Hacker News Reader

Comment by godelski | Hacker News Reader

Didn't Signal do something like this and get in trouble?[0] I honestly don't know much about domain fronting so if this is something completely different than I'd appreciate an explanation. I do know that my friends in China are unable to use Signal, so I figure something is up.

[0] https://signal.org/blog/looking-back-on-the-front/

View on HN

Domain fronting was (and to a lesser extent still is) mainly about using CDN infrastructure so that clients appear (to a network censor) to be connecting to one CDN customer, but then ask the CDN to actually let them talk to a different CDN customer. (There are various protocol-layering tricks that may enable this either by accident or on purpose.)

This is a little different than using VPS services because with the VPS services you're actually connecting to the customer you appear to be connecting to, it's just very unclear who that is, because it's just one random VPS customer among a huge number of servers hosted on that same service.

Ah, thanks for the explanation. I do have a followup though. If this method is successful for Tor, why isn't it for Signal? I was under the impression that they used AWS and other servers. Or are they just not doing this and leaving an (easy?) censorship mitigation opportunity unsolved?

I believe Tor has a more active anti-censorship project than Signal does. While I don't think Signal is in any sense OK with governments blocking it, the Tor folks have something along the lines of a whole anti-censorship team (part paid and part volunteer). I don't believe Signal has a direct equivalent to that.

There could also be an element of luck or differences in how strongly particular governments are trying to block particular apps and circumvention methods at a given moment. I know that varies a lot from country to country.

Edit: However, Signal does have a "Censorship circumvention" feature under "Advanced" options. So there is some level of official work on that from Signal. Have your friends tried this feature?

Well I should correct this slightly. They have been fine if they connect to a VPN first. I'm not sure if they have tried the proxy option, though I was under the impression that this wasn't as actively supported. This is something I wish Signal would do better.

I also have the impression it's not as actively supported, but when I first replied to you, I had the impression it no longer existed at all as an organized effort, so it looks like the situation is probably better than I first thought. :-)

There are a number of countries gearing up to actively regulate instant messaging, including with potential encryption restrictions and app-blocking remedies for noncompliance, so I imagine this functionality will become more and more relevant over time. :-(

I just tried the feature in China, doesn't seem to help.

Thank you for trying it! Maybe I need to donate to Signal in the hope that they'll eventually have more resources to work on improving their anti-censorship technology.

I'm not sure how much they pay attention to community discussions, but I did find this thread. Looks like some users are really against this stuff.

https://community.signalusers.org/t/signal-needs-to-shift-to...

I don't think the privacy/anonymity proposals are exactly identical to anticensorship, even if they tend to appeal to the same people. (In the thread you linked, they're advocated by the same person.) After all, you can have a highly centralized service that knows personal data about its users but that also tries to prevent governments from blocking it.

Reply on news.ycombinator.com