Hacker News Reader

Comment by paxys | Hacker News Reader

Thing is the VPN service would be subject to the same law, and so the connection would likely still be insecure.

I don't think that's true. If the VPN is compromised then the Signal traffic over it should still be encrypted (that's the point of Signal). As long as the VPN doesn't block your access to Signal you should be fine, and there is no risk the VPN would read your messages.

The connection needs to be secure at least initially when you are exchanging encryption keys.

This is an incredibly complex problem and it really depends on the details. which keys are used, which are pinned. Which keys the government has, and which certificates it can and will issue itself. Which clients it will backdoor, and where will it attempt MITM attack if necessary.

On Signal you're encouraged to verify out-of-band (such as in person) with the "safety number" which allows users to verify each other's keys to prevent a man-in-the-middle attack. This way you'll notice if the initial key exchange has been compromised.

Hmm, okay, so I can drive over to Canada, make a developer friend there, build an instance of the Signal iOS app using the licenses there, load it onto my phone via TestFlight or USB stick, then drive back to the U.S. and use it assuming TSA doesn't touch my phone?

Smuggle the phone back using an electric dirt bike crossing the Canada-US border in the middle of the night, that way the TSA won't bother you.

I guess I should work on my bushwhacking skills.

After you load TestFlight and Signal build onto your phone, make a full encrypted local backup via iTunes.[0] Upload that backup image somewhere. Turn off Find My (iPhone) to disable activation lock. Restore iPhone to factory setttings. Return iPhone to factory sealed box. Optional: mail phone to self at destination or other location of your choosing in destination. Cross border. When at desired use location, unbox phone. Fetch backup you made earlier. Restore backup to iPhone. Use Signal.

[0] https://support.apple.com/guide/itunes/back-up-your-ios-devi...

That sounds much more feasible! I copied and pasted your tip into my notes app. Thanks!

Another tip is that it doesn’t have to be the same phone as far as the backup and restore is concerned. Enrollment of the TestFlight app might be impacted if the phone changes but that’s just my concern because I haven’t tested that part.

Here’s some links related to these ideas which may be relevant to your interests.

https://support.apple.com/en-us/HT208079 iTunes update that allows installing apps

https://www.idownloadblog.com/2015/12/25/how-to-download-old... Charles proxy how to download specific app versions

https://www.reddit.com/r/jailbreak/comments/auabt7/question_... Context for AppAdmin jailbreak tweak which allows for downgrading apps from device via App Store

http://www.i-funbox.com/en/index.html iFunBox lets you backup and install ipa from device via pc or Mac

http://julioverne.github.io/description.html?id=com.juliover... Jailbreak tweak to auto resign apps and install/backup from device

https://support.apple.com/apple-configurator Apple Configurator allows device management and provisioning by your whitelisted macOS devices

But if Signal is end to end encrypted then the VPN being compromised is not a problem.

Signal would be end to "the other side of VPN end" encrypted. The VPN channel itself would have a backdoor and thus defeat the whole point.

If Signal is end to end encrypted (or even just encrypted to a server that has no backdoors) then observing the network traffic towards that server (which is what the compromised VPN would do) wouldn’t help. This is how even “basic” HTTPS remains secure against malicious attackers.

So this would be a complete ban on VPNs? How does that even work? It’s enforceable in Uganda and China, but in the US?

Reply on news.ycombinator.com