Help users in Iran reconnect to Signal
signal.org
signal.org
First of all, thank you moxie and signal team for this proxy.
Until 2018, many Iranians used telegram but Iran's regime after Russia blocked this messenger. telegram released mtproxy and this proxy was helpful. Russia lifted the ban on telegram but this app is still blocked on my country. but with VPNs, many iranians still use this app. after 2018, second most popular messaging app in iran was whatsapp, until facebook's new privacy policy, like all of you, many iranians switch from whatsapp to signal. mullah's regime removed signal app from the iranian app stores and started blocking all signal traffic in the country, but they don't block whatsapp. I'm not a paranoid but it is difficult to understand for me why they didn't block whatsapp after 2018? can they break whatsapp encryption?
I have a suggestion for signal team: please put tor in the signal, tor is better than any proxys or vpns.
Regarding Tor: if you want a Signal-like app that uses an onion router look at Session. [2]
It uses the same encryption protocol and very similar UI to Signal but routes all traffic through the Loki network so your traffic passes through three nodes. It is an onion network like Tor.
One other benefit of Session is the lack of metadata inherent to its design. No phone numbers or even usernames are attached to your account. You get a set of characters that looks similar to a bitcoin address and a QR code to make sharing it easier.
Of course this lacks the convenience of Signal but it’s as hard to block as Tor.
1. An associated crypto-currency (not outright bad but weird smell IMO) [1]
2. Abandoned perfect forward secrecy and deniability [2]
3. Never completed an audit (though supposedly one is in progress) [3]
There are a million and one encrypted chat programs out there. Why should I use this one?
[1]: https://github.com/oxen-io/oxen-mobile-wallet
[2]: https://getsession.org/session-protocol-technical-informatio...
The lack of metadata is also quite a unique selling point in my eyes. There’s a million encrypted messengers now sure. How many automatically connect through an onion router with zero config required and don’t require you to create an account at all, but instead assign you a random ID disconnected entirely from your phone number, email, and other personal identifiers?
It’s certainly an option to consider is the only thing I’m saying. Tor was mentioned so Session popped into my head for the reasons mentioned above.
Regarding PFS. They currently implement the Signal Protocol. Session is of course FOSS so anyone can check this. Your source does say they’re planning to fork it as the Session Protocol later this year so it integrates with their network more easily. But that’s an upcoming, unfinished project. To be honest I don’t know much about it as it’s still in development. I do know that currently Session uses the Signal Protocol through an onion router without the need to so much as create an account.
And yes the network itself is a bit of a convoluted idea that tries to do many things at once, but the fact they run on a blockchain means they already have a lot of nodes set up in different countries around the world through which to route traffic, and the reason they could build a decentralised network quite quickly despite being a relatively young project is they incentivise those node operators with cryptocurrency.
Because it is a young project they are still undergoing audit yes. This is absolutely something worth noting. It’s a relatively new project. It’s no longer in beta, but nowhere near as well established as Signal. However it’s precisely because of this it’s unlikely governments are bothering to target it yet.
Regarding your footnote #2 about PFS, it said this (among other things).
> In some theoretical scenarios, these properties do protect users; however the utility of these protections in real-world scenarios is often more limited in scope than might be expected. We must also consider that these safeguards are offered at the expense of additional complexity, decreased account portability, and multi-device limitations. These protocols were simply not designed to be run over a decentralised network.
I have to say, I’ve considered the utility of it myself. It seems to me that I’m far, far more likely to have my chats compromised through my chats being stored in plain text on my devices than in a technical scenario that PFS could have prevented. What do you think?
I suspect that is the future for encrypted messaging. Pretty much everyone ends up keeping their old messages around thus negating the value of forward secrecy[1]. Deniability ends up being just some forgability scheme in most cases[2].
So the benefit of those features turned out to not be worth the extra risk of the added complexity.
[1]: https://articles.59.ca/doku.php?id=pgpfan:forward_secrecy
[2]: https://articles.59.ca/doku.php?id=pgpfan:repudiability
Also, Session is promoted as a non-profit project, but following links around about LokiNet and Oxen you find out about a blockchain-based cryptocurrency, which is known to be an anti-pattern on many levels (though they use Proof-of-Service not Proof-of-Work which is slightly less worse).
Finally, Session appears to be free-software (good), but is not distributed on F-Droid, the only privacy/security-friendly app store for Android. They encourage you to download random APKs from Google Play (which requires Google Play Services malware and a google account) or Github (owned by Microsoft, though i note they sign checksums with PGP on Github so it's safer to download from there than Google Play, even though they don't provide instructions on how to verify signatures). On F-Droid, they could either have F-Droid build/distribute the package with Fdroid's PGP key, or open their own F-Droid repo with their own PGP key (like Newpipe did), or both.
I really appreciate their communication around dissent and the need to protect communications to help the people against their governments. However these three points i just noted are really shady to say the least. I understand they need to please investors to put money in their fridges, however trying to mix for-profit incentives with non-profit services to the communities is always a dead-end.
They don’t have to, they just need Facebook to cooperate.
To be clear I’m not suggesting this is absolutely happening. I’m merely pointing out it’s entirely possible from a technological perspective given it’s closed source software owned by Facebook. That’s not a recipe for privacy.
Not saying this happens, one possibility can always be to send encrypted traffic to WhatsApp servers while opening a second unencrypted channel to govt servers if a govt asks for it.
This proxy arrangement is better because folks who start them tell their friends in Iran, who tell their friends, but it isn't listed publicly, like most Tor entry nodes are. When the authorities find a proxy and block it, they only disconnect a subset of Signal users, who hopefully have other proxies they've learned from other friends or friends-of-friends. So now the blocking is trying to put out a thousand small fires that they have to find one-by-one.
<I have consulted for the Signal Foundation in the past, but not recently and haven't talked with anyone there about this>
If you can help share more proxies to people who need them, please send me an email (in my HN profile).
I don't remember what it's called, but I think the app is official by the Tor devs and basically makes a local VPN that your phone connects to and then forwards all traffic through Tor. It was on F-Droid last time I checked.
Can you explain this?
Let's say you use the Tor browser to browse some regular (non-Tor) site that is illegal in your country for whatever reason. But let's say you then remember you still haven't paid your taxes so you open a new tab and quickly go do that. But you're still in the Tor browser, so your e-banking traffic is going out the same exit node as your "illegal" traffic. Now, anyone that saw both of those things come out of the same node can conclude that it's somewhat likely both were done by the same person. If that someone is the government, they can get access logs from your bank and see which account was accessed by the exit node's IP. The more times you do this, the stronger the link between you personally and the illegal site is.
Of course, doing your taxes through the same Tor session is something most people would know to not do, but if your entire device is tunneled through Tor, you no longer have a say in what data it leaks. Your banking app probably sends requests periodically in the background to check for updates or whatever, your email client syncs your emails, etc. If any one of those services can be coerced by your government (and chances are they can) then whatever illegal things you do in that session can be loosely linked to you. I say loosely, because there are many people on one exit node, but the data points start adding up after a while (and depending on the insanity of your leaders, just being on the list of candidates might be enough to disappear you).
As for how they would get that metadata in the first place, there are a few ways. The exit node might be under their jurisdiction, but since we're talking about bypassing censorship, it certainly isn't. They could also have compromised the "illegal" server (hacked/coerced/honeypot...), in which case it's just a matter of cross-referencing the site's logs with anything they can get their hands on (and if the government is authoritarian enough, they probably already have access to a lot). The last option is compromising the exit node, which is also not impossible. There's nothing stopping your government from setting up a thousand Tor exit nodes and logging all the metadata. If you're constantly running Tor, chances are you land on one of their exit nodes eventually.
DISCLAIMER: the above was probably a bit too paranoid, but as I have zero experience hiding from an authoritarian government, I'm not in a position to judge how much paranoia is justified. It's entirely possible that none of this applies because your specific adversary doesn't employ these specific de-anonymization tactics, but that is something you need to know for your specific situation. I assumed an "everything is fucked" threat model here, but yours might not be as severe and other types of mitigations might be more appropriate.
But maybe so many people in Iran use Tor that it's not very outstanding to use it? I remember there were stats on that published on the Tor Project Website...
Edit: To answer myself after 5 minutes of thinking: Of course there are bridges, too. I guess they don't appear as suspicous as regular entry nodes?
You can get a tor proxy for Android at
Caddy has a secure forward proxy plugin born out of a research project at Google that does something similar, but works with any clients that let you configure HTTP proxies, and doesn't terminate TLS: instead it tunnels it over TLS. The proxy server itself can also be probe-resistant, i.e. difficult to detect that a website is acting as a proxy.
I'm hoping more people can help test the patch to support Caddy v2: https://github.com/caddyserver/forwardproxy/pull/74
(Edit: Disclaimer - Don't use this in situations where your personal safety or freedom could be at risk... not yet. Not until more people with more experience can vet its implementation for bugs, and a very clear threat profile can drawn up. If you have experience with this, we'd love your help.)
>Don't use this in situations where your personal safety or freedom could be at risk
https://theintercept.com/2020/12/06/kashmir-social-media-pol... https://thewire.in/media/kashmir-journalist-auqib-javeed-pol...
reason why i have a general disregard for technologies that are based on some sort of "link" AFK, phone number or the stupid facebook real name policy. this is as of today being used to crack down on dissent. what you are saying is true but https://thenextweb.com/in/2020/01/08/kashmirs-police-want-pe... when you have your govt do this, how can you keep your signal account private? your phone is already listed. isnt it? cant the police see if you are on signal and if online means you are bypassing them somehow regardless of what you might be saying?
No, it's pretty good. Think about it: all DPIs can see is an ordinary https connection. Since the traffic itself is encrypted, to discriminate this from normal web browsing the DPI device can only depend on metadata. Classic moves are:
1. Packet length pattern for TLS-in-TLS. 2. TLS fingerprinting.
The first could be defeated by adding padding to the first few packets of each of your connections. [1]
The second.. someone built a socks5 <-> https CONNECT proxy client [2] out of Chrome's codebase, which means it shares all the fingerprint with Chrome and you really can't tell.
[1] https://github.com/klzgrad/forwardproxy/commit/2350f380f8db2... [2] https://github.com/klzgrad/naiveproxy
Note that TLS over TLS is _not_ the same thing as TCP over TCP. TCP over TCP is usually only a problem for VPNs or something similar (i.e. anything that sends raw IP packets over TCP).
Yet, in the US these companies help the mainstream narrative to enforce censorship by banning (Google and Apple App market) or simply not offering other point of views basic hosting services (AWS).
I am an Iranian and don't agree with all of our government actions but I can clearly see a tech neo-colonialism/neo-imperialism here. I am sure Signal's intention and people wanting to help is genuinely good but this does not change this double-standard.
I would like to see your supportive reaction if an Iranian company offers hosting to Parler. I imagine you would call it foreign intervention!
This is a hacker forum and not a US foreign ministry praise board, even though it is mainly US based. In other words, I doubt the reaction here would be rage, if a iranian company would do that. Hackers usually are not in favor of censorship or information restriction.
So who do you mean, with "you"?
There are many comments on previous HN threads defending censorship and information restriction, precisely as the GP has described it.
https://news.ycombinator.com/item?id=25693742
https://news.ycombinator.com/item?id=25691631
Rather the contrary. Anyway, by my tautological definition of hacker, no hacker would be in favor of banning a communication app, anyway, so ...
I agree I could have said it more clearly and less emotionally.
Why THESE companies? Where did Signal do this? Or are all US companies the same entity to you?
In this simplistic viewpoint, issues in 3rd world countries (even this naming is condescending) are assumed to be evident. In this case an evil government versus oppressed people who can not even communicate with each other freely. So 'we' good people must help these poor people against their oppressive government.
This is in contrast to a much more nuanced view of the issues in the west. End-to-end encryption is a debated issue in the US and EU and legislators have proposed laws to ban it or enforcing other mechanisms to circumvent by law enforcement such as backdoors.
I mentioned the US as an example, because of Signal is operating under US jurisdiction. Moreover, the recent events in the US demonstrated that how a supposedly stable democracy is vulnerable to chaos. In this situation the tech companies decided to limit the communication of people or access to their platform for the greater good (according to them). I am not stating whether this is good or bad. I just want to point out that the issue is complex, nuanced and needs debate in the society. Keep in mind that the US is a superpower surrounded by two oceans and two friendly countries and has no serious external threat.
This is in contrast to Iran which is in a chaotic region and surrounded by the US military bases. It has suffered wars and coup in its recent history. It is currently under harsh economic sanctions with a possible goal of people revolting. The Iranian government has reasons to be paranoid and fearful that Signal can be used to organize violent demonstration. They cannot even demand information regarding criminal cases such as drug trafficking from these tech companies.
In the US the decision of giving access to tools and platforms is out-sourced to companies but in most part of the world governments make these kind of policies (again not necessarily good or bad).
I don't have a solution to these problems and I am not trying to say that we have an equivalence here. What I am expecting is a more nuanced and sophisticated perspective toward the issue.
It looks to me like you try to cloud your false argument in whataboutisms based upon a profound lack of knowledge:
> I mentioned the US as an example, because of Signal is operating under US jurisdiction.
The reason Signal is a good way to go is because this doesn't matter. Signal doesn't save any conversations they can hand over to the US (or other) government.
> This is in contrast to Iran which is in a chaotic region and surrounded by the US military bases.
Yeah, yeah I get it. We all do. US = bad but how does it change anything for the oppressed people in Iran we can help here? If those would have been people in the US, we'd be doing the same thing for them here in the EU.
> What I am expecting is a more nuanced and sophisticated perspective toward the issue.
A whataboutism and derailment of the issue is neither nuanced nor sophisticated. It's quite shady and ignorant.
Here is something you can do to help people out but instead of doing that, you try to build some weird case which actually helps the Iranian government.
And sure enough, the FBI is investigating.
Signal is a charity rather than a company, but dunno if that makes any actual difference.
It's fine with me if an Iranian company offers to host Parler.
Having said that, I'm also in favor of prosecuting US companies that violate any sanctions we have against Iran.
Can someone please explain to me why it's a OK to reconnect Iranians to Signal, but not Trump supporters to Twitter (the ones censored and banned by Twitter)?
If you want to reconnect people to twitter (a publishing platform) who have been banned for racist hate speech or inciting violence, and the laws in your jurisdiction permit you to do that. Then you can do that without going to jail.
If you want to reconnect people to signal (a personal communications tool) who have been disconnected from it due to reasons best understood by the Iranian government, an the laws in your jurisdiction permit you to do that. Then you can do that without going to jail.
It's really just a value judgement whether you consider giving a publishing platform to racists against the will of said publishing platform is a worthwhile activity.
And, again, it's just a value judgement whether you consider giving the right to privately communicate back to Iranians who have been, effectively, deprived of it by connecting them to a service which will willingly have them is a worthwhile activity.
Your values may differ from mine. And both my and your values could differ from the majority of HN users. My experience is that perfect alignments of values rarely, if ever, occur between any two individuals.
Iran's (authoritarian, human-rights-abusing) government wants to prevent citizens from communicating with each other using tools that are resistant to interception by their secret police. HN supports the basic human right to privacy, and thus wants to help Iranians circumvent unjust laws or government actions.
White supremacists (who happen to support Trump, because duh) are being banned by Twitter -- a company, notably distinct from a government, and thus incapable of "censoring" anything. This prevents them from using Twitter's platform to publish hate speech and (arguably illegal, definitely unjust) calls to violence. HN supports the right of a company to decide who can publish content on their platform and agrees that it's cool to tell racists that they aren't welcome there.
Meanwhile we are blocking Iranians to access Docker, Slack, Gitlab, Google Code, Github(Github until recently), Paypal, Apple Store, Play Store, AWS, Coursera, Adobe, Nvidia, AVG, Avast, Symantec, McAfee, Matlab!!, Oracle and many more.
It should be really fun to use Internet in Iran.
Jokes aside it's truely painful. I was lucky to have a job that got me out easily. Though it felt embarrassing when I was seeing everyone uses Docker and AWS extensively at my new job while I had never used them properly not because I wasn't smart enough but just because of where I born :(
Is there no way to build this in the Signal clients themselves? Eg. on is on a wifi, try to upnp, ask the user if they'd wish to help.
[1] https://addons.mozilla.org/en-US/firefox/addon/torproject-sn...
They can donate some money to charities running Tor nodes while they're at it, or run some themselves.
Iran tried to censor Tor too, but it's pretty much impossible to do so fully. At least the Tor devs are usually on top of it, while Signal is inexperienced dealing with things like this.
The fact that it is?
There are secret bridges and Tor is able to disguise its traffic as other 'legitimate' protocols.
My ex moved to China, and she told me that the only people who say Tor can't be blocked are people who have never lived in a country where the government is actively trying to block it. Just because you can connect to it doesn't mean you won't get a knock on the door in a month asking why.
Iran can block these proxies, too, but this way there isn't any centralized listing of proxies. This proxy setup is simple enough that a single person could run a proxy for a few dozen of their friends, and the Iranian government might just never find out about it.
One could use censorship evading VPNs like Tor, Lantern, Shadowsocks, Psiphon in addition to using these proxies. They all have different evasion mechanisms.
The thing that works for user-run proxies is, it is like a hydra, you censor one proxy another crops up.
https://2019.www.torproject.org/docs/bridges.html.en#Pluggab...
So no, it's not 'blocked'. They're just trying. Mostly by blocking bridges they know of.
$ docker logs shadowsocks 2>&1| grep "AEAD: repeat salt detected" | wc -l
16468
It's not easy to build a protocol that is cryptographically safe all while keep the traffic characterless/innocent. Could be a "World Changing Event" if somebody discovered a way through.
Although, if only Signal is making nice sized packets, that could be suspicous.
If the censor already knows about your proxy they would have no reason to test it... The whole point is that there isn't a central list of proxies for them to easily block.
If it's trivial to figure out (by doing a nice handshake) whether something is a certain kind of proxy, then the cat-and-mouse game is reduced from finding lots of mice to updating the cat system to test whether passing animals are mice and instantly wiping out the mice population.
YET. I wonder if someone will find a simple way to map these with shodan.
I fully expect the US govt to have access to fb/whatsapp data (at least the metadata), but it's a bit surprising to me that Iran would too.
https://transparency.facebook.com/government-data-requests/c...
They certainly aren't complying with U.S. antitrust laws. They comply if it makes them money and don't comply if it doesn't make them money.
I guess I'm coming down hard on one side of a controversial question, but in my mind, if it allows the server to intercept messages without users knowing about it under the default configuration, it's a backdoor.
— Perhaps the door is cracked (or ajar) and a microphone is listening in ... still?
Citation?
https://gist.github.com/TimWolla/457c45dfccde26fc674dde4b3c7...
I could not test it with the Signal client yet, because the Beta is not yet available for me. However I verified that the nested TLS works using openssl and netcat.
Looking into their repo, they also appear to be building an nginx image from docker.io/ubuntu:20.04 instead of using docker.io/nginx. They are also running two separate nginx processes. I wonder how they ended up with this weird intricate setup.
I would be glad to help if they offered straightforward instructions.
Also the way they’ve done it makes it incredibly easy for anyone who isn’t a tech expert with a web server to still help out with a $5 domain and a $5 VPS. You literally run three commands and it’s done.
They want as many people as possible running these so blocking them all is as difficult as possible. It’s the smartest approach to have a low barrier to entry for something like this.
Without federation, Signal is just another stepping stone in the long path of eventually abandoned instant messengers, all the way back from ICQ. We will get to an SMTP-like protocol, and email-like service, at some point. If not Signal, some other one.
It’s why we re not using smtp for chat. SMTP can’t be extended enough so replacements are built instead. Similarly if signal federated, eventually it would freeze and a few years later users would move to wherever they could get new features.
Federation is a good thing but only when the protocol is finished or if there is a forcing mechanism to allow updates to the protocol. ethereum/Bitcoin are good examples as they have flag days that force the value of currency to be in the balance to keep the protocol moving forward.
Im not sure "chat" needs this much constant "innovation" at the protocol level. Most of the issues with email are client UX more so than actual protocol limitations.
I think XMPP is a better comparison than SMTP. In its heyday, XMPP had several clients, some with different proprietary extensions, and all the core functionality basically worked across all the clients. Though it turns out some of the messengers I thought were XMPP were actually different protocols that XMPP could work with. Imagine that. People still use it too, though it's not as popular as it was in the 2000s.
Moxie, one of the original authors of the Signal protocol, said federation severely restricted flexibility and so they had to move on: https://news.ycombinator.com/item?id=11668912
Agreeing on and keeping some spec up to date is a solved problem. Just ask any web standards committee.
Do any SMTP servers still allow organic routing? I was under the impression that all modern servers have extremely cumbersome auth/dkim and its hard to not be GMail and still send a real msg and have it arrive
More info: https://www.secfirst.org.
iOS: https://apps.apple.com/us/app/umbrella-security/id1453715310
Android: https://play.google.com/store/apps/details?id=org.secfirst.u...
Web (Beta): https://umbrella.secfirst.org
Even if you teach everyone how to deploy their own servers, then that's the knowledge the government will start targeting. You can make blocks expensive, i.e. blocking other major, useful services that would disrupt society too much for them to want to deal with, but this of course has its own costs.
It's censorship and surveillance all the way down.
That's not to say it's a free society or that censorship doesn't exist there, just that it's not the sort of regime that is particularly good at it.
If I had to guess, Iranian expats would be a likely set of people to start up proxy servers for their family and friends back home.
From the article:
> A more discrete approach would be to only send the link via a DM or a non-public message. You can post something like this on your favorite social network:
> * #IRanASignalProxy Reply to this thread if you want the connection details, and follow me so I can DM you the link.*
They'll probably try, but it's not very scalable. It's tough to build and maintain a Twitter account with a history that looks like a real regular person, much less create a bunch of them fast with history that dates back before the day you started. If most of them make a modest effort to verify users, most of them should remain unblocked. It's all pretty decentralized, so it's not that big as deal if a few of them do get discovered and blocked.
You also overestimate how committed Iran is to stopping this. Doing this in public risks the state finding out, but outside of times of crisis the state is usually pretty slow to respond. Keeping it private tanks participation rates.
From the blog post, "A more discrete approach would be to only send the link via a DM or a non-public message."
> how about randomly giving out random proxies in some header that the app could query on cloudflare or google or akamai
That would "..increases the chance that Iranian censors will simply add those IPs to their block list"
It looks like the solution provided in the blog post is limited to helping folks run their own proxy for people they know.
My last in-depth reading on it was the excellent 2016 SoK paper “Towards grounding censorship circumvention in empiricism” (http://www.cs.umd.edu/class/fall2018/cmsc818O/papers/sok-cen...)
The high level takeaway then seemed to be that researchers were not focusing efforts on measures that can actually help more people resist censors. Have we made progress since then?
Tor, Jigsaw's Outline, and V2RayNG are worth keeping tabs on as they're FOSS projects and do much of their development in the open.
Lantern's development whilst it was still open source was fascinating to see as well. Since 2016 (I believe) they stopped doing so out of security concerns: https://twitter.com/adamfisk/status/1316569766832869377
I'd heavily advise instead to run as many xmpp servers* as possible, and let people/friends use them.
*not matrix, unless one configures it to forget the data and only act as a message broker, like XMPP. For this specific use, it's better.
edit: https://twitter.com/alsdkjflasdkjf1
edit2: You can drop me a mail here, too: jegzc4na8j7@temp.mailbox.org
Except, of course, that posting public keys is too 1990s for him https://moxie.org/2015/02/24/gpg-and-me.html (which contains some good arguments but offers no solutions, so whatcha gonna do, post a phone number and trust the signal servers to give you the right public key? That's better than self-published public keys? For an anarchist? Is it smart to post phone numbers publicly anyway, see e.g. SS7?) Perhaps just ignore this paragraph, I'm just a confused person seeing mixed signals.
Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services.
They gave up and lifted the ban eventually.
https://www.schneier.com/blog/archives/2018/06/russian_censo...
Just set one up myself took 15 minutes and that includes setting up a fresh VPS.
Just thinking what the best way to share it is.
Immediate recalling John Gilmore (GNU/EFF/etc.) in 1993:
"The Net interprets censorship as damage and routes around it."
Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.
Dealing with hostility from government bodies is probably no fun.
> Except as otherwise authorized pursuant to this part, and notwithstanding any contract entered into or any license or permit granted prior to May 7, 1995, the exportation, reexportation, sale, or supply, directly or indirectly, from the United States, or by a United States person, wherever located, of any goods, technology, or services to Iran or the Government of Iran is prohibited, including the exportation, reexportation, sale, or supply of any goods, technology, or services to a person in a third country undertaken with knowledge or reason to know that:
> (a) Such goods, technology, or services are intended specifically for supply, transshipment, or reexportation, directly or indirectly, to Iran or the Government of Iran; or
> (b) Such goods, technology, or services are intended specifically for use in the production of, for commingling with, or for incorporation into goods, technology, or services to be directly or indirectly supplied, transshipped, or reexported exclusively or predominantly to Iran or the Government of Iran.
For US citizens, does helping folks in Iran in this way with a Signal proxy fall under these terms?
https://www.ecfr.gov/cgi-bin/text-idx?SID=f384a46ec1b04cc7b2...
For instance, Virgil Griffith is being held and charged for giving a high level description of bitcoin transactions at an academic conference in North Korea.
This is incredibly more specific and more technical of an act.
https://www.coindesk.com/usa-v-virgil-griffith-what-we-know-...
https://www.nytimes.com/2019/12/02/nyregion/north-korea-virg...
edit: further.. how is Signal shielded (if at all) from providing services to anyone in Iran? Wouldn't they be a target in such a case? The blog post is an explicit call for assistance specifically to do so.
[1]: https://home.treasury.gov/policy-issues/financial-sanctions/...
Edit: You might find GitHub's description of how they handle this interesting: https://github.blog/2021-01-05-advancing-developer-freedom-g...
RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz
https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng...
Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.
Won't the censors just block DNS for `signal.tube` immediately?
You are actively encouraging people to use technology that will reveal to their ISP/government they use Signal despite a government ban. You also force them to use phone numbers, which are uniquely-identifiable and are also advertised publicly in multi-user chats. ARE YOU TRYING TO GET PEOPLE JAILED OR KILLED?
If you were really fighting for freedom and the right to legitimate dissent against unfair governments, then you would federate your services so you don't become a central authority who can ban users (SPOF), abandon phone numbers entirely (because they're a security nightmare and publishing them facilitates harassment, a known problem on your platform you have refused to address so far), and use established proxying mechanisms which are less detectable than a plaintext header containing "signal.org" (like Tor).
The SNI header is not dropped to upstream because it's used whether the reverse proxy is operated by the intended recipient (Signal) or not (the proxy). That's precisely the reason why people have been promoting Encrypted SNI for some time now.
This scheme is convenient for those with correctly configured devices, but comes at the cost to everyone else of increased risk of inadvertent leaks of the fact that they're attempting to circumvent the block. I'd be interested to hear more about what factored into the decision to make this trade-off.
Edit: On a second thought, I wonder if a custom scheme would have worked, e.g. signal-proxy://example.com?
There needs to be a way for the same Signal application to, in an emergency, connect to a different server. Perhaps even some form of federation so that once somebody switches server, they can still reach people on a different server if need be. I would absolutely love to see some work done on making a Matrix/Signal hybrid.
think about it
First Signal doesn't want to build a federated service because it is too complicated to build (for the guys who brought us a new class of encryption) and now they are asking us for proxy servers because their centralized network can be censored...
But since Signal is probably the best option for private communication right now, I don't want anybody to discourage to run a proxy right now.
And if you're the mouse, you really don't want to be hobbled by not having an auto-update mechanism in your proxy servers...
At the very least they could have made it load the config from https://signal.org on startup, or made an apt package that sysadmins can easily update with everything else.
Unless Iran totally kills its internet to all.
Sure there is the dark side that it could be used to organize crimes and terror, but I think we have to recognize the right to meaningful communication and privacy.
Signal gives me hope on the internet of the future.
Internet is a bad fit for this. I wish everyone was using yggdrasil, I2P, tor or something similar.
I mean: I could provide as many yggdrasil addresses as I wanted to. It would be possible to setup a few VPNs to connect separate networks (though potentially traceable).
I would gladly sent a link to Signal for my proxy though so they can forward it to people that need it? Hmm, I'm beginning to see the problem now..
Moreover, should I run this from my personal server? Could it become a target for nefarious stuff? I feel the same as I do when I think about running a TOR exit node. I want to be like my hero Edward Snowden but... I'm afraid of the stuff that gets associated with my IP address.
Also, a https://www.linuxserver.io/ Docker image would be cool ;)
I’ve got a couple of idle servers but don’t want mystery stuff proxied. Ie open to other traffic
See here in the code:
https://github.com/signalapp/Signal-TLS-Proxy/blob/master/da...
this is looking like a zero sum game unless signal account is delinked from phone numbers because the govt can play cat and mouse game indefinitely
then its a matter of time before they link real identity to the phone. With the wide availability of femtocells, all they need to do is get lucky once.
This puts operators of Signal proxies at potential harms way! Absolutely irresponsible for people on HN to downvote and downplay genuine security concerns.
I would bet yes.
It looks like you haven't logged in from this browser before. Please enter the login code from your phone below.
NOT COMING MY PHONE CODE
> One woman in the Iranian capital, whose satellite dish was demolished by the police several months ago, told "Persian Letters" that the first thing she did the day after her apartment complex was raided was order a new dish and receiver.
> "That's the only fun we have here. There's nothing worth watching on [state television]," she said. "They can come and take my dish away. I will get a new one."
https://www.rferl.org/a/persian_letters_satellite_dishes_ira...
This is especially true for economies that are as disconnected from the US as the Iranian one is.
The only thing a state has control over is payments from users. But if smuggling in transceiver equipment with pre paid traffic isn't that hard.
It's called XMPP. It predates Signal by ~15 years.
It seems like both signal and matrix choose "Human-meaningful" over "distributed" on Zooko's Triangle: https://en.wikipedia.org/wiki/Zooko%27s_triangle
Matrix is federated which I'd argue is pretty different than "distributed". Certainly the fact that federation is built-in makes matrix more resistant to lazy censors who are slow to block popular homeservers, but a concerted check-any-IP-and-if-it-seems-like-it-might-be-a-homeserver-then-block-it action by a censor would be harder to deal with.
Wouldn't a truly distributed/secure/really-super-hard-to-block protocol rely on non-meaningful addresses (i.e. public-key-derived like a tor hidden service) and some kind of interesting mesh setup (i.e. like tor) to route and deliver messages?
I trust Signal to try their hardest to solve communication, spitting on them is not the solution.
Can they then read said proxy traffic since it’s on their machine?
Just spin up a server if you can spare the expense and help some people out.
Action > inaction.
edit: you can get the connection details via @appliedlambdas on twitter!
“Almost everyone in these comments is asking questions of various degrees of pedantry or outright dissing hospitals/insurance/medical bankruptcy/whatever...
Just donate to a charity if you can spare the expense and help some people out.
Action > inaction.”
Healthcare and communication aren’t comparable. But my point is that you can criticise institutions for their (contested) faults.
If you place yourself on the mantle of non-federation, then availability and censorship resistance are your cross to bear, frankly.
The notion that I should help them workaround their architectural failure when it’s been widely criticised (and criticism openly dismissed) multiple times is a little wild.
This right now is about people having their access to uncensored communication cut off, and moxie asking people to help out. If you think their architecture is doomed, you're free to codify your opinion somewhere in a pull request or comment under an article about signal's protocol philosophy.
That doesn't mean it's unwinnable. That means you create a lot of evasive mice and win.
Perfect is the enemy of the good. This is the kind of thing where winning is more important than a perfect strategy.
Be water.
Call me extremely pessimistic but events like Jan 6. will be used as justification to start attacking applications that offer end-to-end encryption, and encryption in general. Just like 9/11 was used to justify eroding certain civil liberties.
https://www.theverge.com/22249391/signal-app-abuse-messaging...
Thanks to olah_1 for this reference
> One employee pointed out that fascists are often quite public about their activities, as the recent insurrection in broad daylight at the Capitol showed
https://www.theverge.com/22249391/signal-app-abuse-messaging...
how do I offer it to others for use if I don't use twitter?
Now that's fine if you support the expansion of global liberal democracy (which happens to be neither liberal or democratic) but just don't be deluded into believing this is some good guy vs bad guy scenario. As we speak, U.S media is advocating for the removal of Signal because Americans may also have access to encrypted private speech!
Not everything is a US conspiracy in geopolitics...
Who is to say that the Western technocratic system of government replacing the current Iranian regime would not also be oppressive? I personally believe it would be vastly more oppressive.
You can see it as a Trojan horse if you will
As I have said before. I'm not in the US and I don't care about its politics. But I'm scared and hiw easily they can define Good and Bad and then manipulate the internet
Iranians who use Signal are American proxy forces. By definition it is treason.
https://www.theguardian.com/world/2020/jan/15/internet-parti...
https://thewire.in/rights/kashmir-internet-white-list-net-ne...
https://thewire.in/rights/modis-thought-control-firewall-in-...
>The reason the government wants to keep blocking full access to the internet in the Valley is its fear of civil disobedience.
and the ban is still in place although it is on high speed mobile internet today.
https://thekashmirwalla.com/2020/12/high-speed-internet-ban-...
not to forget there were reports of CISCO being brought in to build this fucking firewall
people underestimate the security intelligence service of countries in this region. They have far more capacity than people in the West estimate.
It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and access to internet.
>It's irresponsible of HN to put people in potential harms way, Iran is at a breaking point, they have nothing to lose and will stop at nothing to stop exfiltration and access to internet.
yes. shocked pikachu face gets a random HN reader nothing but people can die as a result of this. heck i have records of people who are locked up since last year because of "social media misuse" aka dissent