4 ms·

What happens when Iran's government itself runs a bunch of these proxies?

IncludeSecurity 6y ago
Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/nginx-relay/Dockerfile https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.
- RL_Quine 6y ago
  That’s awful.
- gspr 6y ago
  I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not). [1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6 https://github.com/signalapp/Signal-TLS-Proxy/issues/6
  - aftbit 6y ago
    They have completely disabled issues on that repository. Wow I used to really like Signal...
    - kelnos 6y ago
      And it seems they've fixed the issue, without any kind of public comment.... still not great: https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97dab729fd705445742c95d5dd77eb62109e8 https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97da...
      - kdunglas 6y ago
        I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2 https://github.com/signalapp/Signal-TLS-Proxy/pull/2), and it looks like they welcome contributions, because they merged mine.
        gspr 6y ago
        Sorry for not noticing your PR before filing the bug. I still find the way they (partially) dealt with this a bit worrisome.
        cryo 6y ago
        Wouldn't it be saner to also verify the downloaded archive hash? It looks like the domain resolving of nginx.org is trusted without doubt.
        kdunglas 6y ago
        Sure! I also opened another PR to check the archive signature: https://github.com/signalapp/Signal-TLS-Proxy/pull/10 https://github.com/signalapp/Signal-TLS-Proxy/pull/10
- sneak 6y ago
  You'd be building and running these outside of Iran for them to work, which would limit the Iranian government's ability to perform the attack you describe.
harg 6y ago
If all the traffic going via the proxies is e2e encrypted is there much that can happen?
- TedDoesntTalk 6y ago
  But the fact that you are in Iran and using Signal may get you added to a watchlist. They can trace the IP addresses connecting to the proxy server back to a household or phone, no?
  - harg 6y ago
    I don't think Iran is as oppressive a regime as you make it out to be. AFIAK the act of using (or attempting to use) Signal is not illegal. The resources required to trace an IP and track down the user simply because they used a messaging app seems unfeasable. Not to mention IP addresses on mobile devices are highly dynamic especially if you're jumping between wifi and cellular. Correct me if I'm wrong but I think in practice it's pretty hard to link IP addresses to actual individuals.
sudosysgen 6y ago
Not much. It's 99% certain that Iran already has the IPs of all Signal users, and they haven't penalized people for using encrypted messaging as of now.

Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as: RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz http://nginx.org/download/nginx-1.18.0.tar.gz https://github.com/signalapp/Signal-TLS-Proxy/blob/master/nginx-relay/Dockerfile https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng... Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.

RL_Quine 6y ago
That’s awful.
gspr 6y ago
I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not). [1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6 https://github.com/signalapp/Signal-TLS-Proxy/issues/6
- aftbit 6y ago
  They have completely disabled issues on that repository. Wow I used to really like Signal...
  - kelnos 6y ago
    And it seems they've fixed the issue, without any kind of public comment.... still not great: https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97dab729fd705445742c95d5dd77eb62109e8 https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97da...
    - kdunglas 6y ago
      I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2 https://github.com/signalapp/Signal-TLS-Proxy/pull/2), and it looks like they welcome contributions, because they merged mine.
      - gspr 6y ago
        Sorry for not noticing your PR before filing the bug. I still find the way they (partially) dealt with this a bit worrisome.
      - cryo 6y ago
        Wouldn't it be saner to also verify the downloaded archive hash? It looks like the domain resolving of nginx.org is trusted without doubt.
        kdunglas 6y ago
        Sure! I also opened another PR to check the archive signature: https://github.com/signalapp/Signal-TLS-Proxy/pull/10 https://github.com/signalapp/Signal-TLS-Proxy/pull/10
sneak 6y ago
You'd be building and running these outside of Iran for them to work, which would limit the Iranian government's ability to perform the attack you describe.

harg 6y ago

If all the traffic going via the proxies is e2e encrypted is there much that can happen?

TedDoesntTalk 6y ago
But the fact that you are in Iran and using Signal may get you added to a watchlist. They can trace the IP addresses connecting to the proxy server back to a household or phone, no?
- harg 6y ago
  I don't think Iran is as oppressive a regime as you make it out to be. AFIAK the act of using (or attempting to use) Signal is not illegal. The resources required to trace an IP and track down the user simply because they used a messaging app seems unfeasable. Not to mention IP addresses on mobile devices are highly dynamic especially if you're jumping between wifi and cellular. Correct me if I'm wrong but I think in practice it's pretty hard to link IP addresses to actual individuals.

sudosysgen 6y ago

Not much. It's 99% certain that Iran already has the IPs of all Signal users, and they haven't penalized people for using encrypted messaging as of now.