.
- subliminalpanda 10y agoNot unless you MITM the connection, otherwise it wouldn't be an effective measure. There's a pretty good write up I found here: https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek commit for the ios version is here: https://github.com/WhisperSystems/SignalServiceKit/commit/78515377b14f1055c4a87548a7899650b753ce52 https://github.com/WhisperSystems/SignalServiceKit/commit/78...
- smartbit 10y agoThanks for the links, informative. So the proxy app that the Egypt government would like to take down is signal-reflector-meek.appspot.com
- kijiki 10y agoNo, per the linked check-in, the Egyptian govt would have to block OWSCensorshipConfigurationFrontingHost, which is "https://google.com" https://google.com". That is the domain looked up in DNS and included in the TLS Certificate's SNI field. These are the only domains that are sent plain-text. "signal-reflector-meek.appspot.com" domain only shows up in the HTTP "Host" header, which is TLS encrypted, and thus not visible to the censors.
- PakG1 10y agoIt can be blocked, but doing so will block google.com. Basically Open Whisper Systems is making a block that much more costly to implement, since Google is ubiquitous in so many different areas. If they can ramp up their homegrown options or a regional competitor to Google develops that can really compete well, why wouldn't they block all of Google.com? In China, it's already happening. It's completely possible because a lot of the population doesn't require access to English content, and so doesn't require an English search engine. Local search engines like Baidu and foreign search engines willing to comply with their local laws like Bing will be totally fine. And given that the Middle East has a lot of locals who don't actually speak English, I see that as a distinct possibility in the future. The comparison is almost perfect, no?
- r3bl 10y agoYou're missing the point. Domain fronting is intended to mask the Signal traffic into something that's not. Sure, they can block Google. Signal can do the same process with YouTube, or GMail, or whatever, and they can play a cat and mouse game like that until Egyptian people get really pissed off.
- PakG1 10y agoThis comment explains better than I can as to why that doesn't matter. https://news.ycombinator.com/item?id=13268819 https://news.ycombinator.com/item?id=13268819 Essentially, if a local regional player (or a foreign player who complies with their laws) can compete to take the place of whatever domain they block, why can't they block any or all domains used for domain fronting? The cat and mouse game becomes irrelevant if local companies become relevant.
- pcmaffey 10y agoSeems like even more effective than fronting as google.com would be essentially to front as a random domain, perhaps selected from the top 1k domains popular in that country... To boot: Systematically defeating the ability for a country or ISP to block traffic to a specific domain would be a universal win for free speech.
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. It can't be hidden behind a random domain.
- hartem_ 10y agoHere is the paper that describes how domain fronting works in great detail http://www.icir.org/vern/papers/meek-PETS-2015.pdf http://www.icir.org/vern/papers/meek-PETS-2015.pdf
- dimino 10y agoI mistakenly thought Signal was an app on your phone that encrypted/decrypted text messages. What part of that has to be online, other than getting updated public keys, or is that the part that was blocked?
- detaro 10y agoSignal does not include the text message encryption feature anymore. It's an internet-based messenger.
- avhon1 10y agoSignal is really an XMPP client with a custom protocol extension. All of its encrypted messaging functionality relies on being able to communicate with the official Signal server(s). The Android version can, or at least used to, send and receive text messages, but these were unencrypted. I believe that it was just to make Signal useful as an all-in-one short messaging app.
- distances 10y agoThere was also an encrypted SMS/MMS feature, but that was removed in 2015: https://whispersystems.org/blog/goodbye-encrypted-sms https://whispersystems.org/blog/goodbye-encrypted-sms
- moosingin3space 10y agoSignal does not use XMPP, it uses its own Internet-based protocol.
- h4waii 10y agoThe Android client does support regular SMS handling, which is what makes it great. Regular unencrypted SMS for users without Signal, and end-to-end for users who have it, all in the same application. It used to support encryption over SMS, unfortunately it was removed and is now the primary focus of Silence[0], while Noise[1] is now for Signal without the requirement of GCM for signaling. 0. https://silence.im https://silence.im 1. https://copperhead.co/android/docs/usage_guide https://copperhead.co/android/docs/usage_guide
- myf01d 10y agoI'm from Egypt, I think it's more an economic than political initiative, telecom companies are among the last standing pillars of the economy and they are losing money more than ever as more and more people using chat software than talking using mobile phones or even using their shitty 3g internet connection which is still applied so far. Any connection on https is impossible to decrypt here anyway as our government isn't that competent.
- SonicSoul 10y agoso how does not being able to decrypt traffic make them lose money?
- myf01d 10y agoTelecom companies which employed tens of thousands mostly young educated because of the massive growth since early 2000s, have been facing now slowdown if not shrinking because most people here are now communicating for free using whatsapp and viber. These companies were doing also nasty things like injecting advertisement codes inside plain html pages to earn money, as most people here are browsing only facebook and twitter which use https, it became harder for them to compensate their losses on their main service (phone calls). They were colluding with the government to ban some chat apps on 3g communication and postpone new technologies like 4g and faster adsl connections in order to make people obliged to return to phone calls. The government knows very well that these companies are too big to fail as they are maybe the biggest employer in the country.
- xarball 10y agoSo their answer is corruption/fascism?
- myf01d 10y ago> corruption/fascism that's what we call national security/stability here in the middle east :D. Seriously though, the government and the three telecom companies Orange/Vodafone/Etisalat falsely think that this is a win win situation to save the telecom industry and national security, however when it reall comes to terrorism, you can organize a terror attack using facebook chat without anyone knowing anything about you, maybe even after the attack if you are paranoid enough and take all social engineering precautions.
- stratigos 10y agosignal ftw!
- fgandiya 10y agoIs it still blocked even after that change Signal made to the app a few days ago?
- contravariant 10y agoAccording to the comments below the article it seems it was blocked for a week but is currently working.
- deleted 10y ago[deleted]
- ge96 10y agoCurious how you "block" an app. If you're saying blocking though an app store. But what about sending the files through other means, zip in an email, Dropbox, whatever. If the app connects online me somehow Egypt "knows"? Asking because I don't know
- makecheck 10y agoWe need to reach the point where there’s no easy way to simply “block” things you don’t like. Quite the opposite, it should be absurdly expensive to even try to do that, with numerous technical and geographic hurdles to overcome. A truly secure protocol should have no easy way to identify its traffic (e.g. no obvious domain-name patterns that can be disallowed with a single regex, no common IP address blocks, and no suspicious volume of traffic that couldn’t just as easily come from 100 other things on the Internet). The backbone itself should also have more than one off-switch; difficult in practice for some remote areas but theoretically doable in combination with satellite radios, etc.