[liberationtech] Signal ignores proxy censorship vulnerability, bans researchers

[Shava Nerad]

Just to clarify, it looks like Signal did get funds from the Open
Technology Fund, about three million over four years, ending in 2016.

https://www.opentech.fund/results/supported-projects/open-whisper-systems/

Since then, they've been funded as a 501c3 US charity, with private
funding, from what I understand.  It is no longer your tax dollars at work.

https://en.wikipedia.org/wiki/Signal_(software)#2018%E2%80%93present:_Signal_Technology_Foundation

I agree it would be nice if everything worked perfectly all the time when
there are people in need.

I'm a little out of date in general due to being retired.  I know that most
people I talk to are using Signal or Telegram for secure messaging.  Are
you trying to say that Telegram is better?  I only used it once, when a
scammer presented himself as wanting to commission me for an editing job,
and found that it had a lot of faux security features, such as not letting
you cut and paste conversations (I used my tablet to photograph my phone
screen), plus like WhatsApp, all conversations are server based rather than
peer to peer.

Signal has been overwhelmed since the WhatsApp privacy policy rumors were
compounded by an endorsement by my homeboy Elon Musk.  Their call
initialization service was down for a while, and on the Play Store they
went basically overnight from 10M to 50M downloads.

Are we expecting instant response?  They seem overwhelmed trying to deliver
the level of service they're accustomed to.

Unless we have a better recommendation (I've used Silent Circle's chat
client based on the same architecture and found it easier to use -- but
it's also a subscription service and spendy) perhaps we need to give them
time to breathe, and Moxie will have a more nuanced response?

In the meantime, perhaps some of us with current skills can try to help.


   1.
*Contribute code *If you have Android or iOS development experience, please
   consider helping us tackle some of the open issues in our GitHub
   repositories <https://github.com/signalapp>.

https://support.signal.org/hc/en-us/articles/360007319831-How-can-I-contribute-to-Signal-

That is more likely to get the problem solved sooner than this discussion.

yrs,

Shava Nerad
shava23 at gmail.com
https://patreon.com/shava23


On Thu, Feb 25, 2021 at 2:48 PM Collin Anderson <collin at averysmallbird.com>
wrote:

> To bo0od and Shiva’s messages —
>
> Signal has received millions of dollars in Congressionally allocated funds
> to foster secure communications in Iran and similar countries. As a
> taxpayer, and quite frankly as someone who actually talks to those
> non-elite communities, it’s not asking much for their tools to actually
> work, especially when there are real solutions.
>
> On Thu, Feb 25, 2021 at 12:41 PM bo0od <bo0od at riseup.net> wrote:
>
>> signal can do nothing from what you said and can do everything the
>> opposite and still no problem.
>>
>> software developers have no liability,responsibility,guarantees of what
>> you get when you use their software.
>>
>> its from signal devs kindness that they even typed anything to answer
>> this matter.
>>
>> i dunno why some ppl think that software and software developers should
>> take the responsibility of anything.
>>
>> Collin Anderson:
>> > All this debate over whether Signal could use a better bridge protocol
>> is
>> > fine, but distracts from the core problem — Signal Proxy is of little
>> > consequence and is a slight of hand trick to avoid taking on further
>> > burdens to address 80 million vulnerable people (a community Signal was
>> > long funded to support) being cut off.
>> >
>> > Signal could invest that time into providing another cloud service for
>> > meek-style circumvention. It did not. Instead it told users, who
>> generally
>> > have no connection to Iran to run bridge and post solicitations on
>> blocked
>> > social media. How is that a serious idea to pitch to people?
>> >
>> > The aughts called and it wants its internet freedom agenda back.
>> >
>> > On Wed, Feb 24, 2021 at 11:41 PM Adam Fisk <afisk at getlantern.org>
>> wrote:
>> >
>> >>
>> >> On Wed, Feb 24, 2021 at 8:19 PM Harry Halpin <hhalpin at ibiblio.org>
>> wrote:
>> >>
>> >>> Again, if Sergey - who seems to be a perfectly nice Ph.D. student -
>> wants
>> >>> to fix TLS, that's fine. I would support fixes to TLS as would any
>> sensible
>> >>> person, including Moxie.
>> >>>
>> >>
>> >> So just so we're on the same page, Sergey is a perfectly nice Ph.D.
>> >> student whose code was deployed on more phones globally than Moxie's up
>> >> until a few months ago. It's deployed almost exclusively in censored
>> >> regions, in contrast to Signal which is deployed almost exclusively in
>> >> uncensored regions.
>> >>
>> >> Making TLS more censorship resistant at the IETF level is great. I'm
>> not
>> >> sure what vulnerabilities you specifically have in mind, but to me the
>> most
>> >> promising is Encrypted Client Hellos (
>> >> https://tools.ietf.org/html/draft-ietf-tls-esni-09) that especially
>> Nick
>> >> Sullivan at Cloudflare has been pushing with great success.
>> >>
>> >> While I agree we should vigorously pursue approaches like that, it
>> won't
>> >> help people in the most censored regions today. Sergey's code is
>> actually a
>> >> core piece of bypassing real world censorship now.
>> >>
>> >>
>> >>> But that's not Signal's problem - TLS bugs are a lower-level network
>> >>> level protocol whose bugs Signal inherits when it tries to use TLS.
>> Sergey
>> >>> should approach the TLS 1.3 Working Group at the IETF, no try to
>> garner
>> >>> attention for himself via media releases over his github comments.
>> This
>> >>> reminds me of the Israeli "security" firm that claimed they had
>> "hacked"
>> >>> Signal by simply accessing the keys in the phone, which can be done to
>> >>> *any* app on phone that has a rootkit that doesn't use
>> >>> some-yet-not-really-working secure enclave.
>> >>>
>> >>
>> >> Right. Signal's problem is that they were blocked in Iran. Their
>> solution
>> >> to that problem attempts to use TLS in a way that doesn't work. You're
>> >> basically thinking of TLS in the way that Signal is thinking of TLS,
>> which
>> >> is limited and the heart of the problem.
>> >>
>> >> Sergey hardly tried to garner attention for himself -- heck his last
>> name
>> >> was never even mentioned anywhere I saw. I happened to realize it must
>> be
>> >> him just based on his first name and the nature of the analysis.
>> >>
>> >>
>> >>>
>> >>> There are literally *no* server that is not susceptible to active
>> probes
>> >>> and machine-learning based traffic analysis attacks. If Sergey had a
>> kind
>> >>> of solution that actually did what Adam claimed it did
>> "anti-censorship
>> >>> tools that actually work at scale in censored regions are not
>> susceptible
>> >>> to active probes" then all of China would be using it. As it doesn't
>> exist,
>> >>> people aren't using them.
>> >>>
>> >>
>> >> I never mentioned anything about machine-learning based traffic
>> analysis,
>> >> which is a different problem, but the most disturbing reality is that
>> there
>> >> are "anti-censorship tools that actually work at scale in censored
>> regions
>> >> are not susceptible to active probes", but it turns out that a very
>> small
>> >> minority of Chinese actually have much interest in the censored
>> internet.
>> >> Could the tools that work in China capture more of them? Sure, but
>> there
>> >> are all sorts of other issues in China too, such as distribution. It's
>> also
>> >> very dangerous for people in China to work on those tools.
>> >>
>> >> One that's been growing recently is v2ray. There's a reason it has over
>> >> 30K stars on GitHub: https://github.com/v2ray/v2ray-core
>> >>
>> >>
>> >>>
>> >>> Censorship is a very hard problem, which is why Shava is basically
>> right.
>> >>> Cutting-edge usable tech here is still I believe obfs4proxy, and it's
>> >>> well-known defeatable by nation-state level adversaries.
>> >>>
>> >>
>> >> This is actually the fundamental issue -- there is a huge asymmetry of
>> >> information between the more conventional security community and the
>> people
>> >> who work on bypassing censorship, largely because the techniques that
>> work
>> >> are largely kept secret. The "cutting-edge" usable tech at one time was
>> >> obfs4proxy, but it's been probably 7 years or so since that was the
>> case.
>> >> The people who know what the cutting edge usable tech is are those who
>> >> deploy it at scale, but you're not likely to read about it anywhere.
>> >>
>> >>
>> >>> I do support the usage of Tor, and Tor also is susceptible to the
>> precise
>> >>> same kinds of attacks Signal is and thus doesn't work in China, Iran,
>> and
>> >>> many other places. Furthermore, it's not resistant to NSA-style
>> traffic
>> >>> analysis. But it is by better than most shady VPNs and proxies, and I
>> hope
>> >>> people use it where their nation-state hasn't starting censoring it
>> yet.
>> >>> Same with Signal. Most VPNs that work in these countries work insofar
>> as
>> >>> they are easily susceptible to attacks (i.e. see Moxie's older work
>> on bugs
>> >>> in PPTP or the myriad of authentication issues facing OpenVPN,
>> >>> fingerprinting of Wireguard...). Again, more work is needed but aim
>> work in
>> >>> productive way, not cheap media hit pieces on Signal or Tor.
>> >>>
>> >>
>> >> Yeah so that's where the asymmetry of information kicks in. The VPNs
>> that
>> >> work in the most censoring countries that are easily susceptible to
>> attacks
>> >> stopped working long ago. China in particular has stepped up its game
>> in
>> >> crazy ways in the last couple of years.
>> >>
>> >> Tor is incredible, and I support Tor's work all day long, but as you
>> say
>> >> it is not used widely in the most censoring countries. Other tools are.
>> >>
>> >> -Adam
>> >>
>> >> --
>> >> --
>> >> President
>> >> Brave New Software Project, Inc.
>> >> https://lantern.io <https://www.getlantern.org>
>> >> A998 2B6E EF1C 373E 723F A813 045D A255 901A FD89
>> >> --
>> >> Liberationtech is public & archives are searchable from any major
>> >> commercial search engine. Violations of list guidelines will get you
>> >> moderated: https://lists.ghserv.net/mailman/listinfo/lt. Unsubscribe,
>> >> change to digest mode, or change password by emailing
>> >> lt-owner at lists.liberationtech.org.
>> >>
>> >>
>>
>> --
>> Liberationtech is public & archives are searchable from any major
>> commercial search engine. Violations of list guidelines will get you
>> moderated: https://lists.ghserv.net/mailman/listinfo/lt. Unsubscribe,
>> change to digest mode, or change password by emailing
>> lt-owner at lists.liberationtech.org.
>>
> --
> *Collin David Anderson*
> averysmallbird.com | @cda | Washington, D.C.
> --
> Liberationtech is public & archives are searchable from any major
> commercial search engine. Violations of list guidelines will get you
> moderated: https://lists.ghserv.net/mailman/listinfo/lt. Unsubscribe,
> change to digest mode, or change password by emailing
> lt-owner at lists.liberationtech.org.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ghserv.net/pipermail/lt/attachments/20210225/761745b1/attachment.htm>