7 ms·

This proxy failed to be probing resistant. The PoC code is released by studentmain: https://github.com/signalapp/Signal-TLS-Proxy/issues/3#issuecomment-77355116

• lucb1e 6y ago
  That's the sort of PoC that should be PGP encrypted to the Signal authors instead of publicly posted. Iran will have a field day with it being posted like this. Except, of course, that posting public keys is too 1990s for him https://moxie.org/2015/02/24/gpg-and-me.html https://moxie.org/2015/02/24/gpg-and-me.html (which contains some good arguments but offers no solutions, so whatcha gonna do, post a phone number and trust the signal servers to give you the right public key? That's better than self-published public keys? For an anarchist? Is it smart to post phone numbers publicly anyway, see e.g. SS7?) Perhaps just ignore this paragraph, I'm just a confused person seeing mixed signals.
  • mercora 6y ago
    it is pretty trivial though and an obvious deficit easily visible by just looking at the "code" or nginx config in this case... it is even trivial to come up with this without knowing any of the setups details...
  • junon 6y ago
    They've since deleted the issue, FWIW. Perhaps it was important enough this time ;)