29 ms·

Help users in Iran reconnect to Signal

• crescit_eundo 6y ago
  I just set up a Signal proxy - I don't have any social media, any suggestions as to the best place to post the signal.tube link so that it can get to those who need it the most? Thanks!
• throwitaway1235 6y ago
  This is only popular and presented as altruistic because toppling the Iranian regime aligns with the foreign policy of Western states. Now that's fine if you support the expansion of global liberal democracy (which happens to be neither liberal or democratic) but just don't be deluded into believing this is some good guy vs bad guy scenario. As we speak, U.S media is advocating for the removal of Signal because Americans may also have access to encrypted private speech!
  • 3np 6y ago
    The good news is that regardless of framing, this doesn't discriminate US users either. You can see it as a Trojan horse if you will
  • Krasnol 6y ago
    I am not in the US and this is popular to me because I'm happy to be able to help people out who are suppressed by their government. Not everything is a US conspiracy in geopolitics...
    • throwitaway1235 6y ago
      That nation states do things to advance their interests globally is not a conspiracy. Foreign policy 101. Who is to say that the Western technocratic system of government replacing the current Iranian regime would not also be oppressive? I personally believe it would be vastly more oppressive.
      • Krasnol 6y ago
        > That nation states do things to advance their interests globally is not a conspiracy. Foreign policy 101. This level of argumentation is so beyond sense and reason that I'm not even sure which nation you're talking about. Iran is not advancing anything and Signal is not part of the US government. > Who is to say that the Western technocratic system of government replacing the current Iranian regime would not also be oppressive? I personally believe it would be vastly more oppressive. Nobody is saying that because you can't but you don't have to if you want to help people out who are opressed under a dictatorship.
        • throwitaway1235 6y ago
          Signal is an American company with it's headquarters in California. My point is that the global interests of nation states and their alliances are not only pursued through government channels but also through their influence on domestic private companies. I agree that my second point was too personal and unproductive.
          • Krasnol 6y ago
            > Signal is an American company with it's headquarters in California. My point is that the global interests of nation states and their alliances are not only pursued through government channels but also through their influence on domestic private companies. Please outline those channels which connect Signal to the US government. Otherwise please stop insulting me with this story. Selling basic human rights as some evil US government agenda is ridiculous.
• LinuxBender 6y ago
  How would you let users know about this proxy without letting their government know about it? Instead of platforms like twitter, how about randomly giving out random proxies in some header that the app could query on cloudflare or google or akamai? Does Signal already make use of any CDN's for out-of-band signalling and fail-over? If the Signal proxy could expose an obfuscated load metric, then the CDN could pick another proxy via health checks. The proxy could advertise itself via CDN's as well.
  • cmroanirgo 6y ago
    I think Signal is clearly recognising that nearly sny server or system they create will be blocked, which is why they recommended this being done on an individual layer. From the article: > A more discrete approach would be to only send the link via a DM or a non-public message. You can post something like this on your favorite social network: > * #IRanASignalProxy Reply to this thread if you want the connection details, and follow me so I can DM you the link.*
    • deleted 6y ago
      [deleted]
    • not2b 6y ago
      No good; people working for the Iranian state will DM. Signal didn't think this through. No one should announce proxies via social media. Tell people how to set one up for friends and family.
      • DangerousPie 6y ago
        There are plenty of people that don't have friends of family in Iran but would still like to help.
      • boomboomsubban 6y ago
        People working for the Iranian state generally would be discernible from their Twitter account, and by controlling the information you hand out you can also flag the hidden accounts that aren't easily recognized. You also overestimate how committed Iran is to stopping this. Doing this in public risks the state finding out, but outside of times of crisis the state is usually pretty slow to respond. Keeping it private tanks participation rates.
• mholt 6y ago
  I'm a big fan of the idea of independently-run proxy servers. Caddy has a secure forward proxy plugin born out of a research project at Google that does something similar, but works with any clients that let you configure HTTP proxies, and doesn't terminate TLS: instead it tunnels it over TLS. The proxy server itself can also be probe-resistant, i.e. difficult to detect that a website is acting as a proxy. I'm hoping more people can help test the patch to support Caddy v2: https://github.com/caddyserver/forwardproxy/pull/74 https://github.com/caddyserver/forwardproxy/pull/74 (Edit: Disclaimer - Don't use this in situations where your personal safety or freedom could be at risk... not yet. Not until more people with more experience can vet its implementation for bugs, and a very clear threat profile can drawn up. If you have experience with this, we'd love your help.)
  • 2Gkashmiri 6y ago
    how does something like this work against DPI? i guess not great? >Don't use this in situations where your personal safety or freedom could be at risk https://theintercept.com/2020/12/06/kashmir-social-media-police/ https://theintercept.com/2020/12/06/kashmir-social-media-pol... https://thewire.in/media/kashmir-journalist-auqib-javeed-police-assault https://thewire.in/media/kashmir-journalist-auqib-javeed-pol... reason why i have a general disregard for technologies that are based on some sort of "link" AFK, phone number or the stupid facebook real name policy. this is as of today being used to crack down on dissent. what you are saying is true but https://thenextweb.com/in/2020/01/08/kashmirs-police-want-people-to-register-their-whatsapp-groups/ https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe... when you have your govt do this, how can you keep your signal account private? your phone is already listed. isnt it? cant the police see if you are on signal and if online means you are bypassing them somehow regardless of what you might be saying?
    • rfoo 6y ago
      > how does something like this work against DPI? i guess not great? No, it's pretty good. Think about it: all DPIs can see is an ordinary https connection. Since the traffic itself is encrypted, to discriminate this from normal web browsing the DPI device can only depend on metadata. Classic moves are: 1. Packet length pattern for TLS-in-TLS. 2. TLS fingerprinting. The first could be defeated by adding padding to the first few packets of each of your connections. [1] The second.. someone built a socks5 <-> https CONNECT proxy client [2] out of Chrome's codebase, which means it shares all the fingerprint with Chrome and you really can't tell. [1] https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2451528863fd12aeed3d3d06ec65 https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2... [2] https://github.com/klzgrad/naiveproxy https://github.com/klzgrad/naiveproxy
• turminal 6y ago
  Or they could just let people host their own server instances. Would be considerably more censorship resistant from the start.
  • JohnBerea 6y ago
    Or just use Element/Matrix which already lets you do that.
    • hospadar 6y ago
      I feel like this answer to "how to make government censorship of private communications over the internet impossible" is more complex though than just "use element/matrix" It seems like both signal and matrix choose "Human-meaningful" over "distributed" on Zooko's Triangle: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle Matrix is federated which I'd argue is pretty different than "distributed". Certainly the fact that federation is built-in makes matrix more resistant to lazy censors who are slow to block popular homeservers, but a concerted check-any-IP-and-if-it-seems-like-it-might-be-a-homeserver-then-block-it action by a censor would be harder to deal with. Wouldn't a truly distributed/secure/really-super-hard-to-block protocol rely on non-meaningful addresses (i.e. public-key-derived like a tor hidden service) and some kind of interesting mesh setup (i.e. like tor) to route and deliver messages?
      • eeZah7Ux 6y ago
        > Wouldn't a truly distributed/secure/really-super-hard-to-block protocol rely on non-meaningful addresses (i.e. public-key-derived like a tor hidden service) and some kind of interesting mesh setup (i.e. like tor) to route and deliver messages? Yes. You just described Briar.
    • notme77 6y ago
      Found the PM
  • awestroke 6y ago
    You're welcome to either use such a decentralised service or fork signal and add decentralisation / federation. Centralised services get more users by having a lower threshold of adoption.
• notsureaboutpg 6y ago
  Hmm, I have a family member going to seminary in Iran and he has been in contact with me over Signal (he moved our family chat to it over WhatsApp because of recent events). Did this happen like literally today? Because otherwise I haven't heard of such a thing...
• chmod775 6y ago
  Why can't they just ship signal with a Tor client? This is precisely what Tor was built for. They can donate some money to charities running Tor nodes while they're at it, or run some themselves. Iran tried to censor Tor too, but it's pretty much impossible to do so fully. At least the Tor devs are usually on top of it, while Signal is inexperienced dealing with things like this.
  • viro 6y ago
    Tor is is blocked in Iran.
    • gruez 6y ago
      if they block can block tor what makes you think they can't block these proxies? furthermore if you use tor you can use the existing network of bridges/relays as well as their pluggable transports protocol to avoid DPI/traffic analysis.
      • ryanlol 6y ago
        Tor is very easy to block, and relies on very similar proxies to circumvent that.
        • southerntofu 6y ago
          You probably haven't followed Tor development in the past years. obfs4 and snowflake a really cool circumvention methods that are orders of magnitude harder to detect and block than these "signal" TLS proxies. The TLS proxy signal just advertised uses plaintext TLS SNI header to determine where to route the packets, which makes it really trivial to detect and/or block. The same cannot be said about tor.
          • ryanlol 6y ago
            I’m familiar with obfs4 and snowflake. Signals TLS proxy is naive compared to obfs4, but at it’s core it’s a similar solution.
• deleted 6y ago
  [deleted]
• 2Gkashmiri 6y ago
  this is fine and dandy but when you have a state actor operating with such offensive tactics like india is currently engaged in kashmir, there isnt much these "proxies" can do. sorry. the idea of these proxies is all fun and nice but when a government can just whitelist the entire fucking internet and none of these nonsense works https://www.theguardian.com/world/2020/jan/15/internet-partially-restored-kashmir-social-media-ban-stays https://www.theguardian.com/world/2020/jan/15/internet-parti... https://thewire.in/rights/kashmir-internet-white-list-net-neutrality https://thewire.in/rights/kashmir-internet-white-list-net-ne... https://thewire.in/rights/modis-thought-control-firewall-in-kashmir-may-be-the-internets-future-in-india https://thewire.in/rights/modis-thought-control-firewall-in-... >The reason the government wants to keep blocking full access to the internet in the Valley is its fear of civil disobedience. and the ban is still in place although it is on high speed mobile internet today. https://thekashmirwalla.com/2020/12/high-speed-internet-ban-in-kashmir-500-days-and-counting/ https://thekashmirwalla.com/2020/12/high-speed-internet-ban-... not to forget there were reports of CISCO being brought in to build this fucking firewall
  • f430 6y ago
    its weird that all the criticisms of the technique in this article is being downvoted without any rebuttal people underestimate the security intelligence service of countries in this region. They have far more capacity than people in the West estimate. It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and access to internet.
    • 2Gkashmiri 6y ago
      yes. back after 5 august, i think i got my first crack at internet in february 2020 with 2G internet and a whitelist of "allowed websites". i found out in my own tests that ssh tunneling over random ports used to work. i had managed to set up a server on amazon aws, and i did a dirty ssh tunnel to that to get access to blocked websites. even that failed after some tries and changing networks. >It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and access to internet. yes. shocked pikachu face gets a random HN reader nothing but people can die as a result of this. heck i have records of people who are locked up since last year because of "social media misuse" aka dissent
• blintz 6y ago
  What is the state of the art on censorship resistance right now? This cat-and-mouse proxy fight never seems to go great for the good guys. My last in-depth reading on it was the excellent 2016 SoK paper “Towards grounding censorship circumvention in empiricism” (http://www.cs.umd.edu/class/fall2018/cmsc818O/papers/sok-censorship.pdf http://www.cs.umd.edu/class/fall2018/cmsc818O/papers/sok-cen...) The high level takeaway then seemed to be that researchers were not focusing efforts on measures that can actually help more people resist censors. Have we made progress since then?
  • robert_foss 6y ago
    There are relatively good solutions like dns fronting on Amazon or Google, but they frown upon being used that way.
  • deleted 6y ago
    [deleted]
  • ignoramous 6y ago
    I keep an eye on the work censorship.ai does as they are usually at the cutting edge of it: https://geneva.cs.umd.edu/papers/ https://geneva.cs.umd.edu/papers/ Tor, Jigsaw's Outline, and V2RayNG are worth keeping tabs on as they're FOSS projects and do much of their development in the open. Lantern's development whilst it was still open source was fascinating to see as well. Since 2016 (I believe) they stopped doing so out of security concerns: https://twitter.com/adamfisk/status/1316569766832869377 https://twitter.com/adamfisk/status/1316569766832869377
  • meibo 6y ago
    Telegram got around Russian censors by constantly pushing new IPs for their servers with Google Cloud. Of course this is a cat and mouse game as well, but it worked out well for them, since Russia didn't want to block all of Google/AWS. https://news.ycombinator.com/item?id=26028415 https://news.ycombinator.com/item?id=26028415
• 2Gkashmiri 6y ago
  hey. i just thought of something. is it not possible for india or iran in this case to check your phone number and see if it is active on signal? if you are online means you are somehow bypassing their blocks. isnt then just a matter of tracking your cellphone and relevant xkcd applies ?https://xkcd.com/538/ https://xkcd.com/538/ this is looking like a zero sum game unless signal account is delinked from phone numbers because the govt can play cat and mouse game indefinitely
  • monadic3 6y ago
    > is it not possible for india or iran in this case to check your phone number and see if it is active on signal? WTF, why does signal require PII to use? Shouldn't it give you a public/private key pair on signup?
  • f430 6y ago
    all they need to do is be in the approximate region of the cell signal through triangulation to figure out the phone numbers / unique identifiers attached to the phone. then its a matter of time before they link real identity to the phone. With the wide availability of femtocells, all they need to do is get lucky once. This puts operators of Signal proxies at potential harms way! Absolutely irresponsible for people on HN to downvote and downplay genuine security concerns.
    • 2Gkashmiri 6y ago
      oh. you are not joining all the dots here. an offensive govt already has KYC on cellphones. they can pull your details in a second. My reasoning. they have a list of say 100 users. every govt has lists. they check that list against signal users as "social graph" and voila, they know you are online or not. second, kyc documents show who you are so you are good as toast
    • MrMorden 6y ago
      How is a proxy operator in harm’s way? They aren’t in Iran, and the Iranian government understands the consequences of trying to do anything about it. Users are in no more danger than they’ve always been, and substantially less than if they didn’t have communications ability.
• realducksoft 6y ago
  Damn, I've read the code. This won't work against an active probe. Censors just use signal domains and non-signal domains to test your proxy. If signal domains get passed and non-signal domains got denied, you are fucked. Besides, TLS in TLS is highly identifiable by simple packet length dpi. I'd hope there's better plan.
  • Diggsey 6y ago
    > Censors just use signal domains and non-signal domains to test your proxy. If the censor already knows about your proxy they would have no reason to test it... The whole point is that there isn't a central list of proxies for them to easily block.
    • deleted 6y ago
      [deleted]
    • pmlnr 6y ago
      > there isn't YET. I wonder if someone will find a simple way to map these with shodan.
    • I_Byte 6y ago
      This is the very same problem that Tor faced when Tor bridge use started to pick up in China around the late 2000s / early 2010s. You only needed a single Chinese user to connect to your server for it to be probed by the Chinese censors. Older versions of the obfs Tor bridge protocol could be detected by active probes and thus blocked very much like these Signal proxies. This is a cat and mouse game that Signal could very easily lose should Iran start to care about probing all new active connections that leave Iran.
    • lucb1e 6y ago
      No but look, they're blocking connections country-wide. Apparently they have government boxes installed on the outside lines. If you're looking at IP headers and deciding to drop or pass based on that, it's trivial to collect the IPs you don't yet know, check if they're running a proxy (Signal, Tor, I2P, whatever), then add them to the block list if they are. If it's trivial to figure out (by doing a nice handshake) whether something is a certain kind of proxy, then the cat-and-mouse game is reduced from finding lots of mice to updating the cat system to test whether passing animals are mice and instantly wiping out the mice population.
• superkuh 6y ago
  What happens when Iran's government itself runs a bunch of these proxies?
  • IncludeSecurity 6y ago
    Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/nginx-relay/Dockerfile https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.
    • RL_Quine 6y ago
      That’s awful.
    • gspr 6y ago
      I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not). [1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6 https://github.com/signalapp/Signal-TLS-Proxy/issues/6
      • aftbit 6y ago
        They have completely disabled issues on that repository. Wow I used to really like Signal...
        • kelnos 6y ago
          And it seems they've fixed the issue, without any kind of public comment.... still not great: https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97dab729fd705445742c95d5dd77eb62109e8 https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97da...
• tannhauser23 6y ago
  This is the kind of privacy initiatives we need. While we argue in America about deplatforming, Iran, China, and other authoritarian countries around the world are actually suppressing and punishing free communication. Kudos to Signal for this initiative.
  • notsureaboutpg 6y ago
    America suppresses and punishes free communication, you just aren't aware of it because they control what you see when you live there.
• dunefox 6y ago
  Wouldn't Briar be a good choice? https://briarproject.org/ https://briarproject.org/
  • aendruk 6y ago
    Not yet. https://code.briarproject.org/briar/briar/-/issues/445 https://code.briarproject.org/briar/briar/-/issues/445
    • upofadown 6y ago
      Apple devices are fairly rare in Iran.
      • lucb1e 6y ago
        They're fairly rare compared to Android in most countries, actually, also rich countries. That it doesn't work on Apple devices being seen as a blocker was the last thing I expected when clicking that link.
• deleted 6y ago
  [deleted]
• londons_explore 6y ago
  This is going to be a game of cat and mouse... And if you're the mouse, you really don't want to be hobbled by not having an auto-update mechanism in your proxy servers... At the very least they could have made it load the config from https://signal.org https://signal.org on startup, or made an apt package that sysadmins can easily update with everything else.
• est31 6y ago
  In the long run, starlink will make it even harder for autocrat regimes to censor the internet. Russian authorities already try to ban connections to Starlink.
  • AndrewBissell 6y ago
    Yes I'm sure Starlink would never do something like censor traffic at some regime's behest. Elon Musk is famously independent and not at all beholden to funding from the U.S. and China.
    • sschueller 6y ago
      /sarcasm
  • quenix 6y ago
    Unfortunately, it's easy for governments to criminalise owning Starlink terminal equipment. Also, Starlink may be legally forced to deny service to users in certain geographical regions.
    • roywiggins 6y ago
      Iran's been having a tough time shutting down illicit satellite receivers. > One woman in the Iranian capital, whose satellite dish was demolished by the police several months ago, told "Persian Letters" that the first thing she did the day after her apartment complex was raided was order a new dish and receiver. > "That's the only fun we have here. There's nothing worth watching on [state television]," she said. "They can come and take my dish away. I will get a new one." https://www.rferl.org/a/persian_letters_satellite_dishes_iran_police/24514665.html https://www.rferl.org/a/persian_letters_satellite_dishes_ira...
    • est31 6y ago
      Unless the government can seize Starlink's assets, or shut down/harm their operations, they can't really tell Starlink to do anything. E.g. if they can shoot down satellites, they'd have influence. This is especially true for economies that are as disconnected from the US as the Iranian one is. The only thing a state has control over is payments from users. But if smuggling in transceiver equipment with pre paid traffic isn't that hard.
• not2b 6y ago
  If everyone announces their proxies the Iranian government will be monitoring those announcements and will be able to block traffic to them. It may be better for those with friends and family in Iran to run proxies and quietly inform only people they trust.
  • monadic3 6y ago
    Not to mention you can get into significant legal trouble helping people sanctioned by the US.
• aendruk 6y ago
  > You can share your proxy with friends and family using this URL format: https://signal.tube/#<your_domain_name> https://signal.tube/#<your_domain_name> […] The latest beta release of the Android app is registered to handle links from signal.tube. This scheme is convenient for those with correctly configured devices, but comes at the cost to everyone else of increased risk of inadvertent leaks of the fact that they're attempting to circumvent the block. I'd be interested to hear more about what factored into the decision to make this trade-off.
  • remram 6y ago
    Good point! I wonder why they didn't reverse the scheme, e.g. https://mydomain.example.org/#is-a-signal-proxy https://mydomain.example.org/#is-a-signal-proxy
    • mhils 6y ago
      AFAIK you can register URL handlers for a specific domain (signal.tube), but not for a specific hash. And you don't want Signal to appear as an alternative browser on every link. Edit: On a second thought, I wonder if a custom scheme would have worked, e.g. signal-proxy://example.com?
      • remram 6y ago
        You can set the host to "*" on Android, but maybe not on iOS? For example, my Mastodon app pops up to open all links that look like a Mastodon profile (https://example.org/@somename https://example.org/@somename). https://github.com/tateisu/SubwayTooter/blob/4cf16c6ee890a7d492cd90bf9bc68dffff879e9d/app/src/main/AndroidManifest.xml#L134-L137 https://github.com/tateisu/SubwayTooter/blob/4cf16c6ee890a7d...
      • 2cb 6y ago
        If you click on one of the links it is using sgnl://signal.tube/#[domain] to deliver the proxy settings to the Signal app.
• deleted 6y ago
  [deleted]
• TheJoYo 6y ago
  Everyone complaining this is just a cat-and-mouse game, it’s not a game these people choose to play. They either play it or their movement dies.
  • ncallaway 6y ago
    Of course it's a cat and mouse game. That doesn't mean it's unwinnable. That means you create a lot of evasive mice and win. Perfect is the enemy of the good. This is the kind of thing where winning is more important than a perfect strategy. Be water.
• pmlnr 6y ago
  There was an article in 2014: "Imagining a Rebel Firefox" ( https://medium.com/@efrensandoval/imagining-a-rebel-firefox-8eb8402a4cc5 https://medium.com/@efrensandoval/imagining-a-rebel-firefox-... ) which played with the idea if every firefox node would become tor(ish) gateway. Is there no way to build this in the Signal clients themselves? Eg. on is on a wifi, try to upnp, ask the user if they'd wish to help.
  • circularfoyers 6y ago
    Similar to the Tor Project's Snowflake[1] Firefox addon? [1] https://addons.mozilla.org/en-US/firefox/addon/torproject-snowflake https://addons.mozilla.org/en-US/firefox/addon/torproject-sn...
    • samename 6y ago
      Thanks for mentioning this! I’m surprised I hadn’t seen this before.
  • qwertay 6y ago
    No because mobile devices suck for P2P. Even on wifi and plugged in you likely couldn't force your app to stay open and the phone on. Easier to tell a bunch of people to run a docker container on a raspberry pi.
• sergiosgc 6y ago
  Signal should be federated. This censorship problem would not exist, or would be organically routed around, were the service federated. Without federation, Signal is just another stepping stone in the long path of eventually abandoned instant messengers, all the way back from ICQ. We will get to an SMTP-like protocol, and email-like service, at some point. If not Signal, some other one.
  • vineyardmike 6y ago
    > organically routed around Do any SMTP servers still allow organic routing? I was under the impression that all modern servers have extremely cumbersome auth/dkim and its hard to not be GMail and still send a real msg and have it arrive
    • BenjiWiebe 6y ago
      DKIM/SPF really aren't that bad. And you can not be Gmail and still get emails sent. Except Outlook/Hotmail/etc will randomly start blocking your emails, and only unblock your emails after you pester them enough.
  • ignoramous 6y ago
    Signal was federated at one point: https://lwn.net/Articles/687294/ https://lwn.net/Articles/687294/ Moxie, one of the original authors of the Signal protocol, said federation severely restricted flexibility and so they had to move on: https://news.ycombinator.com/item?id=11668912 https://news.ycombinator.com/item?id=11668912
    • Evidlo 6y ago
      They "federated" with only one other server run by the Cyanogenmod team. Agreeing on and keeping some spec up to date is a solved problem. Just ask any web standards committee.
  • WookieRushing 6y ago
    I’m not so sure. Moxies reasons about how federation leads to protocol development slowing and then freezing are solid. It’s why we re not using smtp for chat. SMTP can’t be extended enough so replacements are built instead. Similarly if signal federated, eventually it would freeze and a few years later users would move to wherever they could get new features. Federation is a good thing but only when the protocol is finished or if there is a forcing mechanism to allow updates to the protocol. ethereum/Bitcoin are good examples as they have flag days that force the value of currency to be in the balance to keep the protocol moving forward.
• pmlnr 6y ago
  So... federate but not really? I'd heavily advise instead to run as many xmpp servers* as possible, and let people/friends use them. *not matrix, unless one configures it to forget the data and only act as a message broker, like XMPP. For this specific use, it's better.
• djl0 6y ago
  If Iran is blocking Signal but not other apps, namely Whatsapp, does this mean Iran has access to Whatsapp data? I fully expect the US govt to have access to fb/whatsapp data (at least the metadata), but it's a bit surprising to me that Iran would too.
  • danenania 6y ago
    I think FB’s policy is to comply with local laws regardless of ethical concerns?
    • benlivengood 6y ago
      There are a few requests reported: https://transparency.facebook.com/government-data-requests/country/IR https://transparency.facebook.com/government-data-requests/c...
      • mzs 6y ago
        which you can't read without a FB account! In any case 6 users/accounts in fist half of 2020
    • xirbeosbwo1234 6y ago
      I think FB's policy is to _____(verb)_____ regardless of ethical concerns. They certainly aren't complying with U.S. antitrust laws. They comply if it makes them money and don't comply if it doesn't make them money.
  • ParanoidShroom 6y ago
    I doubt it. By the same reasoning they would also have access to iMessage and other apps that aren't banned. Not sure what WhatsApp or fb has to do with this.
    • 2cb 6y ago
      Considering Apple put all data of Chinese users on Chinese servers to keep the CCP happy I have no doubt they’re perfectly happy and willing to comply with government requests elsewhere too.
• MayeulC 6y ago
  Hmm, looks like these are just a few nginx rules, they might as well publish those. Internet is a bad fit for this. I wish everyone was using yggdrasil, I2P, tor or something similar. I mean: I could provide as many yggdrasil addresses as I wanted to. It would be possible to setup a few VPNs to connect separate networks (though potentially traceable).
• realducksoft 6y ago
  Here is an interesting discussion: https://github.com/signalapp/Signal-TLS-Proxy/issues/3 https://github.com/signalapp/Signal-TLS-Proxy/issues/3
• leptoniscool 6y ago
  Is there a similar project to help Trump reconnect to twitter? /s
  • xtracto 6y ago
    You say it as a joke but I get sad at seeing all these efforts to circumvent a government policy while another government is allowed to obliterate a same type of service (parcel). As I have said before. I'm not in the US and I don't care about its politics. But I'm scared and hiw easily they can define Good and Bad and then manipulate the internet
• Ericson2314 6y ago
  Doesn't this chip away at the benefits of Signal not being federated? Say the proxies need to be updated?
  • grandchild 6y ago
    Not really. There's not much Signal-protocol-specific technology involved on the proxy, other than dropping traffic that doesn't go towards the Signal server itself.
    • Ericson2314 6y ago
      Fair enough.
• cgb223 6y ago
  Could the Iranian government also run a Signal proxy? Can they then read said proxy traffic since it’s on their machine?
  • NotEvil 6y ago
    No, Nobody even signal can't, that's the whole point of e2e
  • drummer 6y ago
    They could certainly do this, but they would only see which local IP is trying to communicate with Signal (and thus trace the user). The traffic itself is end to end encrypted so they cant read it.
• nrvn 6y ago
  Signal could learn a lot from Telegram in this regard. Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services. They gave up and lifted the ban eventually. https://www.schneier.com/blog/archives/2018/06/russian_censors.html https://www.schneier.com/blog/archives/2018/06/russian_censo...
  • agnosticmantis 6y ago
    I believe telegram itself is blocked in Iran, though.
    • smnrchrds 6y ago
      It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress, Facebook, YouTube, etc. and made their jobs much easier. Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.
      • eternalban 6y ago
        > It is indeed. Iran does not shy away from blocking large swaths of the internet > ran would not hesitate to block all AWS IP addresses as a solution DNS will not resolve any .ir (.coms that are iranian) domains here in US, afaikt.
        • whimsicalism 6y ago
• rthomas6 6y ago
  This is one of the best arguments for federation/decentralization, is it not? It's not impossible to block a protocol, but it's harder than blocking an IP.
  • derbOac 6y ago
    Yeah I was thinking this is awfully close to some kind of federated system. It's not the same but it's pretty close to Signal asking for people to decentralize their service a bit to overcome censorship, which is one of the main arguments for decentralized systems.
• benlivengood 6y ago
  https://github.com/signalapp/Signal-TLS-Proxy/issues/3 https://github.com/signalapp/Signal-TLS-Proxy/issues/3 is the major issue with the current proxy and hopefully it's fixed quickly before a bunch of folks set up a proxy and forget about it.
• isoprophlex 6y ago
  Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing signal/moxie/no federation/whatever... Just spin up a server if you can spare the expense and help some people out. Action > inaction. edit: you can get the connection details via @appliedlambdas on twitter!
  • deleted 6y ago
    [deleted]
  • dijit 6y ago
    How flippant. “Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing hospitals/insurance/medical bankruptcy/whatever... Just donate to a charity if you can spare the expense and help some people out. Action > inaction.” Healthcare and communication aren’t comparable. But my point is that you can criticise institutions for their (contested) faults. If you place yourself on the mantle of non-federation, then availability and censorship resistance are your cross to bear, frankly. The notion that I should help them workaround their architectural failure when it’s been widely criticised (and criticism openly dismissed) multiple times is a little wild.
    • ampdepolymerase 6y ago
      It is not. Healthcare and communications are very much comparable if your life and livelihood are on the line. If the downside risk for both is a dead person then they are very much morally equivalent.
    • isoprophlex 6y ago
      Your neighbor asks you to drive them to the hospital. Do you lecture them on the failures of privatized healthcare? No, you defer your opinion to the relevant place and time. This right now is about people having their access to uncensored communication cut off, and moxie asking people to help out. If you think their architecture is doomed, you're free to codify your opinion somewhere in a pull request or comment under an article about signal's protocol philosophy.
• S53Vflnr4n 6y ago
  Hey Signal, your next contender will be Narendra Modi's Hindu nationalist Indian govt. But Modi is one step ahead, blocked the whole internet in Delhi.
• TimWolla 6y ago
  I created an HAProxy configuration that should be equivalent to the nginx configuration within the Signal-TLS-Proxy repository: https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7235c1 https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7... I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.
  • remram 6y ago
    Their proxy seems to just be nginx, I'm surprised they didn't just share nginx or apache configurations. Most people with a box suitable for running this are probably already running a web server, so there's no reason they should be proxying from their existing web server to this dockerized server which just proxies to Signal. Looking into their repo, they also appear to be building an nginx image from docker.io/ubuntu:20.04 instead of using docker.io/nginx. They are also running two separate nginx processes. I wonder how they ended up with this weird intricate setup. I would be glad to help if they offered straightforward instructions.
    • jlund 6y ago
      The Nginx configs use modules that are not compiled by default, so most preexisting Nginx binaries in mainstream distros won't work.
      • 2cb 6y ago
        This is correct, just set one of these up and it uses extra Nginx plugins. Also the way they’ve done it makes it incredibly easy for anyone who isn’t a tech expert with a web server to still help out with a $5 domain and a $5 VPS. You literally run three commands and it’s done. They want as many people as possible running these so blocking them all is as difficult as possible. It’s the smartest approach to have a low barrier to entry for something like this.
• freakynit 6y ago
  How disgusting these governments have become it pisses me off.
• shervin01 6y ago
  Hi, from Iran with love! First of all, thank you moxie and signal team for this proxy. Until 2018, many Iranians used telegram but Iran's regime after Russia blocked this messenger. telegram released mtproxy and this proxy was helpful. Russia lifted the ban on telegram but this app is still blocked on my country. but with VPNs, many iranians still use this app. after 2018, second most popular messaging app in iran was whatsapp, until facebook's new privacy policy, like all of you, many iranians switch from whatsapp to signal. mullah's regime removed signal app from the iranian app stores and started blocking all signal traffic in the country, but they don't block whatsapp. I'm not a paranoid but it is difficult to understand for me why they didn't block whatsapp after 2018? can they break whatsapp encryption? I have a suggestion for signal team: please put tor in the signal, tor is better than any proxys or vpns.
  • 7357 6y ago
    Love back!
  • toyg 6y ago
    > can they break whatsapp encryption They don’t have to, they just need Facebook to cooperate.
    • k3j45hkj34hkj 6y ago
      I think you mean the phone vendors, as they are the ones holding the unencrypted chat history in the users cloud storage. Facebook themselves do not have access to the chat logs (unless they are compelled to inject keys).
      • 2cb 6y ago
        They could literally have a hidden function in WhatsApp that scoops up all your chat history and sends it to Facebook if the government ask them to. It’s closed source. No one has a clue what it’s doing. To be clear I’m not suggesting this is absolutely happening. I’m merely pointing out it’s entirely possible from a technological perspective given it’s closed source software owned by Facebook. That’s not a recipe for privacy.
• pencilcode 6y ago
  Cloudflare’s warp might help here
• ariosto 6y ago
  This is inspiring. I am going spin one up and also look into contributing to your source code.
• im3w1l 6y ago
  We see again and again that Americans hate freedom of speech. So what is this but a power play? They want people to use controlled platforms where only American-approved activism is allowed. Actions that destabilize an enemy regime. Iranians who use Signal are American proxy forces. By definition it is treason.
  • owl_troupe 6y ago
    Iranians who use Signal are Iranians. Your statement is premised on the Iranian government having absolute authority to surveil the communications of Iranian citizens. By that logic, any from of end-to-end encrypted communication is treason. You might as well say that Iranian citizens have no general right to privacy and any expectation of such is also treason.
    • im3w1l 6y ago
      Signal is American controlled. Encryption in general is not.
• MightyOwl13 6y ago
  Hey, did anyone actually try to run this? I'm getting a bunch of errors when trying to run the sudo docker-compose up --detach. How would I know if it's running or not? Sorry, quite new to this apart from hosting a couple of personal pages on a vps.
  • l1am0 6y ago
    I found that simple apt-get docker does not work for me on debian. Tried the official docker documenation and that helped: https://docs.docker.com/engine/install/debian/ https://docs.docker.com/engine/install/debian/
• s1artibartfast 6y ago
  In light of all the government Internet shut downs in the past years, I’m very curious to see the impact of star link and other Connection methods that might bypass geographic restrictions. Will SpaceX and other service providers shut down access when local governments request it? If not,Will the governments ask on a perceived threat to stability
  • mechnesium 6y ago
    I’m betting hard against a big corporation like SpaceX to do the right thing. By nature, a corporation’s sole purpose is to follow the money and make as much of it as possible. Take a look at Activision/Blizzard bending the knee to China to avoid losing its Chinese user base.
• realducksoft 6y ago
  This proxy failed to be probing resistant. The PoC code is released by studentmain: https://github.com/signalapp/Signal-TLS-Proxy/issues/3#issuecomment-773551167 https://github.com/signalapp/Signal-TLS-Proxy/issues/3#issue...
  • lucb1e 6y ago
    That's the sort of PoC that should be PGP encrypted to the Signal authors instead of publicly posted. Iran will have a field day with it being posted like this. Except, of course, that posting public keys is too 1990s for him https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html (which contains some good arguments but offers no solutions, so whatcha gonna do, post a phone number and trust the signal servers to give you the right public key? That's better than self-published public keys? For an anarchist? Is it smart to post phone numbers publicly anyway, see e.g. SS7?) Perhaps just ignore this paragraph, I'm just a confused person seeing mixed signals.
    • mercora 6y ago
      it is pretty trivial though and an obvious deficit easily visible by just looking at the "code" or nginx config in this case... it is even trivial to come up with this without knowing any of the setups details...
    • junon 6y ago
      They've since deleted the issue, FWIW. Perhaps it was important enough this time ;)
• Jkvngt 6y ago
  What if political dissidents don't want to give their phone numbers to the former head of Twitter security on the eve of President Biden's re-engagement with the Islamic theocracy of Iran?
• hikerclimber 6y ago
  i hope this doesn't work.
• teekert 6y ago
  I'd be happy to run this, but I don't really feel like spreading this (for everyone I know) useless info into my social network (which would be via email for me?) I would gladly sent a link to Signal for my proxy though so they can forward it to people that need it? Hmm, I'm beginning to see the problem now..
  • wheybags 6y ago
    Agreed, I'd happily run a server but I would need some kind of aggregator service to post my proxy on. Surprisingly enough I don't have many contacts in Iran lol
    • teekert 6y ago
      But, I do understand that it is otherwise difficult to reach Iranians and not hand their government a list of urls to block. But I think my reach is useless. If your reach is not, then maybe you'll also reach the Iranian government easily. Moreover, should I run this from my personal server? Could it become a target for nefarious stuff? I feel the same as I do when I think about running a TOR exit node. I want to be like my hero Edward Snowden but... I'm afraid of the stuff that gets associated with my IP address. Also, a https://www.linuxserver.io/ https://www.linuxserver.io/ Docker image would be cool ;)
    • notsureaboutpg 6y ago
      I have contacts in Iran but none of them are having trouble accessing Signal (I'm talking to them with it right now!)
• eatbitseveryday 6y ago
  I do not know anyone in Iran but have spare cash to host a VPS or two. How can I help anyone without broadcasting my proxy for the censors to eventually get ahold of? edit: https://twitter.com/alsdkjflasdkjf1 https://twitter.com/alsdkjflasdkjf1 edit2: You can drop me a mail here, too: jegzc4na8j7@temp.mailbox.org
• elif 6y ago
  I would keep in mind that the US has weird antiterror laws about assisting enemies and also laws which construe bypassing system designs as hacking. For instance, Virgil Griffith is being held and charged for giving a high level description of bitcoin transactions at an academic conference in North Korea. This is incredibly more specific and more technical of an act. https://www.coindesk.com/usa-v-virgil-griffith-what-we-know-and-dont-in-the-bombshell-crypto-sanctions-case https://www.coindesk.com/usa-v-virgil-griffith-what-we-know-...
  • x86ARMsRace 6y ago
    This law is trivially easy to get on the wrong side of. Something like this would be definitely in scope of the anti-terror law you're talking about. American HN users beware.
  • eatbitseveryday 6y ago
    Can someone who is a lawyer comment on this, please? edit: further.. how is Signal shielded (if at all) from providing services to anyone in Iran? Wouldn't they be a target in such a case? The blog post is an explicit call for assistance specifically to do so.
    • iudqnolq 6y ago
      > Executive order 13722, signed by President Donald Trump in 2016, prohibits U.S. persons from exporting services to *North Korea*. Edit: You might find GitHub's description of how they handle this interesting: https://github.blog/2021-01-05-advancing-developer-freedom-github-is-fully-available-in-iran/ https://github.blog/2021-01-05-advancing-developer-freedom-g...
    • nulbyte 6y ago
      Not a lawyer, but details of the sanctions are public[1], including Iran General License D-1 which covers services, software, and hardware incident to personal communications. The license has details for fee based and generally public free-of-charge services. We want Iranians to be free to communicate.[2] [1]: https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information/iran-sanctions https://home.treasury.gov/policy-issues/financial-sanctions/... [2]: https://home.treasury.gov/news/press-releases/sm0322 https://home.treasury.gov/news/press-releases/sm0322
• whalesalad 6y ago
  Where is the 'deploy to heroku' button when you need it
• SandunFernando 6y ago
  The login code you entered doesn't match the one sent to your phone. Please check the number and try again. It looks like you haven't logged in from this browser before. Please enter the login code from your phone below. NOT COMING MY PHONE CODE
• l1am0 6y ago
  While you are on it. There is a similiar easy to use docker-compose file for setting up a tor bridge :) https://community.torproject.org/relay/setup/bridge/docker/ https://community.torproject.org/relay/setup/bridge/docker/
• mr_woozy 6y ago
  Happy to spin up a proxy, but now what? how do I offer it to others for use if I don't use twitter?
• dingoegret 6y ago
  Help undermine security measures taken against seditionists in another country. You don't have to worry about any of the consequences of civil strife because you don't live there. You just get to pretend to be the good guy. Meanwhile a bunch of goofballs protest in D.C and American politicians and tech industry freak out that it's sedition and needs to be mercilessly stamped out. Seditionists wearing hollween costumes. They haven't even begun assassinating scientists and planting bombs in civil buildings yet.
• doublestandard2 6y ago
  It's an irony how American companies try circumvents another country's law (regardless of whether you call it censorship or not, it is still a law) and boast about it. Yet, in the US these companies help the mainstream narrative to enforce censorship by banning (Google and Apple App market) or simply not offering other point of views basic hosting services (AWS). I am an Iranian and don't agree with all of our government actions but I can clearly see a tech neo-colonialism/neo-imperialism here. I am sure Signal's intention and people wanting to help is genuinely good but this does not change this double-standard. I would like to see your supportive reaction if an Iranian company offers hosting to Parler. I imagine you would call it foreign intervention!
  • pre 6y ago
    Well. A Russian company, DDos-Guard, did host Parler in the end didn't they? And sure enough, the FBI is investigating. Signal is a charity rather than a company, but dunno if that makes any actual difference.
  • reactspa 6y ago
    Am honestly not trolling here although it will sound like it: Can someone please explain to me why it's a OK to reconnect Iranians to Signal, but not Trump supporters to Twitter (the ones censored and banned by Twitter)?
    • thw0rted 6y ago
      They're completely unrelated examples. I'll try to explain why. Iran's (authoritarian, human-rights-abusing) government wants to prevent citizens from communicating with each other using tools that are resistant to interception by their secret police. HN supports the basic human right to privacy, and thus wants to help Iranians circumvent unjust laws or government actions. White supremacists (who happen to support Trump, because duh) are being banned by Twitter -- a company, notably distinct from a government, and thus incapable of "censoring" anything. This prevents them from using Twitter's platform to publish hate speech and (arguably illegal, definitely unjust) calls to violence. HN supports the right of a company to decide who can publish content on their platform and agrees that it's cool to tell racists that they aren't welcome there.
• stunt 6y ago
  So their government is blocking Facebook, Twitter, Youtube, Telegram, Signal, BBC, CNN, Netflix, and probably many other social and media platforms. Meanwhile we are blocking Iranians to access Docker, Slack, Gitlab, Google Code, Github(Github until recently), Paypal, Apple Store, Play Store, AWS, Coursera, Adobe, Nvidia, AVG, Avast, Symantec, McAfee, Matlab!!, Oracle and many more. It should be really fun to use Internet in Iran.
  • amir734jj 6y ago
    It is not fun. Trust me. I am an Iranian and I used to sell VPN back in Iran when I was in high school. I had hundreds of users and I was threatened with prosecution and I left the country. Literally everything is blocked except government or university websites. On the positive side, you can Torrent as much as you want or download any music or hack websites and it is completely fine :)
    • Sunspark 6y ago
      I never see Iranian IPs on torrents. Is that because they are all on VPNs?
      • amir734jj 6y ago
        I am not sure. I never had any problem downloading Torrent back then without VPN. I have been living in the U.S. for 12+ years. Things may have changed.
  • 319e82aff522 6y ago
    Spot on! This is the 21st century's version of being born into a poor African American family. Jokes aside it's truely painful. I was lucky to have a job that got me out easily. Though it felt embarrassing when I was seeing everyone uses Docker and AWS extensively at my new job while I had never used them properly not because I wasn't smart enough but just because of where I born :(
  • Siira 6y ago
    Netflix even blocks VPS IPs, to enforce their regional locks or something.
• Thorentis 6y ago
  Well, well. Just a week ago [0] I was lamenting the fact that Signal was too centralised. This comment was made in the context of P2P not being the best solution (due to other privacy issues), but that something in between was needed. When will Signal realise that the centralised approach to hosting is not going to last forever? The code is open source. The server code is supposedly open source, but on closer inspection it is missing some features and is very out of date. The actual server code is clearly still kept close to their chests. There needs to be a way for the same Signal application to, in an emergency, connect to a different server. Perhaps even some form of federation so that once somebody switches server, they can still reach people on a different server if need be. I would absolutely love to see some work done on making a Matrix/Signal hybrid. [0] https://news.ycombinator.com/item?id=25976914 https://news.ycombinator.com/item?id=25976914
• jb775 6y ago
  Ironic how people want to help de-censor what's considered to be an enemy nation (by the media), but are ok with censoring half their next-door neighbors based on politics.
  • Jweb_Guru 6y ago
    Nobody here thinks anyone in the US should be unable to use Signal.
    • andrewzah 6y ago
      ...Until it gets branded as a white supremacist tool for encrypted communications. Call me extremely pessimistic but events like Jan 6. will be used as justification to start attacking applications that offer end-to-end encryption, and encryption in general. Just like 9/11 was used to justify eroding certain civil liberties.
    • jb775 6y ago
      > One employee pointed out that fascists are often quite public about their activities, as the recent insurrection in broad daylight at the Capitol showed https://www.theverge.com/22249391/signal-app-abuse-messaging-employees-violence-misinformation https://www.theverge.com/22249391/signal-app-abuse-messaging... Thanks to olah_1 for this reference
  • olah_1 6y ago
    They’re already discussing what to do when “fascists” (read: Christian rednecks) start posting signal group links. > One employee pointed out that fascists are often quite public about their activities, as the recent insurrection in broad daylight at the Capitol showed https://www.theverge.com/22249391/signal-app-abuse-messaging-employees-violence-misinformation https://www.theverge.com/22249391/signal-app-abuse-messaging...
• gonational 6y ago
  I love how everyone here jumps on this, spread the love and joy for Iran, meanwhile much of the same group of people is perfectly OK with an entire cohort of our population being utterly censored and shunned. Best of all, the same cult will down vote this comment into oblivion, and while doing it they will convince themselves that they are doing it to make this prediction a self-fulfilling prophecy, and then when they read this last part they will then again feel doubly justified. In the end, we all lose because of politics and ignorance. A couple will add a snide and "clever" reply, in order to justify their down vote to themselves and to others. Inside, everyone is lying to themselves, because they know the truth.
• MikeGale 6y ago
  Just remember, Iranian intelligence is no doubt monitoring this discussion.
• secfirstmd 6y ago
  FWIW right now to any Iranian friends on here. We have Umbrella in Persian/Fa now available. It's a massive open source guide to digital and physical security. Everything from how to use Signal to how to deal with arrest. More info: https://www.secfirst.org https://www.secfirst.org. iOS: https://apps.apple.com/us/app/umbrella-security/id1453715310 https://apps.apple.com/us/app/umbrella-security/id1453715310 Android: https://play.google.com/store/apps/details?id=org.secfirst.umbrella https://play.google.com/store/apps/details?id=org.secfirst.u... Web (Beta): https://umbrella.secfirst.org https://umbrella.secfirst.org Github: https://github.com/securityfirst/ https://github.com/securityfirst/
• realducksoft 6y ago
  Signal just closed their issue function there. See here: https://github.com/net4people/bbs/issues/60 https://github.com/net4people/bbs/issues/60
• jagiammona 6y ago
  Noob question: Can a Signal proxy be usefully run on a Raspberry Pi (RP4 ModelB 8GB RAM)?
  • heydabop 6y ago
    > The proxy is extremely lightweight. An inexpensive and tiny VPS can easily handle hundreds of concurrent users. I would bet yes.
    • jagiammona 6y ago
      Thanks for the help!
• cyphar 6y ago
  I know it's too late to engineer this at this point, but maybe Signal should consider adding a built-in Tor client. That way they can take advantage of the many thousands of existing Tor bridges, and Tor has been proven to be pretty effective at censorship resistance over the years...
  • kodablah 6y ago
    I doubt very much it's too late. Tor can be statically compiled into the apps, and assuming Signal is centralized, they can just run their own onion service and otherwise communicate as though they were using TCP.
    • cyphar 6y ago
      I meant that it's too late to solve it for this particular censorship event. You'd need to add a UI for selecting bridges and configuring Tor, all of which is substantially more complicated than just adding support for custom single-hop HTTPS proxies.
• Havoc 6y ago
  Does this potentially proxy other stuff too? I’ve got a couple of idle servers but don’t want mystery stuff proxied. Ie open to other traffic
  • 2cb 6y ago
    It only allows a whitelist of Signal related URLs, nothing else. See here in the code: https://github.com/signalapp/Signal-TLS-Proxy/blob/master/data/nginx-relay/nginx.conf https://github.com/signalapp/Signal-TLS-Proxy/blob/master/da...
• frEdmbx 6y ago
  Is Firechat still around? What other chat solutions allow for local meshnet?
• nojvek 6y ago
  Wow! This is what I call decentralized internet. Where unless Apple can take down the app from the AppStore (we should fight against the monopoly) Signal is hard to censor. Unless Iran totally kills its internet to all. Sure there is the dark side that it could be used to organize crimes and terror, but I think we have to recognize the right to meaningful communication and privacy. Signal gives me hope on the internet of the future.
• signaliscia 6y ago
  biden is trying to do a coup. signal=state dept.
• eatbitseveryday 6y ago
  > §560.204 Prohibited exportation, reexportation, sale, or supply of goods, technology, or services to Iran. > Except as otherwise authorized pursuant to this part, and notwithstanding any contract entered into or any license or permit granted prior to May 7, 1995, the exportation, reexportation, sale, or supply, directly or indirectly, from the United States, or by a United States person, wherever located, of any goods, technology, or services to Iran or the Government of Iran is prohibited, including the exportation, reexportation, sale, or supply of any goods, technology, or services to a person in a third country undertaken with knowledge or reason to know that: > (a) Such goods, technology, or services are intended specifically for supply, transshipment, or reexportation, directly or indirectly, to Iran or the Government of Iran; or > (b) Such goods, technology, or services are intended specifically for use in the production of, for commingling with, or for incorporation into goods, technology, or services to be directly or indirectly supplied, transshipped, or reexported exclusively or predominantly to Iran or the Government of Iran. For US citizens, does helping folks in Iran in this way with a Signal proxy fall under these terms? https://www.ecfr.gov/cgi-bin/text-idx?SID=f384a46ec1b04cc7b2977f1f8c30d2ff&mc=true&node=pt31.3.560&rgn=div5#se31.3.560_1204 https://www.ecfr.gov/cgi-bin/text-idx?SID=f384a46ec1b04cc7b2...
• throwaway122378 6y ago
  Iranian protestors, help American protestors, censor ban deplatform
• rhplus 6y ago
  > Your proxy is now running! You can share your proxy with friends and family using this URL format: https://signal.tube/#<your_domain_name> https://signal.tube/#<your_domain_name> Won't the censors just block DNS for `signal.tube` immediately?
  • GranPC 6y ago
    It looks like the Android app has an intent filter to present itself as an option to handle signal.tube links, so DNS resolution isn't necessary: https://github.com/signalapp/Signal-Android/blob/master/app/src/main/AndroidManifest.xml#L262 https://github.com/signalapp/Signal-Android/blob/master/app/...
• 2Gkashmiri 6y ago
  one question to people here. would you have acted in the same way you are doing now if US govt had banned parler and they wanted people to contribute to keep the service up? for all i know everyone colluded against them and killed them. now, if anyone wanted to help them stay afloat, why did you go after their hosting provider, CDN and payment processors? if helping signal is meaning defying iran, then helping parler would mean defying the US. think about it
  • Cyclone_ 6y ago
    Not exactly the same. Signal is banned by Iranian government, parler was banned by US companies.
    • throwitaway1235 6y ago
      Accurate but a disingenuous concept (not you) because U.S companies are approaching nation state power, i.e Google, Amazon etc.
      • 2Gkashmiri 6y ago
        Yes. Exactly. How do we as outsiders know the us govt isnt doing backchannel deals with faang, even with one is enough to get the ball rolling. Even if thats not the case, my question still stands. If American companies banned parler, why dodgy govt intervene like how it tries to potray a sense of high handedness when it comes to Iran. If the can sanction companies to not serve Iran, cant they force them to serve parler in the first place? If not then they are silently agreeing with faang decision, against free speech
• icare_1er 6y ago
  The future is in initiatives like these... examples here and there show that the internet is way to vulnerable to censorhip (China, Twitter and AWS in the US, Iran, etc...). I hope the push for de-centralized platforms will expand. Well done Signal.
• leveleer323 6y ago
  This is why the mindset that no body will leave whatsapp or social media is very detrimental and erroneous. Even if a few 1000 tech savy users use distributed communication that looks like regular traffic all the time, then when an event like this where governement shuts down all main stream social media happens, people will be forced to learn about distributed communication and mass transformation will happen.
• lstwn 6y ago
  Here is another proxy: https://signal.tube/#langis.lstwn.de https://signal.tube/#langis.lstwn.de
• southerntofu 6y ago
  WTF Signal?! You claim to help users from Iran, however you encourage them to circumvent a government ban by using proxy which redirect trafic based on TLS SNI header, in plaintext?! Maybe you think the Iranian government doesn't have the resources (yet) to log/drop packets based on SNI, however it may well be the case already or soon because that's really not hard to do. You are actively encouraging people to use technology that will reveal to their ISP/government they use Signal despite a government ban. You also force them to use phone numbers, which are uniquely-identifiable and are also advertised publicly in multi-user chats. ARE YOU TRYING TO GET PEOPLE JAILED OR KILLED? If you were really fighting for freedom and the right to legitimate dissent against unfair governments, then you would federate your services so you don't become a central authority who can ban users (SPOF), abandon phone numbers entirely (because they're a security nightmare and publishing them facilitates harassment, a known problem on your platform you have refused to address so far), and use established proxying mechanisms which are less detectable than a plaintext header containing "signal.org" (like Tor).
  • quasirandom 6y ago
    The SNI is encapsulated in an outer layer of TLS, which is removed before forwarding traffic to Signal. That's what nginx-terminate is doing.
    • southerntofu 6y ago
      The header will appear in plaintext between the user and the proxy (easy to detect/log/drop for their ISP/government), and still appear in plaintext between the proxy and Signal (which is less of a problem). The SNI header is not dropped to upstream because it's used whether the reverse proxy is operated by the intended recipient (Signal) or not (the proxy). That's precisely the reason why people have been promoting Encrypted SNI for some time now.
      • quasirandom 6y ago
        It is not true that Signal domains are visible in plaintext on the wire between the user and the proxy. You can spin up the proxy and check yourself. Alternatively, you can ask yourself "why go through the trouble of setting up a legitimate ca-signed certificate if Signal domains are already leaking in plaintext"? The whole point of the ca-signed cert is to make the traffic blend in. Why go through that trouble when a simple regular expression could identify it?
• arendtio 6y ago
  As much as I admire the cause, I can't ignore the irony: First Signal doesn't want to build a federated service because it is too complicated to build (for the guys who brought us a new class of encryption) and now they are asking us for proxy servers because their centralized network can be censored... But since Signal is probably the best option for private communication right now, I don't want anybody to discourage to run a proxy right now.