8 ms·

Unfortunately very true, so although I'm not a big fan of Signal's centralization and USA-based metadata processing (I'm not from the USA), I'll probably end up

by lucb1e 6y ago

Unfortunately very true, so although I'm not a big fan of Signal's centralization and USA-based metadata processing (I'm not from the USA), I'll probably end up moving my family from (now) Telegram to Signal. Alternatives would be Threema and Wire, but Wire has the same main issues as Signal and Threema doesn't have video calls nor a desktop client and an unusable web client (deal breaker for me: you need to navigate two menus on your phone to reconnect every time your phone connects to another wifi or you suspend your laptop or anything).

godelski 6y ago
> USA-based metadata processing Do you mean that they have servers in the US? US based company? They don't leak metadata, that's the difference between Signal and Telegram/WhatsApp. If the encryption is good it shouldn't matter what country the company or servers is in. That's kinda the point of encryption...
- lucb1e 6y ago
  You connect to AWS when you connect to Signal. That means the USA is the government with the most influence on Amazon to have taps placed or connection logs handed over. They can do sealed sender stuff all they like, but when 10.0.1.1 sends a 17-byte message and the server then sends a 17-byte message to 10.0.2.1, and a minute later 10.0.2.1 submits something to the server of 48 bytes and then 48 bytes are forwarded to 10.0.1.1... traffic analysis based on a tap of a Signal server isn't rocket science. Still, it's the best we've got for non-techies. Better than handing over more metadata to Facebook. Even if the jurisdiction is the same, the company (Signal Foundation) is better and is known to collect almost nothing historical by themselves. Other than, say, your real-life-identity-tied user ID of course. (In many countries, phone numbers are given out only after passport/ID verification.)
  - godelski 6y ago
    > You connect to AWS when you connect to Signal. That means the USA is the government with the most influence on Amazon to have taps placed or connection logs handed over. I'm not an networking guy but can you explain this more? I'm actually curious and what better place to get actual info than HN? If you have a sealed sender then shouldn't this be impossible? Shouldn't the size of the message be sealed as well and when the message is received you'd see that 1) it is signed by a different key and 2) the message size doesn't match? Shouldn't this be rejected? 3) Shouldn't this also apply to any app because traffic is going to bounce through some US based (or US company owned) server? My understanding is that sending data from San Francisco to Berkeley can route through Seattle or Tokyo depending on optimal routing, server configurations, and loads. > Other than, say, your real-life-identity-tied user ID of course. This is why I'm excited for the usernames. They are promising them this year.
    - lucb1e 6y ago
      Agreed about being optimistic about usernames. I'm hoping it'll be what we expect, I hear different things from different people but frankly I also have been too lazy to actually look into it (I feel like I'm always the one doing the digging). > Shouldn't the size of the message be sealed as well To hide the volume of data being sent, you need to limit how much data you can send. How would you hide from the relaying server how much data you're sending without adding dummy data? And if you add 0-500 bytes of dummy data every 5 minutes, then whenever you send >500 bytes or send a message more often than once per 5 minutes, the server still knows that it was an actual message and its size, and you can start to do traffic analysis. > Shouldn't this also apply to any app because traffic is going to bounce through some US based (or US company owned) server? Um, when I message my friend whose Matrix homeserver I'm using, the traffic involved is: 1. DNS lookup of a .de domain (does not reveal message size or anything else, even if I were to use Google DNS and reveal my home server to a USA company) 2. TCP connection to a German server 3. More traffic to his German server And same on the receiving side. Unless one of us travels to the Americas, it's not likely to ever pass through the USA. That isn't to say that American agencies might not collaborate with European agencies or even tap European land-based connections, but it's harder and would not be an option available to criminal (or civil, for that matter) investigations due to the disproportionality of the method. > can you explain this more? I'm not quite sure what's unclear about it, but I'll give it another general shot. Imagine you see this traffic log, where A/B/C/D are different IP addresses. You see various people sending data of various sizes (you don't know who's who, but everyone connects from their own IP address, or in networking terms, a TCP tuple). Since the server is just pushing messages from one contact to another, like if Alice messages Bob, it will always forward a message as soon as possible. 00:00 A -> server: [17 encrypted bytes] 00:00 C -> server: [29 encrypted bytes] 00:00 server -> D: [17 encrypted bytes] 00:00 server -> B: [29 encrypted bytes] 00:01 D -> server: [48 encrypted bytes] 00:01 server -> A: [48 encrypted bytes] From this, I would assume (without knowing any contents or anything else) that the subscriber behind IP address "A" is talking to the subscriber behind IP address "D", and that "C" is talking to "B". Now you can start building a social graph, which according to a paper I recently read (I could maybe dig it up again) needs only a few nodes before they can tell who you are, or they just ask the ISP (or in the case of the Netherlands, query the CIOT database[1]). If you think that a "sealed sender" might hide your IP address, the answer is no because the packets somehow need to make it across the network to the right devices (or to the server for that matter) and then the receiver decrypts it. [1] https://nl.wikipedia.org/wiki/CIOT https://nl.wikipedia.org/wiki/CIOT only available in Dutch. TL;DR central mapping system of IP addr -> subscriber info, available at the police's discretion, updated daily.
  - codethief 6y ago
    What makes you think that Signal doesn't have AWS instances in other regions? (I haven't checked but given their popularity, I'm sure their servers are not just in the US anymore.) > They can do sealed sender stuff all they like, but when 10.0.1.1 sends a 17-byte message and the server then sends a 17-byte message to 10.0.2.1, and a minute later 10.0.2.1 submits something to the server of 48 bytes and then 48 bytes are forwarded to 10.0.1.1... traffic analysis based on a tap of a Signal server isn't rocket science. True, though with a bazillion connections going in and out of Signal's AWS instances every minute and additional domain fronting by AWS, the NSA would probably have to be inside the AWS datacenter to carry out their traffic analysis and even then it doesn't seem like a triviality to me. Compare this to someone hosting their own Matrix node (which you're mentioning further down): In this case, it is clear that every message sent to that node has something to do with the node's owner. More generally, reconstructing a social network in a p2p network (without onion routing or anything like that) is much easier than doing this in a centralized network where all messages get routed through a central location. There's a reason why the guys from GNUnet have so far spent two decades on getting p2p right. (Though, of course, anonymity is just one of their concerns and not their only one.)
    - lucb1e 6y ago
      > AWS instances in other regions Is still Amazon operating those locations, so I assume it's still the USA who's calling the shots. Please do prove me wrong if I am, this is somewhat of an assumption (even if I am fairly confident it works this way in practice). Though perhaps I'm putting too much weight on this aspect, it's just that everything we do in Europe can be monitored through one USA organisation or another. It feels really weird when you think about the number of actually European services you use (very few) and how much money the ad machines are making with your data in the USA, how much that data is apparently worth. We're wholly dependent. Domain fronting: didn't Amazon and Google say they were not going to do that anymore, because they didn't want to stand up for the organisations using it at the time? Some countries wanted to block certain services (was it sci-hub? TPB? Tor? I don't remember) and instead of standing up for them, they just banned domain fronting. Therefore I'm assuming that one can see when a packet is actually intended for Signal and filter those out. From there, it should only be a very manageable number of packets, since we're only interested in the routing header and packet size. One does need proper equipment to capture and filter multiple gigabits per second, but the attack scenario was more about legal interception (which you put in front of the server rather than in front of the datacenter) than about dragnet surveillance. The latter is indeed less applicable on non-USA soil, hence my saying Wire and Signal have the same issue but e.g. Threema does not, though centralization still makes it way easier (thus Matrix is king in this regard). > reconstructing a social network in a p2p network (without onion routing or anything like that) is much easier than doing this in a centralized network Hmm, you mention gnunet and I'm not up to date there, perhaps you know something I don't, but this doesn't seem quite right to me. Sure, once you know who is running a server, you can install a tap and learn whom they are talking to. Way less traffic than doing surveillance on a Signal server, I'm with you there. But you do need to figure out who you're interested in first. The way that I understood these metadata targets work, is that you take a popular network (say, WhatsApp) and check who talks to whom. Anyone within 3 degrees of a suspect is now also a suspect if I remember and understood USA law correctly. But if there is no single central service, you need to install a lot of taps or capture the right internet backbones to get close to the same information. And if you're serious about anonymity, if you're hiding from the police or an intelligence agency, then surely you'd host that server somewhere paid for without traces to your real name. Or use some public home server -- they still need to tap that specific home server rather than a centralized server.

by lucb1e 6y ago

godelski 6y ago

> USA-based metadata processing Do you mean that they have servers in the US? US based company? They don't leak metadata, that's the difference between Signal and Telegram/WhatsApp. If the encryption is good it shouldn't matter what country the company or servers is in. That's kinda the point of encryption...

lucb1e 6y ago
You connect to AWS when you connect to Signal. That means the USA is the government with the most influence on Amazon to have taps placed or connection logs handed over. They can do sealed sender stuff all they like, but when 10.0.1.1 sends a 17-byte message and the server then sends a 17-byte message to 10.0.2.1, and a minute later 10.0.2.1 submits something to the server of 48 bytes and then 48 bytes are forwarded to 10.0.1.1... traffic analysis based on a tap of a Signal server isn't rocket science. Still, it's the best we've got for non-techies. Better than handing over more metadata to Facebook. Even if the jurisdiction is the same, the company (Signal Foundation) is better and is known to collect almost nothing historical by themselves. Other than, say, your real-life-identity-tied user ID of course. (In many countries, phone numbers are given out only after passport/ID verification.)
- godelski 6y ago
  > You connect to AWS when you connect to Signal. That means the USA is the government with the most influence on Amazon to have taps placed or connection logs handed over. I'm not an networking guy but can you explain this more? I'm actually curious and what better place to get actual info than HN? If you have a sealed sender then shouldn't this be impossible? Shouldn't the size of the message be sealed as well and when the message is received you'd see that 1) it is signed by a different key and 2) the message size doesn't match? Shouldn't this be rejected? 3) Shouldn't this also apply to any app because traffic is going to bounce through some US based (or US company owned) server? My understanding is that sending data from San Francisco to Berkeley can route through Seattle or Tokyo depending on optimal routing, server configurations, and loads. > Other than, say, your real-life-identity-tied user ID of course. This is why I'm excited for the usernames. They are promising them this year.
  - lucb1e 6y ago
    Agreed about being optimistic about usernames. I'm hoping it'll be what we expect, I hear different things from different people but frankly I also have been too lazy to actually look into it (I feel like I'm always the one doing the digging). > Shouldn't the size of the message be sealed as well To hide the volume of data being sent, you need to limit how much data you can send. How would you hide from the relaying server how much data you're sending without adding dummy data? And if you add 0-500 bytes of dummy data every 5 minutes, then whenever you send >500 bytes or send a message more often than once per 5 minutes, the server still knows that it was an actual message and its size, and you can start to do traffic analysis. > Shouldn't this also apply to any app because traffic is going to bounce through some US based (or US company owned) server? Um, when I message my friend whose Matrix homeserver I'm using, the traffic involved is: 1. DNS lookup of a .de domain (does not reveal message size or anything else, even if I were to use Google DNS and reveal my home server to a USA company) 2. TCP connection to a German server 3. More traffic to his German server And same on the receiving side. Unless one of us travels to the Americas, it's not likely to ever pass through the USA. That isn't to say that American agencies might not collaborate with European agencies or even tap European land-based connections, but it's harder and would not be an option available to criminal (or civil, for that matter) investigations due to the disproportionality of the method. > can you explain this more? I'm not quite sure what's unclear about it, but I'll give it another general shot. Imagine you see this traffic log, where A/B/C/D are different IP addresses. You see various people sending data of various sizes (you don't know who's who, but everyone connects from their own IP address, or in networking terms, a TCP tuple). Since the server is just pushing messages from one contact to another, like if Alice messages Bob, it will always forward a message as soon as possible. 00:00 A -> server: [17 encrypted bytes] 00:00 C -> server: [29 encrypted bytes] 00:00 server -> D: [17 encrypted bytes] 00:00 server -> B: [29 encrypted bytes] 00:01 D -> server: [48 encrypted bytes] 00:01 server -> A: [48 encrypted bytes] From this, I would assume (without knowing any contents or anything else) that the subscriber behind IP address "A" is talking to the subscriber behind IP address "D", and that "C" is talking to "B". Now you can start building a social graph, which according to a paper I recently read (I could maybe dig it up again) needs only a few nodes before they can tell who you are, or they just ask the ISP (or in the case of the Netherlands, query the CIOT database[1]). If you think that a "sealed sender" might hide your IP address, the answer is no because the packets somehow need to make it across the network to the right devices (or to the server for that matter) and then the receiver decrypts it. [1] https://nl.wikipedia.org/wiki/CIOT https://nl.wikipedia.org/wiki/CIOT only available in Dutch. TL;DR central mapping system of IP addr -> subscriber info, available at the police's discretion, updated daily.
- codethief 6y ago
  What makes you think that Signal doesn't have AWS instances in other regions? (I haven't checked but given their popularity, I'm sure their servers are not just in the US anymore.) > They can do sealed sender stuff all they like, but when 10.0.1.1 sends a 17-byte message and the server then sends a 17-byte message to 10.0.2.1, and a minute later 10.0.2.1 submits something to the server of 48 bytes and then 48 bytes are forwarded to 10.0.1.1... traffic analysis based on a tap of a Signal server isn't rocket science. True, though with a bazillion connections going in and out of Signal's AWS instances every minute and additional domain fronting by AWS, the NSA would probably have to be inside the AWS datacenter to carry out their traffic analysis and even then it doesn't seem like a triviality to me. Compare this to someone hosting their own Matrix node (which you're mentioning further down): In this case, it is clear that every message sent to that node has something to do with the node's owner. More generally, reconstructing a social network in a p2p network (without onion routing or anything like that) is much easier than doing this in a centralized network where all messages get routed through a central location. There's a reason why the guys from GNUnet have so far spent two decades on getting p2p right. (Though, of course, anonymity is just one of their concerns and not their only one.)
  - lucb1e 6y ago
    > AWS instances in other regions Is still Amazon operating those locations, so I assume it's still the USA who's calling the shots. Please do prove me wrong if I am, this is somewhat of an assumption (even if I am fairly confident it works this way in practice). Though perhaps I'm putting too much weight on this aspect, it's just that everything we do in Europe can be monitored through one USA organisation or another. It feels really weird when you think about the number of actually European services you use (very few) and how much money the ad machines are making with your data in the USA, how much that data is apparently worth. We're wholly dependent. Domain fronting: didn't Amazon and Google say they were not going to do that anymore, because they didn't want to stand up for the organisations using it at the time? Some countries wanted to block certain services (was it sci-hub? TPB? Tor? I don't remember) and instead of standing up for them, they just banned domain fronting. Therefore I'm assuming that one can see when a packet is actually intended for Signal and filter those out. From there, it should only be a very manageable number of packets, since we're only interested in the routing header and packet size. One does need proper equipment to capture and filter multiple gigabits per second, but the attack scenario was more about legal interception (which you put in front of the server rather than in front of the datacenter) than about dragnet surveillance. The latter is indeed less applicable on non-USA soil, hence my saying Wire and Signal have the same issue but e.g. Threema does not, though centralization still makes it way easier (thus Matrix is king in this regard). > reconstructing a social network in a p2p network (without onion routing or anything like that) is much easier than doing this in a centralized network Hmm, you mention gnunet and I'm not up to date there, perhaps you know something I don't, but this doesn't seem quite right to me. Sure, once you know who is running a server, you can install a tap and learn whom they are talking to. Way less traffic than doing surveillance on a Signal server, I'm with you there. But you do need to figure out who you're interested in first. The way that I understood these metadata targets work, is that you take a popular network (say, WhatsApp) and check who talks to whom. Anyone within 3 degrees of a suspect is now also a suspect if I remember and understood USA law correctly. But if there is no single central service, you need to install a lot of taps or capture the right internet backbones to get close to the same information. And if you're serious about anonymity, if you're hiding from the police or an intelligence agency, then surely you'd host that server somewhere paid for without traces to your real name. Or use some public home server -- they still need to tap that specific home server rather than a centralized server.