28 ms·
Amazon threatens to suspend Signal's AWS account over censorship circumvention
- mtgx 8y agoGoogle did the same to Telegram: https://www.theverge.com/2018/4/18/17253784/google-domain-fronting-discontinued-signal-tor-vpn https://www.theverge.com/2018/4/18/17253784/google-domain-fr... Tech companies being "on users side" (if they ever were) is now officially over. Hopefully they don't expect users to be on their side when the regulations are coming.
- tuttle 8y agoWill Moxie finally acknowledge that the right tool for censorship circumvention is Tor?
- johnwheeler 8y agoYou want to use the resources and influence of a large corporation to acheive your organizations goals. They don’t have to be on board with your mission, and it’s arrogant to think so IMO. Why should they let you do it, when they won’t allow it for others? Seems like you feel entitled because you think by default people should support what you’re trying to do. The flipside of free speech you’re ignoring is that people get to abstain from using their voice in addition to using it.
- icebraining 8y agoWhat part of the post shows they feel entitled to it?
- johnwheeler 8y agoThe fact that they posted the e-mail from Amazon, so readers could direct the blame at them. You can’t read that blog post and say it’s the most unbiased and objective way they could have presented this, especially if they want to remain on good terms with Amazon, who has done nothing wrong at all.
- insensible 8y agoI thought it was 100% objective, straight across. I don't see any barbs or negativity toward Amazon whatsoever, just the facts about that situation and an honest discussion of the facts looking forward.
- s73v3r_ 8y agoI feel the phrasing of the title (the word "threatens", using the phrase "censorship circumvention", not mentioning that they're doing all that stuff without Amazon's consent) is definitely aimed at generating negative feeling toward Amazon.
- deleted 8y ago[deleted]
- icebraining 8y agoOne can have an opinion and disagree with Amazon without feeling entitled to anything from them. I'm not objective; it's my subjective opinion that you're wrong. That doesn't mean I feel entitled to have you change your mind.
- johnwheeler 8y ago"One can have an opinion and disagree with Amazon without feeling entitled to anything from them." That's a straw man. In this case, they don't only disagree, they also feel entitled; that's what I'm saying.
- icebraining 8y agoI understand; but you're saying you can tell they feel entitled by the fact that they're not objective or unbiased. And what I'm saying is that not being objective doesn't show they feel entitled. Maybe they feel entitled, but I don't think there's anything in the blog post showing that. All I see is (fairly mild) disagreement with Amazon's actions.
- 8y ago
- Promarged 8y agoIt seems centralized solutions (Telegram, Signal) are under fire recently. I wonder what would happen if federated protocols (Matrix, XMPP, etc.) were more popular and, thus, also in spotlight.
- mmahmad 8y agoThey say it doesn't solve the problem - "Would adding federation to Signal help with users behind country-wide blocks? Seems like a distributed service would be harder to censor than a centralized one." - "It's trivial to block several distributed hosts simultaneously. An aspiring censor would simply find the most common federated endpoints for a given service and block all of them. Only the users of that software would be affected. There wouldn't be any collateral damage. If the censors somehow didn't hit every single worthwhile federated endpoint, users would still be left wondering why they couldn't communicate with most of their friends. Moving between federated hosts would also necessitate an entirely new identifier, so users would need to rebuild their social graph again. In addition to being ineffective against censorship, there are several other properties and trade-offs that make federation a difficult proposition for an application like Signal: https://signal.org/blog/the-ecosystem-is-moving/" https://signal.org/blog/the-ecosystem-is-moving/" src: https://news.ycombinator.com/item?id=16868564 https://news.ycombinator.com/item?id=16868564
- Boulth 8y agoI think it may depend on how well distributed would a service be: having several big servers would not help but if every family and company had their own mini server, located in a non-censoring country then the censors would be unable to do anything easily. These servers, in turn, would be able to easily connect to the broader network. Of course that wouldn't be as easy to setup as a simple installation of the Signal app.
- jlund 8y agoAn aspiring censor could also "easily connect to the broader network" and masquerade as a federated server in order to discover others. This process could even be automated. Federated services also require an identifier, and this identifier usually indicates where the user's account is located and how to connect with them (e.g. user@domain.com). As people share these identifiers, the aspiring censor can just keep adding new entries to the blacklist.
- geff82 8y agoYou should be using your own servers. Guess the lesson is learned now?
- snissn 8y agoI think the idea is to blend in with Amazon traffic
- pyre 8y agoHow do you propose that they implement domain-fronting to circumvent censorship from their own servers?
- notyourday 8y agoBoatload of VMs with constantly migrating IP addresses.
- stordoff 8y agoWhich then has the problem of how do users find them (if by DNS, you can block the DNS record).
- reitanqild 8y agoSeems it is enough to be a little creative with side channels.
- notyourday 8y agoService discovery is an actual interesting problem to solve when you don't outsource it to k8s, huh?
- QuinnyPig 8y agoIn this specific case, or in general? The former has merit, the latter isn't realistically tenable in 2018 for many shops.
- jedberg 8y ago
- Talyen42 8y agoMisleading headline? > Signal plans to make its traffic look like traffic from another site, (popularly known as “domain fronting”) by using a domain owned by Amazon -- Souq.com
- FranOntanaya 8y agoI reckon with Amazon IPs being thrown indiscriminately in the bucket with Telegram they aren't keen to seeing a repeat of the same situation.
- pyre 8y agoThe part you're missing is: ... to third parties. They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties creating the SSL connection are not lying to each other, though.
- dsl 8y agoBut they are. With SNI you are literally lying to the Amazon load balancer, which is one of the two parties of your encrypted communications.
- apendleton 8y agoAre you? It looks like the Amazon load balancers don't actually care what your SNI domain is when routing traffic. They terminate your TLS connection, and then use the domain in your actual HTTP request to route it, which is not Amazon's domain. Amazon's ability to allow these two domains to differ, and to mostly ignore the former, is the crux of this whole trick.
- bitCromwell 8y agostill lying though and it seems like that’s a foundational problem. it’s reasonable for a machine to refuse connections from a machine that has lied.
- andrewaylett 8y agoSurely better to get an at-least-vaguely-friendly warning pre-implementation rather than a post-implementation block? I would much prefer censorship circumvention to be possible, but I have some sympathy for platform providers not wanting their customers and their platform to be conflated so easily.
- Tinyyy 8y agoSo they're basically asking for forgiveness instead of permission, fronting other sites until they are told to stop?
- foobarbazetc 8y agoYou can’t really stop someone from domain fronting on any CDN. This is like “maybe you should have not talked about this on HN”. :)
- dsl 8y agoFixing domain fronting is easy. You just match the certificate SANs (or SNI requested domain) to the request Host header. The only problem is it breaks a subset of users who are domain fronting by accident (Think a mobile app that connects to www.app.com but sends api.app.com).
- Boulth 8y agoThis also breaks non terminating load balancers.
- foobarbazetc 8y agoI’ve used every major CDN on the market and none of them do this. Some don’t even check that the Host header host is a customer and just proxy it anyway.
- dsl 8y agoI said the fix was easy, not that people were actually fixing it. :/
- tzakrajs 8y agoExactly, bragging about this hack made them do something about it.
- 8y ago
- QuinnyPig 8y agoSorry, I'm not on board with using an Amazon owned domain for this. That's got the potential to get Amazon itself blacklisted in some places, so they're absolutely not going to be okay with it.
- smileysteve 8y agoOr it forces oppressive regimes to realize that they are being an oppressive regime. Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.
- criley2 8y agoAmazon isn't in the business of forcing oppressive regimes to realize they are oppressive regimes, they are in the business of selling goods and services regardless of the oppressiveness of the regime governing the region where the currency comes from. If you want Amazon to stop doing business with oppressive regimes, contact your politicians about sanctions.
- deleted 8y ago[deleted]
- icebraining 8y agoThe problem is deeper than that; even if Amazon doesn't sell stuff to oppressive regimes, they host the sites/services of companies who do. And if the solution was to force Amazon to block any access from their servers to those oppressive regimes, that wouldn't help Signal at all, because they too would be blocked.
- smileysteve 8y agoYou're not wrong, it would certainly not be in shareholder's financial interest for amazon to take this stance. For the record, U.S. politicians have voted on sanctions on Russia for cyber crimes and brought representatives to the UN raising the issue of their human rights records.
- dijit 8y agoOnce all speech has moved to privately owned platforms, having the right to free speech will be effectively useless.
- praneshp 8y agoYou have the right to read the linked article, why don't you exercise it?
- pera 8y agoI still don't understand why would Google or Amazon care about this, and why it's against their ToS. Do they think that some of those states may block all kind of access to their IP blocks just because of some people using Signal?
- DangerousPie 8y ago> Do they think that some of those states may block all kind of access to their IP blocks just because of some people using Signal? I think this is exactly the problem, yes.
- manigandham 8y agoThat's exactly what happened, so yes. https://arstechnica.com/information-technology/2018/04/in-effort-to-shut-down-telegram-russia-blocks-amazon-google-network-addresses/ https://arstechnica.com/information-technology/2018/04/in-ef...
- middleclick 8y agoCollateral damage...
- zoltaan 8y agoI can imagine why someone cares if someone else pretend being that someone....
- icebraining 8y agoNo, the trick works the other way around; they pretend they want to talk to someone, but then talk to someone else. They never pretend to be someone else.
- jakebasile 8y agoWhat was it that convinced Google and Amazon to no longer allow this particular censorship evasion?
- goatsi 8y agoRussia made it clear that they would block AWS and Google Cloud if domain fronting was allowed to continue. https://arstechnica.com/information-technology/2018/04/in-effort-to-shut-down-telegram-russia-blocks-amazon-google-network-addresses/ https://arstechnica.com/information-technology/2018/04/in-ef... As moxie says in the blog post >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan.
- deleted 8y ago[deleted]
- jakebasile 8y agoAh, that's right. I forgot about that development.
- insensible 8y agoI have looked into the Russia/Telegram war thoroughly due to personal interest, and to my knowledge that situation hasn't involved domain fronting. Rather, Russia is blocking by IP and Telegram is hopping to IPs all over the cloud. Russia is on record as wishing to go a different path than the Great Firewall of China. From statements I read including Putin, they're saying they want to avoid a deep packet inspection regime à la NSA or China except when they've got a court order to go after someone in particular.
- sterlind 8y agoRussia's butting heads with Telegram under a law that requires all service providers to yield their public keys to FSB. Telegram isn't being banned over access to a particular someone's messages, it's over handing them everything. Considering that Russia has banned all of Wikipedia in the past, among numerous others, it's a little naive to take Putin at his word here.
- unethical_ban 8y agoThey're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan. That they interpret AWS and Google as "the rest of the Internet" is pretty sad, too.
- colechristensen 8y agoIt is not that much of an interpretation. When us-east has problems a huge proportion of Internet sites that people actually use goes down.
- kempbellt 8y agoI agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.
- gue5t 8y agoHardly reasonable. Domains are (in reality, if not in legislative fantasy) property of ICANN and merely rented by everyone else.
- CoryG89 8y agoSo? If we qualify it to preventing unauthorized use of one of their rented domains does that make it any less reasonable?
- caf 8y agoThe conceit here is that you must be "authorized" in order to write an app that puts the domain in question into the SNI field of a TLS connection that it initiates. I don't think that's reasonable. It is of course up to Amazon what their servers then do when presented with such a connection, in particular whether they ensure the Host: header later presented matches the SNI data.
- goatsi 8y agoThe HN post that alerted Amazon: https://news.ycombinator.com/item?id=16868564 https://news.ycombinator.com/item?id=16868564
- jessaustin 8y agoThanks, HN!
- manigandham 8y agoThis is nothing to do with censorship. AWS has many clients and does not want its network to be blocked because of a single customer. Tough for Signal but that's how it is when dealing with businesses (especially one that so many others rely on). The same thing just happened with Telegram in Russia which explains the preemptive messages: https://arstechnica.com/information-technology/2018/04/in-effort-to-shut-down-telegram-russia-blocks-amazon-google-network-addresses/ https://arstechnica.com/information-technology/2018/04/in-ef...
- maxerickson 8y agoCapitulating to foreign censors for business reasons has something to do with censorship.
- s73v3r_ 8y agoNo, it doesn't. This is Amazon saying they don't wish to be a part of this dispute, which is entirely their right. It is not Signal's right to drag Amazon into the dispute against their will.
- maxerickson 8y agoAmazon stepping away is literally the result of censorship working. It's entirely their right of course.
- eganist 8y ago> they don't wish to be a part of this dispute, Right, because of the risk of being blocked. It is their right, but to say it's not motivated by a risk of censorship is pretty disingenuous. (I have no horse in this race. I'm merely contextualizing the debate)
- manigandham 8y agoThey're not capitulating to anything... they're asking one of their customers to not break the terms of their service. Same scenario if someone was running crypto mining or bittorrent on the cloud. It's not a single company here, thousands of businesses rely on AWS and don't want their service disrupted because of Signal.
- ClassAndBurn 8y agoTheir AWS wasn't threatened, only their ability to use CloudFront. We will immediately suspend your use of CloudFront if you use third party domains without their permission to masquerade as that third party.
- jlund 8y agoThe relevant text is in the subject line of the email: "Notification of potential account suspension regarding AWS Service Terms"
- yodon 8y agoPlease don’t use code formatting for quotes, it makes the content unreadable on mobile
- gsich 8y agoLast I checked scrolling is possible on mobile. As is landscape.
- gue5t 8y agoHow is it possible to "use" a domain name without owning it? More specifically, which mentions count as "uses"?
- icebraining 8y agoIn the request from the Signal app to Amazon's servers, they pretend that's the domain they want to contact, but inside the encrypted connection, they actually ask for a different domain (the latter of which they own).
- alpb 8y agoCan someone explain how does one serve content on a domain they don't own, like in this case Souq.com? Do they shove their content to something like product reviews or what? EDIT: I realized they use souqcdn.com. Does this mean it works because their clients use "souqcdn.com" to resolve to CloudFront CDN's IP address and then they craft a different Host header (like "Host: api.signal.org"). Also how can they possibly use CDN for this? As far as I know, CDN works only with GET requests, so how are they doing a chat app on this?
- pault 8y agoTFA explains it in detail.
- sincerely 8y agoWhat's TFA?
- deleted 8y ago[deleted]
- derivagral 8y agothe "friendly" article
- gruez 8y agothe fucking article
- monochromatic 8y agoThe Fucking Article
- tzakrajs 8y agoThe fine article
- basch 8y agothe father article
- notyourday 8y agoWell, this is what happens when countless startups go to a couple of web hosters in the name of outsourcing unsexy stuff like racking and stacking servers.
- monochromatic 8y agoIf they were self-hosted, it would be even easier for Iran to block them.
- notyourday 8y agoIf they hosted on VMs they would simply hop from one place to the other. The problem is that all of this stuff is "difficult" and no one would be writing stories about how great signal is if it could switch between thousands of companies that provide VMs to masses. We do not have these thousands of companies because AWS/GCS/Azure are the go to. Well, guess what? That means that objectively there are three kings of the world and the lieutenants of those kings get to decide what is and is not allowed.
- tedunangst 8y agoIran is probably sophisticated enough to make some DNS queries...
- goatsi 8y agoEgypt and Iran block their domain, so they would have no method of directing users to the current IP.
- notriddle 8y ago> If they hosted on VMs they would simply hop from one place to the other. No, that isn't a good enough solution. Signal needs to be reliable, or it's not worth having at all. The fundamental problem is node discovery: allowing the users to discover the IP address of the mothership (or, if you prefer, other members of the P2P network, but Signal is a centralized network) without the oppressive regime finding those IP addresses. Domain fronting was supposed to be a "cut the knot" solution, but CDN providers are shutting it down. Tor's approach has been to use a La Resistance approach, where Dave in the US runs an obfsproxy node for Yasim and his twelve trusted friends, that's how node discovery works, and as long as Dave is a good sysadmin and nobody squeals it's reliable. Personally, I think that's the only sustainable solution, but it's not very user-friendly, because you need to have trusted confidants on the other side of the firewall that your government doesn't know about. Signal can't be that trusted confidant, though I imagine Signal works over Tor just fine if you set it up.
- deleted 8y ago[deleted]
- organicmultiloc 8y agoThis doesn't seem like a good solution from any angle. Do we need to change TCP/IP/whatever to actually allow network traffic to be secure again?
- therealmarv 8y agoAFAIK There was some effort to make this TLS 1.3 SNI header encrypted but some influential groups blocked that (I think I read something about ability to route and control traffic easily). Really sad :(
- geofft 8y agoWhat do you encrypt the header to? Options include: - Start an encrypted unauthenticated conversation with the server first: that adds at least one extra round-trip, so most people won't do it, so it's easy to block all connections that do - Encrypt it to a key you have from the previous connection: doesn't help the initial connection and you already have session resumption for the rest - Encrypt it to a well-known "private" key: doesn't help at all The actual proposal for TLS 1.3 SNI seems to involve ... domain fronting. https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02 https://tools.ietf.org/html/draft-ietf-tls-sni-encryption-02 (I assume that's so that it avoids the "it's easy to block" problem)
- icebraining 8y agothat adds at least one extra round-trip, so most people won't do it Eh, people will do whatever the TLS libraries have as default. Optimizing for an extra RT is way above what most app developers do.
- geofft 8y agoMost app developers, sure, but most web server developers are definitely going to optimize for it - the cost of an extra round-trip is immediately noticeable in benchmarks. And most app developers are running a pre-existing web server to proxy to their code (whether via HTTP to localhost / within the firewall, or something else like WSGI or FCGI), not linking TLS libraries themselves.
- ChuckMcM 8y agoClearly they need to create a free iPhone/Android game that becomes wildly popular in these countries so that they can use their own domain to front their 'secret' packets.
- coolspot 8y agoCensors are not stupid, they will ban domain with no problem. See Russia banning millions of AWS and Azure IPs to block Telegram, damaging a lot innocent applications by the way.
- sorokod 8y agoSome censor are very stupid. I visited a country in south east Asia about ten years ago that was blocking Google. On http. But not on https.
- reitanqild 8y ago> Censors are not stupid, they will ban domain with no problem. > See Russia banning millions of AWS and Azure IPs to block Telegram, damaging a lot innocent applications by the way. In that particular case they seem to have been outsmarted for now : )
- pm90 8y agoI'm thinking of a legislative, not technological solution to this, which seems to be pretty straightforward: make it unlawful for US companies to refuse service simply for Domain fronting. That way, none of the big companies could lawfully refuse service to Signal; neither could they be faulted by these other regimes for "letting Signal use their domain".
- jpk 8y agoNo, the solution is to solve the technical problem of leaking metadata during the TLS handshake. Should it also be unlawful to refuse service to someone who pretends to be you when they resell your widgets to the mob because they fear retaliation if the mob isn't happy with the goods?
- deleted 8y ago[deleted]
- jpk 8y agoRe: Your deleted The fact that in Signal's case, the client and the server are fully aware of who each other are is immaterial (thus not part of the analogy). What the analogy demonstrates is that there exists a potentially-retaliatory party that sees the server identify itself as someone else. That someone else (in this case, the cloud provider) has the right to protest the use of their identity in a way that makes it a target for the retaliatory party. Have a great day.
- RIMR 8y agoGood, go ahead and pass those laws and I'll use Cloudfront to impersonate Amazon.com and steal credit card info, and Amazon will be legally unable to stop me.
- icebraining 8y agoYou've misunderstood how the trick works. Nobody is impersonating anybody. To make an analogy, they're like a guy who tells the building security guard that they're going to apartment 5 (the Souq servers), but when they're in they actually go to apartment 8 (Signal's servers). Except the censors can only see the conversation with the guard, but they can't see where he actually goes, so they can't distinguish him from a real Souq visitor.
- myth_buster 8y agoThe title is a bit clickbaity. It makes complete sense why Amazon will not be happy with domain fronting. Side note, Not sure what the point of [Redacted] is as it's trivial to get name from > General Manager, Amazon CloudFront
- insensible 8y agoTo focus the attention on the role rather than the person, who is clearly just representing the company. It softens it.
- zoltaan 8y agoBased on the story Amazon has no problem with you circumventing censorship, it is not the subject of the topic at all, do not lie please because you only hurt your own reputation and trustfulness - which in a highly sensitive area that you are working in is paramount!
- jlund 8y agoThe technique that Signal was using to circumvent censorship (domain fronting) will no longer be possible on Amazon: https://aws.amazon.com/blogs/security/enhanced-domain-protections-for-amazon-cloudfront-requests/ https://aws.amazon.com/blogs/security/enhanced-domain-protec...
- zoltaan 8y agoThis is not waht's in the title of the article! The title says the account is threatened to be closed on the grounds of circumventing censorship! Big fat lie! The account suspension threat is based on using something that is not permitted! Knowingly not permitted, illegitimate use!
- Skunkleton 8y agoWouldn't it make more sense to build TOR or something like it into signal for these use cases?
- icebraining 8y agoTor was actually using the same trick to avoid censorship: https://blog.torproject.org/how-use-meek-pluggable-transport https://blog.torproject.org/how-use-meek-pluggable-transport meek-amazon makes it look like you are talking to an Amazon Web Services server (when you are actually talking to a Tor bridge), and meek-google makes it look like you are talking to the Google search page (when you are actually talking to a Tor bridge).
- buildbuildbuild 8y agoBundling Tor in an app is quite an engineering hurdle and latency increase, but yes. Pluggable transports allow the public to find solutions that work for specific countries faster than an in-house development team as well. Delegating censorship circumvention to the Tor Project as an opt-in option for users could save a lot of engineering hours. Tackling it yourself does get you some easy press opportunities though, as this upvoted article proves.
- rajacombinator 8y agoIt’s pretty clear Amazon is in the right here. Actually I’d say it’s a positive that they made an effort at human outreach.
- QuinnyPig 8y agoNote that this was about to break in any case: https://aws.amazon.com/blogs/security/enhanced-domain-protections-for-amazon-cloudfront-requests/ https://aws.amazon.com/blogs/security/enhanced-domain-protec...
- onetimemanytime 8y ago>>Direct access to Signal has been censored in Egypt, Oman, Qatar, and UAE for the past 1.5 years. Yeah but Amazon alone, should not bear the cost of making Signal accessible to these countries--especially without their consent. People underestimate dictators, they will block God's channel to ensure their own survival. How many times has Youtube been blocked by countries? Plenty of time. So Amazon cannot risk being blocked completely because of this.
- kombucha2 8y agoCouldn't they ask people to donate their AWS instances or a portion of their webserver (or domain) resources to running a small outward facing webserver as a dummy, making the domain look like its a real website (eCommerce etc) and then passing Signal data through a Shadowsocks (or something similar) proxy? Couldn't they develop an AMI that they hold the keys to that people could deploy with ease?
- mabbo 8y agoThose who wish to suppress Signal would just play whack-a-mole. They'd login to Signal, find what domains it was connecting to and then block those. To update Signal with new addresses constantly, you'd need a server hosting those updates- which would in turn be blocked immediately. The idea of using Souq.com or Google.com as the domain name in the TLS header was that even oppressive regimes won't block Google or Souq for their entire country.
- cjbprime 8y agoThis has been explored by Tor, through a design sometimes called "flash proxy" and "snowflake". They used websockets and webrtc datachannels so that all you have to do to volunteer yourself as a relay is visit a webpage with JS enabled. The idea is to have many short-lived proxies on residential connections, paired with an announce mechanism.
- cjbprime 8y agoAmusing idea: use Bitcoin's blockchain as a peer announce mechanism. Does your country want to be involved in cryptocurrencies less than they want to censor? On second thought, the countries most interested in censoring are probably also the countries most interested in blocking people from using Bitcoin? :)
- zzzcpan 8y agoTelegram has some pretty interesting ideas wrt censorship circumvention. I.e. you can still use Amazon, Google, Microsoft as an unblockable side channel to deliver proxy settings, same way domain fronting relies on them. And you can sponsor other people to setup proxies, making it hard to detect and suspend accounts used for censorship circumvention on Amazon and other hosting companies. As a side channel dns over https still works even with tls to google.com and then putting Host: dns.google.com into the header. Frequent updates to applications and push notifications can be used as side channels too. You can also register a bunch of domain names ahead of time using hash of a current day, month, year and then let the app generate domains names to query on the fly and query them over normal dns. The censor would need to reverse engineer the app to figure out the domain generation algorithm. To make proxies hard to enumerate you can shard the mapping of ids/phone_numbers to proxies in a such way, that each id receives multiple proxies using multiple different sharding schemes. This not only makes it harder to enumerate, but also lowers the chances of someone else obtaining the same set of proxies as the censor and rendering the app unusable. Changing IPs then forces the censor to chase you, but never really catch you to censor the app. But I do think building peer-to-peer network instead of proxies is a better idea for circumvetion.
- theintern 8y agoGiven its an open source app, it should be reasonably easy for the censor to reverse engineer the algorithmically generated domains. Frequent tiny updates would be an interesting solution though. Now that most mobile apps can deliver just deltas to save bandwidth it'd be viable.
- geofft 8y agoWhy can you not run load-balancers on AWS using randomly-selected subject names of other certificates on other AWS machines? Or just design your protocol so it looks like TLS session resumption and no SNI hostname is in the clear at all?
- krallja 8y agoThe load balancers will have to have a public IP address, controlled by Signal, which is trivial to block. The whole reason this hack works is because CloudFront is the one terminating the TLS connection with a misleading SNI header. Blocking CloudFront means nobody can use CloudFront for any purpose.
- badrabbit 8y agoIf TLS incorporated a feature by which clients can send the server name after the TLS handshake which would cause renegotiation of encryption keys with the requested server (if available) then wouldn't that solve the problem at hand? That way there would be no nees for an unencrypted SNI. Is there already a TLS extension for this? If not,would have been nice if 1.3 incorporated this.
- ars 8y agoCould they use http instead, with random (generated) domains? And then encrypt the payload? For extra credit encrypt the payload as html tags (i.e. build valid html where the tags correspond to the bytes in the payload.)
- manquer 8y agoAll of the domains still would need to point to cloudfront. Only CF was ignoring the outer header, which aws is changing it and this hack won't work in the future
- prabhaav 8y agoThis is why we have built stealthy.im on a decentralized and censorship resistant platform.
- coolspot 8y agoIf censor can enumerate nodes of P2P network, it can ban it.
- jeena 8y agoWouldn't a federated system be much more robust where you would only need to access one of the nodes and this would send it through a chain of nodes to the receiver?
- merb 8y agowouldn't it be possible to actually allow "signal" customers create an appengine account via the signal app? i.e. every customer can just add their google account as a setup to setup an appengine proxy to signal. this would mean that iran would either need to block appengine or they would need to find out all customers. it could be even implemented with a shuffle so that you can shuffle your app id.
- sounds 8y agoI took away two important messages: 1. Amazon is paying more attention to the TLS handshake than I thought. 2. Censorship-bypassing software is getting popular enough that it's hitting the news.
- kazinator 8y agoWhat? Surely: 0. Amazon is paying more attention to HackerNews than I thought. I mean: Yesterday AWS became aware of your Github and Hacker News/ycombinator posts [ ... ] General Manager, Amazon CloudFront
- ry_ry 8y agoAll the big tech companies are pretty well represented here - it is most likely an employee spotted and flagged the issue whilst having a wee browse over their morning coffee.
- textmode 8y ago"Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need." Does this mean that endpoints that require SNI are potentially contributing to censorship? Facts: SNI is optional. Not all websites require it. For example, https://signal.org https://signal.org does not require SNI; clients that do not send SNI can be used to fetch this blog post, without exposing the hostname.
- thefifthsetpin 8y agoSure, but the censor can just censor requests that omit SNI.
- textmode 8y ago"According to our communication with the International Computer Science Institute's certificate notary, which observes on the order of 50 million TLS connections daily, 16.5% of TLS connections in June 2014 lacked SNI, which is enough to make it difficult for a censor to block SNI-less TLS outright." Fifield et al. Proceedings on Privacy Enhancing Technologies 2015(2):1-19 at 2.
- krallja 8y agoThe process listening to IPs that resolve as signal.org must not have alternative hosts on it, since the web server can’t choose a certificate based on anything but IP. Now the censor can just block your IP.
- deleted 8y ago[deleted]
- textmode 8y agos/send/& correct/
- pasbesoin 8y agoDemonstrating that these companies are willing to sell the values of the societies, and many of the people, who created them, down the road. Free and open speech, interaction, and association. Privacy. For most of us, this is "somewhere else", right now. But it will be "coming to a theater near you", real soon now.
- mvanbaak 8y agoI really dislike the way they put it in the title of this post. What they are doing is simply abusing the name/size of a totally unrelated company to mask signal traffic. While I am totally in favor of signal, simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do. They could have simply have sent the question to the owner of the domains (google and amazon) explaining what they wanted to do, and only think about implementing it when the owner agreed. And last but not least to answer those: 'why would they even care, the traffic goes to cloudfront anyways?' ... It will seriously mess up the stats (and billing, yes, amazon owned companies pay internal bills to aws for usage, it's a very normal way of doing business and get your taxes right). It's sad that tricks like these are being considered/needed to have access to internet services in some parts of the world, but simply doing it without all parties involved knowing about it and agreeing on it is _NOT_ the way to do it.
- wildfire 8y agoIf this would "seriously mess up the stats", then arguably the CDN is doing it wrong. It should bill on the inner (encrypted) domain and not what is outside.
- mvanbaak 8y agoStill, the initial package is meant for the infra of the outer domain. Sure, the real payload will be billed to the inner domain owner, but not the initial handshake (and usage of keys etc)
- nebulous1 8y ago> simply using a domain name you dont own in the SNI header just because it is terminated at the same service as you want to use is something you cannot do Why not out of curiosity? I'm not disputing Amazon's right to disallow this (it's their service after all), but before that I don't see any objective reason why this is something they they "cannot" or even "should not" do. Also, unless Amazon put in a technical barrier (which they are in the process of doing), then they can't stop a third party from doing it anyway (i.e. me personally sending a different domain in the SNI header than the one I actually end up communicating with), and on that level (ie me rather than Amazon's customer) I see no reason why I wouldn't do exactly that if my ISP was blocking the target domain.
- diedyesterday 8y agoIt's like Robin Hood running from King John's guards and barging through other people's homes. Some would definitely be pissed.
- RockyMcNuts 8y agoI feel like Amazon has a moral obligation to name the country that is forcing them to do this under penalty of having their entire IP block black-holed. I assume Amazon would not take this step unless that was going to happen otherwise, or at least I don't see why they would. They don't need to make a political statement about it, just say they did it to comply with law / order of 'X'. <cough>Russia<cough>
- RandomCSGeek 8y agoWhy wouldn't they do this on their own? Keeping their reputation good with all countries(even the oppressive one's) is an important part of business. After all, amazon has stakeholders to answer to.
- RockyMcNuts 8y agoI don't see how it hurts their reputation to allow Signal to anonymize. They could even block domain fronting in general to block bad actors, and quietly whitelist Signal.
- RandomCSGeek 8y agoIt's not about anonymizing, it's about hiding under the mask of some other entity, without their(other entity's) permission. AWS's other customers and various governments won't be happy about aws allowing Signal to do so. While they could white list Signal, I don't see why they would want to go through this trouble. It's not like any of these public companies care any more about supporting people under oppressive rules, than profit.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- bluefox 8y ago"If you put a spoonful of wine in a barrel of sewage, you get sewage. If you put a spoonful of sewage in a barrel of wine, you get sewage." -- Schopenhauer Unencrypted server name indication is sewage.
- nemothekid 8y agoIn the past, the alternatives was a static IP, which are easier to block. i can’t think of a solution that doesn’t just pass the buck to another third party (like a CA) which would be sucseptible to the same attacks.
- shruubi 8y agoIt's frustrating because I can see both sides having valid concerns, however, while Signal's position may be the right one ethically, AWS/Google are in the right practically. Should these countries kick up a stink about a private business acting from their perspective to undermine the laws of their country, it could very well blow up into an international incident. From the point of view of AWS/Google, allowing this to happen or turning a blind eye makes them just a culpable if this were to turn into an incident. That's not to say I don't support what Signal is trying to achieve, in fact, I very much do, however, given that in essence they forced Google/AWS into this situation without much thought makes me less sympathetic to their plight.
- soheil 8y agoThe title is misleading they are pretending to be Amazon. The title, Amazon threatening to suspend Singnal’s AWS acoount over censorship circumvention, is more vague, less accurate and potentially harmful.
- M00nF1sh 8y agoI think Amazon is doing the right thing here. There is no reason to blame Amazon, since it's protecting other customers's right to serve content legally. When we need "collateral freedom", we should change TLS, instead of asking Amazon to allow this by hurting more customer's right to serve content to countries like russian.
- vioyul 8y agoI don't like this. The last few services taking privacy seriously are under attack all over the world. Telegram vs. Russia, Signal vs. Amazon, WhatsApp Encryption vs. Facebook...
- CamTin 8y agoCan't we just fix TLS to not have this plaintext negotiation component? It clearly isn't necessary, or domain "fronting" couldn't even work.
- manquer 8y agoIt is still nessecary , it only works because both domains are serviced by the same CDN servers which ignores the plain text version once the packet reaches them. If the plain text component is not there none of the intermediary parties will know where to route the packet as they cannot decrypt the header.
- dannyw 8y agoWell, routing of the traffic can happen AFTER decryption.
- yani 8y ago"If you’d like to help, we’re hiring." Sure but none of the open jobs are related to the problem the post is describing ... unless designers started to have super powers or Android developers are the new Avengers
- _bxg1 8y agoIs this something that CloudFlare could help with? They tend to have an idealistic bend, and they serve content for enough sites that they could conceivably disguise traffic in the crowd for altruistic purposes. I could be misunderstanding the mechanism in question, though.
- daveheq 8y agoAmazon isn't targeting Signal, this is their new policy based on (mostly) abusers (though I doubt Signal was intentionally trying to abuse the system for malicious reasons). Hopefully this doesn't get spun out of control, but the title of this post seems to be spinning it.
- HIPisTheAnswer 8y agoAccording to the founder of matrix, him and Moxie had a meeting a few years ago to discuss federation where Moxie debated that it wasn't ideal to create a federated protocol, that somehow it would create too many problems. Now that Signal is unable to service everyone without federation, does Moxie still hold reservations on federated protocols? On another tangent; the Host Identity Protocol would resolve this (and countless other) security issue by simply rendering all traffic impossible to analyze in such a way. Why a big tech company like google hasn't put their men on the idea is beyond words, especially since it also elegantly solves mobility.
- DEFCON28 8y agoWhy should we in the United States coerce (or sneak into) countries whose Governments don't want us there? Are these folks really "idealists" who think that access to tools like "Signal" will usher in a new spring! (See how well that worked in Egypt and Syria?) Let these Nations enjoy their sovereign right to protect their borders--even their digital ones--as they see fit.
- lovelearning 8y agoA nation != its current government Citizens under oppressive governments often don't like their governments. The feeling's usually mutual. Some people in such countries - I actually think "most" but I'll remain conservative here - appreciate such tools and its creators. Not necessarily to do anything so ambitious as "ushering in new springs", but often simply to talk to relatives or make online friends or learn new things or exchange ideas online. In case you didn't realize it, lack of freedom and powerlessness really brings down one's mood, and anything to brighten it up is welcome.
- foxylad 8y agoWouldn't it be nice if Facebook, Apple, Amazon, Netflix and Google all gave Signal certificates as part of their anti-censorship support?
- DEFCON28 8y agoC'mon! Can't we solve this problem with the Blockchain?
- jsjohnst 8y agoWhy can’t they use raw HTTP vs HTTPS and use an encrypted payload? That handles the SNI front as they outlined as the detection mechanism hindering them. I’m sure there’s more to it because this seems pretty basic, but curious the reason why this was ruled out.
- meesles 8y agoThe issue here isn't that the content can be read, it's that oppressive regimes can censor content from apps like Signal completely. It's a question of hiding the source/destination, not the contents.
- jsjohnst 8y ago1) they already said they can rotate IPs just by using a cloud service 2) I have to assume they aren’t relying on traditional dns alone because that’s the first thing countries like the UAE filter on, so if dns blocking was an issue, they’d be dead before domain fronting would be needed. 3) the mechanism claimed for detection now is TLS SNI. So my point is remove that part and secure contents otherwise thus moving the cat and mouse game further!
- emmelaich 8y agoThat occurred to me too. But HTTP/1.1 requires a Host: header. It also brings a problem of key distribution. The other technique that might be useful to register lots and lots of obscure domain names and rotate them regularly. Might cost a bit in SSL certs.
- jsjohnst 8y ago> That occurred to me too. But HTTP/1.1 requires a Host: header. Yes, but that’s easily forgeable as long as the servers in between allow it. > It also brings a problem of key distribution. Not really, you can still do chain of trust SSL validation on a payload in the body of HTTP as you could to encrypt the entire HTTP connection as in the case of HTTPS. > Might cost a bit in SSL certs. LetsEncrypt could help there.
- cavisne 8y agoIt's a strange choice to use Souq.com as the target here. They could have used any AWS customer but chose to use one owned by Amazon. It probably is genuinely one of the biggest Middle East customers on AWS but going this way would really have forced Amazon's hand.
- wastedhours 8y agoIt needs to be big enough so you can try and rationalise the morality of the DNS call cost (even being a few dollars, you're still being a bad actor in this scenario), a site known and well classified by traffic monitors that they won't get blocked on their own. I guess also that hitting an Amazon domain means the logical recourse is to get AWS restrictions (such as we have here), rather than having an aggressive this party company outright trying to sue.
- maxmorlocke 8y agoI posted on the signal community forums in significantly more detail (e.g. how to configure nginx exactly with test connections), but it's relatively easy to use AWS infrastructure only for pass through and configure nginx to accept specific public SNI headers while connecting to domains you are authoritative for (e.g. google.com, amazon.com, yahoo.com, yandex.ru). You can do this by using the ssl_preread nginx module to proxy based on the SNI header (e.g. amazon.com -> 127.0.0.1:444, google.com -> 127.0.0.1:445, yahoo.com -> 127.0.0.1:446). This effectively means that you are not having AWS or GAE do anything other than directly proxy encrypted content, which I would argue is an important distinction. The downside is that no one is providing the DNS redirect in an encrypted transaction.
- manquer 8y agoWhy is fully decentralized option like WebRTC not considered ?, there is no real need for message apps to be centralized especially on mobile. Loss of message queuing can be mitigated easily when both end points are more or less always running and messages sent only when both parties are on online. TURN relays could still be a problem and potential censorship blocks. However the protocol is standard it is not very difficult to setup one even behind NAT. You could even bundle lightweight version with app and make all the clients relays too making it very hard to crackdown on
- idonotknowwhy 8y agoHaven't these guys solved this problem: https://zencash.com/ https://zencash.com/ They're paying over 12,000 people in zencash, to host 'securenodes' with domain names and ssl certificates for domain fronting, rather than using domain names without permission. https://securenodes.na.zensystem.io/nodes/all https://securenodes.na.zensystem.io/nodes/all
- goatsi 8y agoThe point of domain fronting is to use a domain that is a key internet service, so that blocking it would cause significant collateral damage. If a domain was created specifically for domain fronting it is useless. Egypt could simply block every domain in that list and setup a cron job to automatically block new ones as they are added.
- flyGuyOnTheSly 8y agoThat second link you provided lists every single one of the IP addresses and hostnames associated with the service. It would be trivial for censors to just block every single one of them.
- idonotknowwhy 8y agoGood point, in it's current form it's a little weak. I'm hoping they get rid of that list eventually.
- cddotdotslash 8y agoCouldn't Signal use popular domains to host IP addresses as a rudimentary DNS server of sorts? For example, host a text file containing Signal server IPs on Google App engine (using the app.google.com address), Azure Blob Storage (using blob.azure.com endpoint), GitHub (raw.githubusercontent.com), S3 (s3.amazonaws.com), etc. There are hundreds of possibilities on some really popular hosting services. Then, when the app starts, it queries in them in series, gets a list of IPs used by Signal, and tries them directly. Signal can then push new IPs (preferably ones in the AWS address space) to the list as often as needed to avoid blocking. Need a new IP? Just grab another from AWS elastic IP service, update the text file, etc.
- gregschlom 8y agoAnd then the censors can very conveniently block all those IPs too, can't they?
- cddotdotslash 8y agoThat's the point, it'd be a never ending game of cat and mouse, resulting in them blocking thousands of Amazon IPs. You don't have to plaintext the text files either, you could require some kind of shared secret from the app or user login to prevent the censors from just pulling the file in plaintext.
- raarts 8y agoMaybe someone (ICANN) could start a donation register for domains which tells applications they allow using there domain name in domain fronting for censorship circumventing purposes? Since Amazon's TOS does allow domain fronting when the domain's owner allows it.
- deleted 8y ago[deleted]
- pmlnr 8y agoThis is why any centralised service is doomed. Hint: federation.
- exabrial 8y agoKinda a misleading headline. Amazon is stating the don't want their domain name used as a circumvention measure. I think that's reasonable. Signal is the one hijacking it and Amazon is taking the risk if it gets blocked.
- computerfriend 8y agoNo, the fact that Amazon owns the souq.com domain is irrelevant here.
- exabrial 8y agoCan you elaborate? I'm not sure I understand why.
- tripzilch 8y agoYeah the problem must be with Amazon, not that Mr Marlinspike refuses to allow federation of the signal protocol for no good reason whatsoever.
- verbify 8y agoHow would federation help in this use case?
- stevenlefty 8y agoThis might be a good time to switch to Threema, which generates less metadata than Signal b/c it doesn't use phone numbers as identifiers.