Slashdot Mirror
Encrypted Messaging App Signal Uses Google To Bypass Censorship (pcworld.com)
Developers of the popular Signal secure messaging app have started to use Google's domain as a front to hide traffic to their service and to sidestep blocking attempts. Bypassing online censorship in countries where internet access is controlled by the government can be very hard for users. It typically requires the use of virtual private networking (VPN) services or complex solutions like Tor, which can be banned too. From a report on PCWorld: Open Whisper Systems, the company that develops Signal -- a free, open-source app -- faced this problem recently when access to its service started being censored in Egypt and the United Arab Emirates. Some users reported that VPNs, Apple's FaceTime and other voice-over-IP apps were also being blocked. The solution from Signal's developers was to implement a censorship circumvention technique known as domain fronting that was described in a 2015 paper by researchers from University of California, Berkeley, the Brave New Software project and Psiphon. The technique involves sending requests to a "front domain" and using the HTTP Host header to trigger a redirect to a different domain. If done over HTTPS, such redirection would be invisible to someone monitoring the traffic, because the HTTP Host header is sent after the HTTPS connection is negotiated and is therefore part of the encrypted traffic.
I'm just waiting until Egypt does what China has done and blocks Google until they comply. Hopefully not.
Signal is an awesome app. It reminds me of the old TextSecure app that isn't made any longer, which was a perfect replacement for Android's stock SMS appl
So, IANACryptographer, but if I understand correctly: Google gets metadata when Alice sends a message (because connect to its server using this "fronting"), and when Bob receives one (because Signal delivers messages using GCM). It doesn't look too hard for them to reconstruct that Alice is exchanging messages to Bob.
My first program:
Hell Segmentation fault
Could the same technique used with Amazon S3, CloudFlare, or Azure back-ends? It would probably be a lot more difficult to trace if requests are distributed amongst multiple domains, those get enough traffic that the messaging would likely get lost in the "noise."
Frankly, I'm surprised they allow Host header redirection to unknown sites in the first place. Seems open to abuse, like an open mail relay....
Egypt and other countries that want to block Signal will now have to start blocking https://.google.com/ and https://.cnd_domain_here/ real soon now.
This would allow non-encrypted Google searches and non-encrypted CDN traffic. Since most users in those countries know their government is spying on them, er, I mean protecting them from bad stuff on the Internet, this shouldn't cause too much domestic political blowback.
Face it, if you are in a country with draconian censorship or government monitoring - like North Korea and possiby China - you'll need to use stegonography to hide the fact that you are even encrypting things. Furthermore, if you need to "encrypt and hide" more than a relatively small amount of data, you'll have to use a technique that is "custom made" or at least a "custom variation" of well-known formats to avoid detection. I'm not saying the people in Egypt are in this situation now, but people in some parts of the world are.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
FTFA: "The anti-censorship feature is currently present in the latest version of Signal for Android. It’s also included in a beta version of the app for iOS that will be released in production soon. The developers also plan future improvements that will allow the app to detect censorship automatically and switch to domain fronting even if the user has a phone number from a country where censorship is not normally present. This is intended to cover those cases where users travel to other countries where the app is blocked."
I reside in a country that doesn't (yet) block Signal. But will my app automatically use domain fronting anyway? I'd rather not use the feature unless absolutely necessary, to protect the integrity and privacy of my communications.
It is pitch black. You are likely to be eaten by a grue.
Don't do it. You could get into trouble. Be kind to yourself. Please. Do not do this.
If it can operate through sites other than Google, can it get through to and from China?
I have thought about installing Signal, but then I always remember the laundry list of permissions it wants access to in order to install. This app is supposed to make us feel comfortable about being "secure" but it asks for way more privileges than any other app I have ever installed. And speaking of "ever", given the recent Evernote announcement, I worry about giving another company access to THAT MUCH of my phone's contents.
What is everybody else's opinion on Signal?
Egypt doesn't have to block www.google.com, they only have to discern which internal IPs are attempting to communicate securely and blacklist those IPs from performing out-bound connections. As long as Egypt's firewall can tell the difference between a redirect and a normal search response they can do this. Google would have to start padding redirect responses to make it harder to tell the difference between these response types.
> Signalis made by the same devs who make Signal . At the moment, that's moderated +4 Informative. Since that's informative, let me add that Frosted Flakes is made by the same people who make Frosted Flakes.
There are lots of short messages. Just think of the normal redirects to mobile versions of sites with the billions of mobile devices.
Signal does this, May do it, sometimes? Or users do it, how exactly. Murky tech crypto advice.... how's that going in getting everyone encrypted, which would stop crypto-flagging?
The luddites eat big sausage when apping the app in the pack on their back
I'm in UAE and still cannot sign up to Signal.
Someone researched and made a proxy, and it got in the news... Yay! The wheel is round again.
Indeed - some major websites do about 5 redirects before you ever get to any content. It's the norm, not the exception. Good luck with that haystack.
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
I've never liked Signal because it associates users to mobile phone numbers and doesn't have a good PC companion app. Mobile phones are amazingly effective tracking and surveillance devices. We should try very hard to avoid using them or at least decouple them from the phone system as much as possible. We need anonymous mobile computing devices. :)
"Encrypted Messaging App Signal Uses Google To Bypass Censorship"
When every word is capitalized, capitals have no meaning. Wake up Slashdot, headlines don't need this hype and I don't have time to try to decipher them. The English language works- use it!
...omphaloskepsis often...
Now that everyone knows my little secret its time I upgraded security on my server.