<div dir="ltr"><div>Furthermore, the problem with these supposed "attacks" on Signal is they ignore the nature of how censorship-resistance and obfuscation technologies work, blaming Signal where you should just blame TLS. So, of course Moxie deletes the bug. It just shows whoever 'discovered' it hasn't thought about the source of the bug. <br></div><div><br></div><div>Basically, obfuscation will only work for a limited amount of time against an adversary that figures out it's being used. TLS - including TLS workarounds - naturally leaks all sorts of metadata, timing, and volume information. Thus, simplistic techniques like domain fronting formerly used by Signal eventually stop working.</div><div><br></div><div>So, when I look at this "bug" in Signal, it's basically a bug in how TLS works. The same would be true for Wireguard, OpenVPN, etc. and whether or not it was used with Airbnb or Signal if Iran started censoring Airbnb. Sadly, the internet does not have privacy and censorship resistance on the protocol level baked in...yet.<br></div><div><br></div><div> yours,</div><div> harry</div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 24, 2021 at 8:50 PM Yosem Companys <<a href="mailto:ycompanys@gmail.com">ycompanys@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Excellent intervention, Shava. I would also note that Moxie used to be in LT (do not know if he still is), and all of us at Stanford continue to be big fans of his work and accomplishments. (Same goes for Tor.)<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 24, 2021 at 11:43 AM Shava Nerad <<a href="mailto:shava23@gmail.com" target="_blank">shava23@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I am not a cryptographer myself, but I have a bit of experience with anti-censorship tools. <div><br></div><div>I know that my team, led by Roger Dingledine and Nick Mathewson, had great respect for Moxie back in 2007ish for the work he was doing then, including attacking Tor and helping us refine our tools -- and our messaging to end users.<div><br></div><div>Moxie's been in this space for a good 15 years or so. Why are you talking about him as a newcomer?</div><div><br></div><div>Respectfully,<br clear="all"><div><div dir="ltr"><div dir="ltr"><div><div><br></div><div>Shava Nerad</div><div><a href="mailto:shava23@gmail.com" target="_blank">shava23@gmail.com</a></div><div><a href="https://patreon.com/shava23" target="_blank">https://patreon.com/shava23</a></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 24, 2021 at 9:30 AM Adam Fisk <<a href="mailto:afisk@getlantern.org" target="_blank">afisk@getlantern.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Irrespective of the article, the claims are just obvious to anyone with a reasonable enough knowledge of how censors detect proxies to have an opinion. <div><br></div><div>The article is largely irrelevant, and its removal doesn't obviate the fact that the claims of the investigators, such as Sergey, that the Signal proxies are vulnerable to active probes is, again, just there in plain sight. </div><div><br></div><div>This is, of course, not surprising, as the Signal team has almost no experience with building effective anti-censorship tech. The idea that they could realistically deploy a new proxy in a matter of days that would be effective in those environments is frankly naive. That's all fine and good. I don't have the experience they do with designing secure messaging algorithms. It's cool, but we should have illusions about the reality of the situation.</div><div><br></div><div>-Adam</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 24, 2021 at 4:57 AM Charles M. Ess <<a href="mailto:charles.ess@media.uio.no" target="_blank">charles.ess@media.uio.no</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">the most recent version of the article indicates that the original <br>
claims have been disputed and removed by BleepingComputer.<br>
<br>
Truth is difficult ...<br>
best,<br>
-charles<br>
<br>
On 24/02/2021 06:59, Myles Horton wrote:<br>
> Just for the record, the people who posted the vulnerability are hardly <br>
> trollers. First, the vulnerability is obvious and doesn't really need <br>
> any formal proof. Second, one of the researchers is Sergey Frolov, one <br>
> of the top people in the field.<br>
> <br>
> -Adam<br>
> <br>
> On Mon, Feb 8, 2021 at 6:02 PM bo0od <<a href="mailto:bo0od@riseup.net" target="_blank">bo0od@riseup.net</a> <br>
> <mailto:<a href="mailto:bo0od@riseup.net" target="_blank">bo0od@riseup.net</a>>> wrote:<br>
> <br>
> Nothing is concerned just trollers want to damage the image of signal<br>
> <br>
> Yosem Companys:<br>
> > The claims in this article are concerning if true. That said, I<br>
> will note<br>
> > that I remain supportive of Signal's efforts, both because its<br>
> founders and<br>
> > key developers have not only been longtime members of our<br>
> community but<br>
> > also proven themselves time and again indispensable at helping<br>
> high-risk<br>
> > activists in need, most notably during the Arab Spring.<br>
> ><br>
> > ****<br>
> ><br>
> > Signal, an end-to-end encrypted messaging platform was recently<br>
> blocked by<br>
> > the Iranian government.<br>
> ><br>
> > To help its users bypass censorship in Iran, the company<br>
> suggested a TLS<br>
> > proxy workaround.<br>
> ><br>
> > However, multiple researchers have now discovered flaws in the<br>
> workaround<br>
> > that can let a censor or government authority probe into Signal TLS<br>
> > proxies, rendering these protections moot and potentially bringing<br>
> > repercussions for Signal users located in repressive regimes.<br>
> ><br>
> > The researchers who reported these flaws via Signal's GitHub<br>
> repository<br>
> > have been banned by the company with their reported issues removed.<br>
> ><br>
> ><br>
> <a href="https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/" rel="noreferrer" target="_blank">https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/</a><br>
> <<a href="https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/" rel="noreferrer" target="_blank">https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/</a>><br>
> ><br>
> ><br>
> <br>
> -- <br>
> Liberationtech is public & archives are searchable from any major<br>
> commercial search engine. Violations of list guidelines will get you<br>
> moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a><br>
> <<a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>>. Unsubscribe, change<br>
> to digest mode, or change password by emailing<br>
> <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a><br>
> <mailto:<a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>>.<br>
> <br>
> <br>
<br>
-- <br>
Professor Emeritus<br>
University of Oslo<br>
<<a href="http://www.hf.uio.no/imk/english/people/aca/charlees/index.html" rel="noreferrer" target="_blank">http://www.hf.uio.no/imk/english/people/aca/charlees/index.html</a>><br>
<br>
Secretary, IFIP Working Group 9.8, Gender, Diversity, and ICT<br>
<<a href="http://ifiptc9.org/9-8/" rel="noreferrer" target="_blank">http://ifiptc9.org/9-8/</a>><br>
<br>
Fellow, Siebold-Collegiums Institute for Advanced Studies, <br>
Julius-Maximilians-Universität Würzburg, Germany<br>
<br>
3rd edition of Digital Media Ethics now out:<br>
<<a href="http://politybooks.com/bookdetail/?isbn=9781509533428" rel="noreferrer" target="_blank">http://politybooks.com/bookdetail/?isbn=9781509533428</a>><br>
<br>
-- <br>
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>.<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div>--<br>President<br>Brave New Software Project, Inc. <br><a href="https://www.getlantern.org" target="_blank">https://lantern.io</a></div><div>A998 2B6E EF1C 373E 723F A813 045D A255 901A FD89<br></div></div></div></div></div>
-- <br>
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>.<br>
</blockquote></div>
-- <br>
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>.<br>
</blockquote></div>
-- <br>
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>.<br>
</blockquote></div>