5 ms·
That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circ
by sigmar 6y ago
That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way
- windthrown 6y agoCorrect, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
- rzz3 6y agoWhat about Cloudflare?
- capableweb 6y agoAnswer from Cloudflare team seems to be "No" - https://community.cloudflare.com/t/could-cloudflare-support-domain-fronting/200944 https://community.cloudflare.com/t/could-cloudflare-support-...
- hanniabu 6y agoSurprised by that considering their willingness to work with ethereum on resolving .eth domains through .eth.link domains.
- aftbit 6y agoGross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well. We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.
- Craighead 6y agoYes yes, but, when will Verizon and Comcast be broken up?
- jaywalk 6y agoBelieve me, I'm all about reigning in big tech. But I would be 100% against any law that required them to allow domain fronting. It's fine if they want to, but requiring them to basically open up/leave open a hole in their systems is not right.
- praseodym 6y agoProbably malware using domain fronting techniques for C2 traffic played a role in that decision. E.g. https://threatpost.com/apt29-used-domain-fronting-tor-to-execute-backdoor/124582/ https://threatpost.com/apt29-used-domain-fronting-tor-to-exe...
- damnyou 6y agoIn general there are many things that are beneficial when used by good actors and harmful when used by bad actors. That's just the nature of power. I'm really bothered by blanket policies that prevent beneficial uses of a tool because it can also be used to cause harm. Google and Amazon need to figure out how to disambiguate the two.
- hutzlibu 6y agoWhat I recall from the discussion back then is, that domain fronting basically means, that Signal would disguise itself as google or amazon traffic. So I would say, it is understandable, that they decided this is not good for their buisness. So it was not an act by google and amazon to activly harm Signal, but rather canceling ongoing support of Signal, that could put their buisness to harm, which is something different.
- powersnail 6y agoI don't know. In the grand scheme of things, I don't like how much infrastructure technology giants control. In this specific case, however, domain fronting is basically saying "if you want to ban me, you have to ban all of us", without asking if the rest of "us" consent to be put on the same boat. It would be cool if they are, but it's perfectly understandable for them to disagree.
- contravariant 6y agoThere has to be a cleverer way to solve the problem of having several domain names on the same IP than just sending the desired domain name in plaintext.
- 2cb 6y agoAnd this new way, while less convenient, is arguably superior due to its decentralisation. They’re not just going after one service they’re now going after people all around the world running these proxies. Just set one up myself took 15 minutes and that includes setting up a fresh VPS. Just thinking what the best way to share it is.
- birdyrooster 6y agolol i accidentally rented a decent VPS for 30 days in switzerland and now I have a use case for it whoo
- stonesweep 6y agoI've been mulling this over today, as your ability to get the name/IP of the proxy has to be censorship resistant as well. The best idea I've had so far is using a CNAME response to a very common DNS query which would pass a basic filter, like I'd ask for "mail.mydomain.com" and it would respond with a CNAME pointing to the actual proxy. I have dead domains which I have configured with null records for MX and stuff (so spammers can't abuse them), I could hide the name of my proxies in the MX records a CNAMEs and nobody would be the wiser... The trick is getting the word out on how to do it - like "hey everyone, just ask random domains for "mx.domain.com" and use the 30 level MX" or something which would pass as legit traffic. Maybe...
- 2cb 6y agoUsing innocent sounding CNAMEs on abandoned domains is definitely a smart idea. I’ve definitely got some old domains kicking about, I’ll see how far off they are from expiration and do something similar if they have at least a few months left in them. The proxies themselves can also be hosted at normal sounding domains and subdomains like cdn.technology.memes or whatever. And when you point other domains to them as CNAMEs use equally regular looking subdomains no algorithm would pick up as a proxy like webmail.abandoned.tld.
- stonesweep 6y agoThought following yours, I like the CDN idea - if you add in some dynamic DNS updates with random CNAME results it could also help - ask for cdn.example.com, get node182.example.com and 5 minutes later get a different CNAME result injected from some cron job...