10 ms·

Signal TLS Proxy

145 points by nixcraft 4y ago

cimnine 4y ago
I wonder why they use nginx, and not Caddy or similar. Some service, which would handle all the certificate stuff natively, without having to deal with an extra script for certificates and without having to ensure that certbot runs from time to time.
politelemon 4y ago
Context https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/
- erikkri 4y ago
  Couldn't it be a problem that Iran or someone else with connections to the regime run a proxy themselves to find people using Signal?
  - tus666 4y ago
    Yes. It's always a cat and mouse game. Whether they are actually smart enough to think of it is a different question.
    - ReptileMan 4y ago
      A regime that has survived 40 years facing constant adversary and the majority of time under sanctions should be competent enough at internal security. And the people that are protesting and hurting right now are not the most tech savvy one - so expect a lot of naivete about opsec. I doubt that the majority of them even know signal exists.
  - residualmind 4y ago
    It doesn't seem to be the same situation with tor exit nodes, where your node is automatically on the system. Here, it looks like people have to actively use your proxy; it tells people who run a proxy to share a URL with their friends. Probably helpful context: [Help people in Iran reconnect to Signal – a request to our community] https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/
    - lkuty 4y ago
      And that brings the difficulty of letting your proxy be known to legitimate interested people if your iranian social presence is non-existent. I ran a Tor node (not an exit one) in Germany back in the days (it was to help iranian people).
  - alpha64 4y ago
    They already know people who are trying to access signal without a proxy, so I don't think this would make a significant difference. Also note that from the Signal Blog post above: ---- The Signal client establishes a normal TLS connection with the proxy, and the proxy simply forwards any bytes it receives to the actual Signal service. Any non-Signal traffic is blocked. Additionally, the Signal client still negotiates its standard TLS connection with the Signal endpoints through the tunnel. This means that in addition to the end-to-end encryption that protects everything in Signal, all traffic remains opaque to the proxy operator. ----
- joosters 4y ago
  Thank you! This would be a much better link than the github repo. There are so many project READMEs out there that never bother to explain what the code is or does, it's frustrating.
arianvanp 4y ago
Is there a technical reason why this only works on Android and not iOS?
- RNAlfons 4y ago
  iOS is not widely available/popular in Iran so it shouldn't be a problem here: https://gs.statcounter.com/os-market-share/mobile/iran https://gs.statcounter.com/os-market-share/mobile/iran
- augustl 4y ago
  It works on iOS, you just have to add the proxy manually via settings.
  - reefdog 4y ago
    Could you detail how? Slack/iOS didn't accept my `https://signal.tube/#{redacted} https://signal.tube/#{redacted}` address in the Proxy Address field. Do I just enter my server's IP address? I know Android is much more popular in Iran, but I wanted to give my friends instructions for both platforms, just in case.
    - reefdog 4y ago
      Oh, lol, you just enter your domain name as the proxy address. Neat! (Or you just click that URL and it bounces you into the Signal app. I assume the only different between the iOS and Android versions here is that the Android version can capture that request before it goes to the browser, which is probably more secure from a government/firewall perspective.)
- bjord 4y ago
  just a guess, but maybe it has something to do with the fact that the link is never actually handled externally? as in, the signal.tube domain is never resolved, it may as well just be a string
asim 4y ago
Trying to understand the rationale here. So Iran are blocking WhatsApp and other messaging services by blacklisting IPs or filtering the traffic? Is the idea that people will connect to random proxy nodes for signal that will circumvent this blocking? Edit: as a follow up question. Do the people of Iran need messaging access to people outside of Iran or more likely their friends and family within Iran. Most of these messaging services are centralised so blocking them means cutting off communication within the country as well. Maybe they'd benefit from running private messaging servers themselves?
- gsatic 4y ago
  Yup family or friends abroad can run the proxy. Its not straightforward for govt to find the proxies if their addresses are privately shared.
  - asim 4y ago
    How do you tell them the proxy exists?
    - Dobbs 4y ago
      This is discussed in the blog post (which probably should have been linked instead of the git repo) https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/
      - asim 4y ago
        I think that just sort of says, hey share this signal.tube link or use a hashtag on a public channel like Twitter. When they say DM or use a private channel to distribute it my question is, what are those channels? What if those are also blocked?
jhoelzel 4y ago
maybe this is a moot question, but if there is an embargo on iran and you host a proxy like that, are you, as an american, not commiting a crime? The way I understand it people need special licenses in order to operate in iran (meta) and therfore the probability of being sued is very high?
- killingtime74 4y ago
  Usually legal jurisdiction goes with geography. There are Exceptions (crimes against humanity, sex tourism things). If you host it outside Iran and you are outside Iran, then it’s just a theoretical crime? extra territorial example: it may be a crime to do things/speak ill of a foreign government. If you lived there you’d get arrested. What if you did this while sitting in your bedroom overseas?
  - Dobbs 4y ago
    This doesn't seem accurate. US Citizens/Residents/People who travel into the US who do many types of business with Iran can get into legal trouble. The person you are responding to is asking if that would apply here.
    - killingtime74 4y ago
      Ah in that situation, your trouble would be with the Iranian government when you travel back to Iran? Of course countries can generally pass laws that do anything (they can execute people no?). In western legal tradition extra territoriality is reserved for special situations. In places like Iran where the rule of law is weak it does not apply. But then in that sense Iran can do whatever it wants once they get their hands on you, laws or not
      - asdfaoeu 4y ago
        They are saying American law prohibits it.
  - sofixa 4y ago
colordrops 4y ago
Why didn't this come out when China blocked Signal? And what is Signal doing about China blocking Signal's phone verification system? Can't talk to my parents-in-law in China now without installing that spyware WeChat.
- Dobbs 4y ago
  Signal seems to have had the proxy for a while. I'm guessing that China blocked them, they started developing this, released it, Iran blocked them, they signal boost this feature off the back of the second blockage.
- imdsm 4y ago
  I mean, unfair to put expectations on Signal to solve problems (especially right away). It could be that the solution didn't occur to someone until recently.
  - colordrops 4y ago
    They've had years to get rid of of needing a phone number and they've talked about it for years. It's arguably a bigger issue for many that internet blocking, as that can be trivially worked around with a VPN or proxy.
macns 4y ago
Why do I need Docker for such a simple task? From their blog: > The proxy is extremely lightweight. An inexpensive and tiny VPS can easily handle hundreds of concurrent users. Here’s how to make it work: SSH into the server. Install Docker, Docker Compose, and git: I'm sorry but installing Docker on a tiny VPS last time I checked wasn't any light at all.
- tsujamin 4y ago
  pretty sure you can run docker on a $5 vps with plenty of headroom left could it be done leaner? sure is it worth it if it raises the barrier of entry of getting people to run the proxy? doubtful
  - hosteur 4y ago
    A single statically linked binary would not raise the barrier of entry. Quite the opposite.
    - sofixa 4y ago
      But you also need to provide a systemd service for it. And statically linked against glibc or musl?
      - monocasa 4y ago
        you need to provide a systemd service for a docker image as well, the restrt policies leave a lot to be desired for a host that itself can restart. glibc doesn't support static linking, so it's probably going to be musl. Running a musl binary on an otherwise glibc system isn't an issue.
    - franga2000 4y ago
      What if you're running on an ARM VPS? Now there are 2 binaries. What if you're running e.g. Alpine? Now you need 4. Which init system do you provide startup scripts for? You need an install script too. And what if you just want to try it on your Windows/Mac computer? Need to manually set up a VM. Meanwhile, you can just install Docker, which you might already have if you do self-hosting often, and run one command. The overhead of containers is tiny, so you really won't notice it. Bonus points for using Podman, which doesn't even have a daemon.
autoexec 4y ago
If people in Iran could find themselves in trouble for using Signal I'd strongly advise they avoid it and look for some other solution. Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using Signal) it's become much more dangerous for people who want to protect themselves and the people they are in contact with. Because Signal insists on keeping your contacts in the cloud it's possible in some cases for someone to collect a list of your contacts simply by brute forcing a 4 digit pin. It would be horrible to end up in trouble or see your friends and family hurt because Signal wasn't forthcoming about the fact that they were collecting your info and keeping it on their servers.
- croes 4y ago
  >Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using Signal. Since when?
  - autoexec 4y ago
    It was a long time ago. If you're a signal user and you're only hearing about this now, that should tell you all you need to know about how trustworthy the service is. There were a lot of users upset about it at the time (myself included), but their protests went largely ignored. Tellingly, they've refused to update their privacy policy to reflect their new data collection practices. Personally, I take that as a huge dead canary. https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-...
- chekibreki 4y ago
  That’s some lazy FUD. But even if that were true and the contacts weren’t encrypted and PIN entry not rate limited: What do you propose as an alternative?
xorcist 4y ago
I know this tiresome argument comes up every time Signal is mentioned, but there's an elephant there that seems relevant. An totalitarian state would not need to run a packet inspecting firewall to find out who is using Signal. They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users. It is most likely in their power to turn off cell service for these endpoints, or even locate them and let the security service round them up. It's a great service in many ways, but if you are revolting an authoritarian state, it's something to be careful of. At the very least, please be mindful of this and take care of yourself.
- Tepix 4y ago
  The state probably knows who signed up to use Signal, Whatsapp, Viber or some other service back when it was legal to do so. So what?
- keewee7 4y ago
  Signal has 100 million installs on Android alone. Arresting people for having Signal installed is not a scalable approach for a totalitarian state.
  - deleted 4y ago
    [deleted]
  - turminal 4y ago
    No, but banning them from the cell network is.
    - zikduruqe 4y ago
      Then you can go off network... https://berty.tech https://berty.tech
      - NaughtyShiba 4y ago
        Messaging over… Bluetooth?
breakingcups 4y ago
Does starting the proxy automatically add it to some proxy list that gets (partially) distributed to users or does running a proxy like this only help if I distribute the proxy to people? Would some network analysis then not clearly indicate the social graph of people by virtue of connecting the dots of who connects to which proxy domain?
- augustl 4y ago
  You have to distribute it yourself, there's no automatic distribution on Signal's part.
windexh8er 4y ago
As a slight aside one would think that running a proxy you'd want to install Docker so you're getting the latest bits. Considering compose is now a plugin and base repos are often way behind on Docker versions I always point people to leverage the convenience script that Docker provides [0]. [0] https://get.docker.com https://get.docker.com
Lurkars 4y ago
Can anyone here give quick example how would how this on a server already having Apache on port 80 and 443? Can this be proxies through Apache?
throwsignal251 4y ago
used https://freedns.afraid.org/ https://freedns.afraid.org/ to create a dns record and then followed the signal guide on rocky linux 8 with podman and podman-compose (requires some tuning). hope this might help someone: https://signal.tube/#testnotest.mooo.com https://signal.tube/#testnotest.mooo.com

145 points by nixcraft 4y ago

I wonder why they use nginx, and not Caddy or similar. Some service, which would handle all the certificate stuff natively, without having to deal with an extra script for certificates and without having to ensure that certbot runs from time to time.

politelemon 4y ago

Context https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/

erikkri 4y ago
Couldn't it be a problem that Iran or someone else with connections to the regime run a proxy themselves to find people using Signal?
- tus666 4y ago
  Yes. It's always a cat and mouse game. Whether they are actually smart enough to think of it is a different question.
  - ReptileMan 4y ago
    A regime that has survived 40 years facing constant adversary and the majority of time under sanctions should be competent enough at internal security. And the people that are protesting and hurting right now are not the most tech savvy one - so expect a lot of naivete about opsec. I doubt that the majority of them even know signal exists.
- residualmind 4y ago
  It doesn't seem to be the same situation with tor exit nodes, where your node is automatically on the system. Here, it looks like people have to actively use your proxy; it tells people who run a proxy to share a URL with their friends. Probably helpful context: [Help people in Iran reconnect to Signal – a request to our community] https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/
  - lkuty 4y ago
    And that brings the difficulty of letting your proxy be known to legitimate interested people if your iranian social presence is non-existent. I ran a Tor node (not an exit one) in Germany back in the days (it was to help iranian people).
- alpha64 4y ago
  They already know people who are trying to access signal without a proxy, so I don't think this would make a significant difference. Also note that from the Signal Blog post above: ---- The Signal client establishes a normal TLS connection with the proxy, and the proxy simply forwards any bytes it receives to the actual Signal service. Any non-Signal traffic is blocked. Additionally, the Signal client still negotiates its standard TLS connection with the Signal endpoints through the tunnel. This means that in addition to the end-to-end encryption that protects everything in Signal, all traffic remains opaque to the proxy operator. ----
joosters 4y ago
Thank you! This would be a much better link than the github repo. There are so many project READMEs out there that never bother to explain what the code is or does, it's frustrating.

arianvanp 4y ago

Is there a technical reason why this only works on Android and not iOS?

RNAlfons 4y ago
iOS is not widely available/popular in Iran so it shouldn't be a problem here: https://gs.statcounter.com/os-market-share/mobile/iran https://gs.statcounter.com/os-market-share/mobile/iran
augustl 4y ago
It works on iOS, you just have to add the proxy manually via settings.
- reefdog 4y ago
  Could you detail how? Slack/iOS didn't accept my `https://signal.tube/#{redacted} https://signal.tube/#{redacted}` address in the Proxy Address field. Do I just enter my server's IP address? I know Android is much more popular in Iran, but I wanted to give my friends instructions for both platforms, just in case.
  - reefdog 4y ago
    Oh, lol, you just enter your domain name as the proxy address. Neat! (Or you just click that URL and it bounces you into the Signal app. I assume the only different between the iOS and Android versions here is that the Android version can capture that request before it goes to the browser, which is probably more secure from a government/firewall perspective.)
bjord 4y ago
just a guess, but maybe it has something to do with the fact that the link is never actually handled externally? as in, the signal.tube domain is never resolved, it may as well just be a string

asim 4y ago

Trying to understand the rationale here. So Iran are blocking WhatsApp and other messaging services by blacklisting IPs or filtering the traffic? Is the idea that people will connect to random proxy nodes for signal that will circumvent this blocking? Edit: as a follow up question. Do the people of Iran need messaging access to people outside of Iran or more likely their friends and family within Iran. Most of these messaging services are centralised so blocking them means cutting off communication within the country as well. Maybe they'd benefit from running private messaging servers themselves?

gsatic 4y ago
Yup family or friends abroad can run the proxy. Its not straightforward for govt to find the proxies if their addresses are privately shared.
- asim 4y ago
  How do you tell them the proxy exists?
  - Dobbs 4y ago
    This is discussed in the blog post (which probably should have been linked instead of the git repo) https://signal.org/blog/run-a-proxy/ https://signal.org/blog/run-a-proxy/
    - asim 4y ago
      I think that just sort of says, hey share this signal.tube link or use a hashtag on a public channel like Twitter. When they say DM or use a private channel to distribute it my question is, what are those channels? What if those are also blocked?

jhoelzel 4y ago

maybe this is a moot question, but if there is an embargo on iran and you host a proxy like that, are you, as an american, not commiting a crime? The way I understand it people need special licenses in order to operate in iran (meta) and therfore the probability of being sued is very high?

killingtime74 4y ago
Usually legal jurisdiction goes with geography. There are Exceptions (crimes against humanity, sex tourism things). If you host it outside Iran and you are outside Iran, then it’s just a theoretical crime? extra territorial example: it may be a crime to do things/speak ill of a foreign government. If you lived there you’d get arrested. What if you did this while sitting in your bedroom overseas?
- Dobbs 4y ago
  This doesn't seem accurate. US Citizens/Residents/People who travel into the US who do many types of business with Iran can get into legal trouble. The person you are responding to is asking if that would apply here.
  - killingtime74 4y ago
    Ah in that situation, your trouble would be with the Iranian government when you travel back to Iran? Of course countries can generally pass laws that do anything (they can execute people no?). In western legal tradition extra territoriality is reserved for special situations. In places like Iran where the rule of law is weak it does not apply. But then in that sense Iran can do whatever it wants once they get their hands on you, laws or not
    - asdfaoeu 4y ago
      They are saying American law prohibits it.
- sofixa 4y ago

colordrops 4y ago

Why didn't this come out when China blocked Signal? And what is Signal doing about China blocking Signal's phone verification system? Can't talk to my parents-in-law in China now without installing that spyware WeChat.

Dobbs 4y ago
Signal seems to have had the proxy for a while. I'm guessing that China blocked them, they started developing this, released it, Iran blocked them, they signal boost this feature off the back of the second blockage.
imdsm 4y ago
I mean, unfair to put expectations on Signal to solve problems (especially right away). It could be that the solution didn't occur to someone until recently.
- colordrops 4y ago
  They've had years to get rid of of needing a phone number and they've talked about it for years. It's arguably a bigger issue for many that internet blocking, as that can be trivially worked around with a VPN or proxy.

macns 4y ago

Why do I need Docker for such a simple task? From their blog: > The proxy is extremely lightweight. An inexpensive and tiny VPS can easily handle hundreds of concurrent users. Here’s how to make it work: SSH into the server. Install Docker, Docker Compose, and git: I'm sorry but installing Docker on a tiny VPS last time I checked wasn't any light at all.

tsujamin 4y ago
pretty sure you can run docker on a $5 vps with plenty of headroom left could it be done leaner? sure is it worth it if it raises the barrier of entry of getting people to run the proxy? doubtful
- hosteur 4y ago
  A single statically linked binary would not raise the barrier of entry. Quite the opposite.
  - sofixa 4y ago
    But you also need to provide a systemd service for it. And statically linked against glibc or musl?
    - monocasa 4y ago
      you need to provide a systemd service for a docker image as well, the restrt policies leave a lot to be desired for a host that itself can restart. glibc doesn't support static linking, so it's probably going to be musl. Running a musl binary on an otherwise glibc system isn't an issue.
  - franga2000 4y ago
    What if you're running on an ARM VPS? Now there are 2 binaries. What if you're running e.g. Alpine? Now you need 4. Which init system do you provide startup scripts for? You need an install script too. And what if you just want to try it on your Windows/Mac computer? Need to manually set up a VM. Meanwhile, you can just install Docker, which you might already have if you do self-hosting often, and run one command. The overhead of containers is tiny, so you really won't notice it. Bonus points for using Podman, which doesn't even have a daemon.

autoexec 4y ago

If people in Iran could find themselves in trouble for using Signal I'd strongly advise they avoid it and look for some other solution. Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using Signal) it's become much more dangerous for people who want to protect themselves and the people they are in contact with. Because Signal insists on keeping your contacts in the cloud it's possible in some cases for someone to collect a list of your contacts simply by brute forcing a 4 digit pin. It would be horrible to end up in trouble or see your friends and family hurt because Signal wasn't forthcoming about the fact that they were collecting your info and keeping it on their servers.

croes 4y ago
>Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using Signal. Since when?
- autoexec 4y ago
  It was a long time ago. If you're a signal user and you're only hearing about this now, that should tell you all you need to know about how trustworthy the service is. There were a lot of users upset about it at the time (myself included), but their protests went largely ignored. Tellingly, they've refused to update their privacy policy to reflect their new data collection practices. Personally, I take that as a huge dead canary. https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-...
chekibreki 4y ago
That’s some lazy FUD. But even if that were true and the contacts weren’t encrypted and PIN entry not rate limited: What do you propose as an alternative?

xorcist 4y ago

I know this tiresome argument comes up every time Signal is mentioned, but there's an elephant there that seems relevant. An totalitarian state would not need to run a packet inspecting firewall to find out who is using Signal. They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users. It is most likely in their power to turn off cell service for these endpoints, or even locate them and let the security service round them up. It's a great service in many ways, but if you are revolting an authoritarian state, it's something to be careful of. At the very least, please be mindful of this and take care of yourself.

Tepix 4y ago
The state probably knows who signed up to use Signal, Whatsapp, Viber or some other service back when it was legal to do so. So what?
keewee7 4y ago
Signal has 100 million installs on Android alone. Arresting people for having Signal installed is not a scalable approach for a totalitarian state.
- deleted 4y ago
  [deleted]
- turminal 4y ago
  No, but banning them from the cell network is.
  - zikduruqe 4y ago
    Then you can go off network... https://berty.tech https://berty.tech
    - NaughtyShiba 4y ago
      Messaging over… Bluetooth?

breakingcups 4y ago

Does starting the proxy automatically add it to some proxy list that gets (partially) distributed to users or does running a proxy like this only help if I distribute the proxy to people? Would some network analysis then not clearly indicate the social graph of people by virtue of connecting the dots of who connects to which proxy domain?

augustl 4y ago
You have to distribute it yourself, there's no automatic distribution on Signal's part.

windexh8er 4y ago

As a slight aside one would think that running a proxy you'd want to install Docker so you're getting the latest bits. Considering compose is now a plugin and base repos are often way behind on Docker versions I always point people to leverage the convenience script that Docker provides [0]. [0] https://get.docker.com https://get.docker.com

Lurkars 4y ago

Can anyone here give quick example how would how this on a server already having Apache on port 80 and 443? Can this be proxies through Apache?

throwsignal251 4y ago

used https://freedns.afraid.org/ https://freedns.afraid.org/ to create a dns record and then followed the signal guide on rocky linux 8 with podman and podman-compose (requires some tuning). hope this might help someone: https://signal.tube/#testnotest.mooo.com https://signal.tube/#testnotest.mooo.com