8 ms·
[1] answers it clearly: > With today's release, domain fronting is enabled for Signal users who have a phone number with a country code from Egypt or the UAE.
by altendo 10y ago
[1] answers it clearly:
> With today's release, domain fronting is enabled for Signal users who have a phone number with a country code from Egypt or the UAE. When those users send a Signal message, it will look like a normal HTTPS request to www.google.com. To block Signal messages, these countries would also have to block all of google.com. (emphasis added)
It can be blocked, but doing so will block google.com. Basically Open Whisper Systems is making a block that much more costly to implement, since Google is ubiquitous in so many different areas.
EDIT: forgot how to add the emphasis, is fixed now.
- kylehotchkiss 10y agoShould have made it the website of the government :D
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it.
- philfrasty 10y agoWhy isn't all HTTPS traffic being declared this way (hiding the real endpoint)? Is there any downside doing this?
- firloop 10y agoSNI requires the hostname to be sent over the wire as plaintext. The reason why SNI is useful is because it allows one server to host many HTTPS domains. Perhaps some innovation to SNI would fix this problem. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
- endymi0n 10y agoThis. The current advent of the encrypted web would not have been possible without SNI - the costs for exclusive IPv4 addresses (especially when using a CDN) would have been prohibitive. SNI isn't as much as a security risk if you consider that before resolving, you usually need a DNS request too - which would expose the endpoint to your ISP anyway.
- tedunangst 10y agoThe server doesn't know which certificate to present to the user unless the user provides some hint as to which endpoint is desired.
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. I couldn't hide my website behind facebook, because my website and facebook are not behind the same TLS terminator.
- eugeniub 10y agoHow did they manage to accomplish this? Did they need cooperation from Google to do this, and to what extent?
- subliminalpanda 10y agoThey're hosting a proxy on appspot.
- closeparen 10y agoCan you really not draw a distinction between appspot and google.com? They run googleusercontent.com to maintain that separation for Google Cache, after all.
- subliminalpanda 10y agoNot unless you MITM the connection, otherwise it wouldn't be an effective measure. There's a pretty good write up I found here: https://trac.torproject.org/projects/tor/wiki/doc/meek https://trac.torproject.org/projects/tor/wiki/doc/meek commit for the ios version is here: https://github.com/WhisperSystems/SignalServiceKit/commit/78515377b14f1055c4a87548a7899650b753ce52 https://github.com/WhisperSystems/SignalServiceKit/commit/78...
- smartbit 10y agoThanks for the links, informative. So the proxy app that the Egypt government would like to take down is signal-reflector-meek.appspot.com
- kijiki 10y agoNo, per the linked check-in, the Egyptian govt would have to block OWSCensorshipConfigurationFrontingHost, which is "https://google.com" https://google.com". That is the domain looked up in DNS and included in the TLS Certificate's SNI field. These are the only domains that are sent plain-text. "signal-reflector-meek.appspot.com" domain only shows up in the HTTP "Host" header, which is TLS encrypted, and thus not visible to the censors.
- PakG1 10y agoIt can be blocked, but doing so will block google.com. Basically Open Whisper Systems is making a block that much more costly to implement, since Google is ubiquitous in so many different areas. If they can ramp up their homegrown options or a regional competitor to Google develops that can really compete well, why wouldn't they block all of Google.com? In China, it's already happening. It's completely possible because a lot of the population doesn't require access to English content, and so doesn't require an English search engine. Local search engines like Baidu and foreign search engines willing to comply with their local laws like Bing will be totally fine. And given that the Middle East has a lot of locals who don't actually speak English, I see that as a distinct possibility in the future. The comparison is almost perfect, no?
- r3bl 10y agoYou're missing the point. Domain fronting is intended to mask the Signal traffic into something that's not. Sure, they can block Google. Signal can do the same process with YouTube, or GMail, or whatever, and they can play a cat and mouse game like that until Egyptian people get really pissed off.
- PakG1 10y agoThis comment explains better than I can as to why that doesn't matter. https://news.ycombinator.com/item?id=13268819 https://news.ycombinator.com/item?id=13268819 Essentially, if a local regional player (or a foreign player who complies with their laws) can compete to take the place of whatever domain they block, why can't they block any or all domains used for domain fronting? The cat and mouse game becomes irrelevant if local companies become relevant.
- pcmaffey 10y agoSeems like even more effective than fronting as google.com would be essentially to front as a random domain, perhaps selected from the top 1k domains popular in that country... To boot: Systematically defeating the ability for a country or ISP to block traffic to a specific domain would be a universal win for free speech.
- Buge 10y agoThis only works because the same company is hosting the content (appspot) as the fronting domain (google.com). Google terminates the TLS then looks at the host header to see where to send it. It can't be hidden behind a random domain.