5 ms·

So...assuming this bill passes and Signal pulls out of the U.S., what can the average person do to continue to access Signal's servers in other countries? Can w

So...assuming this bill passes and Signal pulls out of the U.S., what can the average person do to continue to access Signal's servers in other countries? Can we VPN into an Apple computer based in the EU, build our own Signal client, and then somehow scp the files back to the U.S.? I think TestFlight would be out of the question, since you probably would need to sign Apple U.S. Terms and Conditions, and because Apple Developer Program is $99 / year. Maybe I should get a Purism phone.

paxys 7y ago
Thing is the VPN service would be subject to the same law, and so the connection would likely still be insecure.
- yingw787 7y ago
  Hmm, okay, so I can drive over to Canada, make a developer friend there, build an instance of the Signal iOS app using the licenses there, load it onto my phone via TestFlight or USB stick, then drive back to the U.S. and use it assuming TSA doesn't touch my phone?
  - aspenmayer 7y ago
    After you load TestFlight and Signal build onto your phone, make a full encrypted local backup via iTunes.[0] Upload that backup image somewhere. Turn off Find My (iPhone) to disable activation lock. Restore iPhone to factory setttings. Return iPhone to factory sealed box. Optional: mail phone to self at destination or other location of your choosing in destination. Cross border. When at desired use location, unbox phone. Fetch backup you made earlier. Restore backup to iPhone. Use Signal. [0] https://support.apple.com/guide/itunes/back-up-your-ios-device-itns3280/12.9/mac/10.14 https://support.apple.com/guide/itunes/back-up-your-ios-devi...
    - yingw787 7y ago
      That sounds much more feasible! I copied and pasted your tip into my notes app. Thanks!
      - aspenmayer 7y ago
        Another tip is that it doesn’t have to be the same phone as far as the backup and restore is concerned. Enrollment of the TestFlight app might be impacted if the phone changes but that’s just my concern because I haven’t tested that part. Here’s some links related to these ideas which may be relevant to your interests. https://support.apple.com/en-us/HT208079 https://support.apple.com/en-us/HT208079 iTunes update that allows installing apps https://www.idownloadblog.com/2015/12/25/how-to-download-older-versions-of-ios-apps/ https://www.idownloadblog.com/2015/12/25/how-to-download-old... Charles proxy how to download specific app versions https://www.reddit.com/r/jailbreak/comments/auabt7/question_is_there_a_working_tweak_to_downgrade/ https://www.reddit.com/r/jailbreak/comments/auabt7/question_... Context for AppAdmin jailbreak tweak which allows for downgrading apps from device via App Store http://www.i-funbox.com/en/index.html http://www.i-funbox.com/en/index.html iFunBox lets you backup and install ipa from device via pc or Mac http://julioverne.github.io/description.html?id=com.julioverne.ext3nder-installer http://julioverne.github.io/description.html?id=com.juliover... Jailbreak tweak to auto resign apps and install/backup from device https://support.apple.com/apple-configurator https://support.apple.com/apple-configurator Apple Configurator allows device management and provisioning by your whitelisted macOS devices
    - deleted 7y ago
      [deleted]
  - sudosysgen 7y ago
    Smuggle the phone back using an electric dirt bike crossing the Canada-US border in the middle of the night, that way the TSA won't bother you.
    - yingw787 7y ago
      I guess I should work on my bushwhacking skills.
- PureParadigm 7y ago
  I don't think that's true. If the VPN is compromised then the Signal traffic over it should still be encrypted (that's the point of Signal). As long as the VPN doesn't block your access to Signal you should be fine, and there is no risk the VPN would read your messages.
  - paxys 7y ago
    The connection needs to be secure at least initially when you are exchanging encryption keys.
    - maqp 7y ago
      This is an incredibly complex problem and it really depends on the details. which keys are used, which are pinned. Which keys the government has, and which certificates it can and will issue itself. Which clients it will backdoor, and where will it attempt MITM attack if necessary.
    - PureParadigm 7y ago
      On Signal you're encouraged to verify out-of-band (such as in person) with the "safety number" which allows users to verify each other's keys to prevent a man-in-the-middle attack. This way you'll notice if the initial key exchange has been compromised.
- alkonaut 7y ago
  So this would be a complete ban on VPNs? How does that even work? It’s enforceable in Uganda and China, but in the US?
- Nextgrid 7y ago
  But if Signal is end to end encrypted then the VPN being compromised is not a problem.
  - dilippkumar 7y ago
    Signal would be end to "the other side of VPN end" encrypted. The VPN channel itself would have a backdoor and thus defeat the whole point.
    - Nextgrid 7y ago
      If Signal is end to end encrypted (or even just encrypted to a server that has no backdoors) then observing the network traffic towards that server (which is what the compromised VPN would do) wouldn’t help. This is how even “basic” HTTPS remains secure against malicious attackers.
bscphil 7y ago
> what can the average person do to continue to access Signal's servers in other countries? I suspect once you get into "use a secure VPN in an EU country" you've already given up as far as the "average person" is concerned. You might as well recommend something like renting a VPS in a country with strong privacy laws and installing your own VPN on that, which is slightly more difficult but a much better security win if you're going that route.

paxys 7y ago

Thing is the VPN service would be subject to the same law, and so the connection would likely still be insecure.

yingw787 7y ago
Hmm, okay, so I can drive over to Canada, make a developer friend there, build an instance of the Signal iOS app using the licenses there, load it onto my phone via TestFlight or USB stick, then drive back to the U.S. and use it assuming TSA doesn't touch my phone?
- aspenmayer 7y ago
  After you load TestFlight and Signal build onto your phone, make a full encrypted local backup via iTunes.[0] Upload that backup image somewhere. Turn off Find My (iPhone) to disable activation lock. Restore iPhone to factory setttings. Return iPhone to factory sealed box. Optional: mail phone to self at destination or other location of your choosing in destination. Cross border. When at desired use location, unbox phone. Fetch backup you made earlier. Restore backup to iPhone. Use Signal. [0] https://support.apple.com/guide/itunes/back-up-your-ios-device-itns3280/12.9/mac/10.14 https://support.apple.com/guide/itunes/back-up-your-ios-devi...
  - yingw787 7y ago
    That sounds much more feasible! I copied and pasted your tip into my notes app. Thanks!
    - aspenmayer 7y ago
      Another tip is that it doesn’t have to be the same phone as far as the backup and restore is concerned. Enrollment of the TestFlight app might be impacted if the phone changes but that’s just my concern because I haven’t tested that part. Here’s some links related to these ideas which may be relevant to your interests. https://support.apple.com/en-us/HT208079 https://support.apple.com/en-us/HT208079 iTunes update that allows installing apps https://www.idownloadblog.com/2015/12/25/how-to-download-older-versions-of-ios-apps/ https://www.idownloadblog.com/2015/12/25/how-to-download-old... Charles proxy how to download specific app versions https://www.reddit.com/r/jailbreak/comments/auabt7/question_is_there_a_working_tweak_to_downgrade/ https://www.reddit.com/r/jailbreak/comments/auabt7/question_... Context for AppAdmin jailbreak tweak which allows for downgrading apps from device via App Store http://www.i-funbox.com/en/index.html http://www.i-funbox.com/en/index.html iFunBox lets you backup and install ipa from device via pc or Mac http://julioverne.github.io/description.html?id=com.julioverne.ext3nder-installer http://julioverne.github.io/description.html?id=com.juliover... Jailbreak tweak to auto resign apps and install/backup from device https://support.apple.com/apple-configurator https://support.apple.com/apple-configurator Apple Configurator allows device management and provisioning by your whitelisted macOS devices
  - deleted 7y ago
    [deleted]
- sudosysgen 7y ago
  Smuggle the phone back using an electric dirt bike crossing the Canada-US border in the middle of the night, that way the TSA won't bother you.
  - yingw787 7y ago
    I guess I should work on my bushwhacking skills.
PureParadigm 7y ago
I don't think that's true. If the VPN is compromised then the Signal traffic over it should still be encrypted (that's the point of Signal). As long as the VPN doesn't block your access to Signal you should be fine, and there is no risk the VPN would read your messages.
- paxys 7y ago
  The connection needs to be secure at least initially when you are exchanging encryption keys.
  - maqp 7y ago
    This is an incredibly complex problem and it really depends on the details. which keys are used, which are pinned. Which keys the government has, and which certificates it can and will issue itself. Which clients it will backdoor, and where will it attempt MITM attack if necessary.
  - PureParadigm 7y ago
    On Signal you're encouraged to verify out-of-band (such as in person) with the "safety number" which allows users to verify each other's keys to prevent a man-in-the-middle attack. This way you'll notice if the initial key exchange has been compromised.
alkonaut 7y ago
So this would be a complete ban on VPNs? How does that even work? It’s enforceable in Uganda and China, but in the US?
Nextgrid 7y ago
But if Signal is end to end encrypted then the VPN being compromised is not a problem.
- dilippkumar 7y ago
  Signal would be end to "the other side of VPN end" encrypted. The VPN channel itself would have a backdoor and thus defeat the whole point.
  - Nextgrid 7y ago
    If Signal is end to end encrypted (or even just encrypted to a server that has no backdoors) then observing the network traffic towards that server (which is what the compromised VPN would do) wouldn’t help. This is how even “basic” HTTPS remains secure against malicious attackers.

bscphil 7y ago

> what can the average person do to continue to access Signal's servers in other countries? I suspect once you get into "use a secure VPN in an EU country" you've already given up as far as the "average person" is concerned. You might as well recommend something like renting a VPS in a country with strong privacy laws and installing your own VPN on that, which is slightly more difficult but a much better security win if you're going that route.