Egypt Blocks Access to Telegram | Hacker News Reader

Egypt Blocks Access to Telegram

masaar.net

160 pointsemptysongglass78 comments

> Egyptian authorities have blocked access to IP addresses of the application.

Good thing that the Telegram client supports proxying traffic over SOCKS5 and MTProto (custom protocol). On the server-side, in the past, they successfully employed domain-fronting and recycling through multiple IPs to bypass the Russian firewall.

The client does its own DNS resolution over HTTPS and so DNS blocks are already ineffective.

It's also capable of masking its proxy traffic as TLS. This works so well you could actually have a web server behind it that would still work through the same port for a regular TLS client.

You can also achieve it with something like sslh and use ssh, https, OpenVPN on the same port. Pretty cool thing. But probably vulnerable to DPI.

> It is noteworthy that last September “Masaar” had published a web page declaring that the authorities have blocked 596 websites and 32 alternative links since May 2017.

It is even more noteworthy that the Masaar site by the link says they blocked 116 news sites, 349 anonymization sites, 6 e-commerce sites, 11 culture sites, 8 blogging platforms etc and... just one terrorist site :-)

I would normally opt for Signal because it's open source. This is inherently more trustworthy.

The fact that so many authoritarian governments ban/are hostile to Telegram suggests they actually do have some integrity.

Your comment is misleading: Telegram is open source (Desktop, iOS, Android), but the server isn't. It would certainly be nice to run your own Telegram server, sure.

IMHO the only good argument against Telegram is that direct messages don't use end-to-end encryption by default.

...except Telegram X, their alternative Android client.

> IMHO the only good argument against Telegram is that direct messages don't use end-to-end encryption by default.

I'd add two more:

1. End-to-end encryption being device-specific. Example: if you start a secret chat from your phone, you can't view it on your other devices. Other end-to-end encrypted solutions don't have this drawback.

2. End-to-end encryption being available only in one-to-one communications. Take this with a grain of salt, but I don't think it's available at all in group chats and channels.

taken individually, these all seem like minor nitpicks. but together, they make for a pretty high-friction E2E experience on telegram. the first time I try to have a "secret chat" with someone, it's often the first time they realize that telegram isn't E2E by default or that it even has that feature! I have to wonder about the design decisions made here. it seems pretty obvious that the combination of limitations is going to result in the vast majority of messages not being E2E. in practice, "secret chat" on telegram is only worth the trouble when both participants understand they are doing something shady.

For me device-limited E2E is actually a feature as I'm sure that no kind of weird sync stuff will leak my data from the device.

Also, E2E chats are not available on the desktop version of Telegram.

Telegram X is made by a different unofficial dev. Telegram has an open API. You can build your own clients.

It's published by Telegram LLC on Google Play. Can't be more official than Telegram itself distributing it.

Telegram's official dev account is 'Telegram FZ-LLC'.

https://play.google.com/store/apps/developer?id=Telegram+FZ-...

Telegram X is not the official version.It is an unofficial client for testing design and app speed. It has a different UI

In what way is the comment misleading? While "Telegram" might refer to "the Telegram app" or "the Telegram service", when talking about open-source, it nearly always refers to the service. Of the two, the source of the central server is arguably much more important, since it's possible to at least track if the app tries to exfiltrate any data.

The source of the central server is useless since if they release it there is no way to prove they are running the same software on their servers.

The source isn't "useless", it allows you to run your own server.

Yeah, and then you need to modify the client to use that server, have everyone you communicate with install that client, and also not brand it as "Signal" because it has nothing to do with the Signal network anymore, and you can't communicate with "regular" Signal users.

So, from the point of view of anyone using the Signal service, the utility of the source is near-useless.

Signal has a fascinating blog post from 2017 about how to use Intel's Software Guard Extensions (SGX) to actually let clients confirm that the software they're communicating with is the exact version they expect it to be.

https://signal.org/blog/private-contact-discovery/

SGX is definitely not bulletproof (https://medium.com/@maniacbolts/signal-increases-their-relia...), but it exists to do exactly this job, and Signal is using it.

in this case, shouldn't the client code be enough to show that bona fide E2E is happening?

I wouldn't trust Signal for the sole fact that the USG promotes its use. Think CryptoAG and how hostile Swiss law is to data privacy. Kids seem to think just because they were once known for banking secrecy doesn't mean they treat data the same way (they don't).

Nevermind that Signal is entirely open source and has been openly audited several times. Lol.

As others have pointed out, we users of Signal have no way of verifying that the code running on the server we connect to is the code they've released.

We are very much trusting the Signal team to do what they're saying (not logging, not leaking) and to make no mistakes in doing it (not logging accidentally, not leaking accidentally).

Which is in general a fair trade-off, but it is very much a trade-off, open audits notwithstanding.

Where does Signal prevent you from using your own server? Spin up your own and use it if you'd like.

https://github.com/signalapp/Signal-Server

As I pointed out elsewhere in the thread, Signal uses SGX to let clients confirm exactly what version of the contact discovery server software they're running against:

https://signal.org/blog/private-contact-discovery/

It's not bulletproof by any means (https://signal.org/blog/private-contact-discovery/ goes into this, and also points out several features they've used SGX for since), but it's certainly something, and they're doing it.

What makes opposition movements adopt telegram? What's the key feature that makes them adopt it instead of WhatsApp or Signal? People are not crypto nerds by default, so there must be a simpler answer.

There isn't necessarily am answer at all. As these people aren't cryotonerds they likely just use the first one their associates use. Telegram was one of the earliest e2e encrypted chats to gain some notoriety as a means to avoid surveillance, and the publicity from that and countries banning it provide advertising others lack.

Think of it like a big public message forum. Technically it works like one: You post messages and they're stored on the server and served up to everyone else at any point in the future. It's perfect for coordinating big groups of strangers.

It has a good reputation for refusing to kick people off when governments demand it. Although accounts are tied to phone numbers it doesn't show them by default and users can choose a unique username, so unlike WhatsApp or Signal it's easy to recognize the pseudo anonymous identity of people you don't know. It's much easier for many people to use than Twitter.

When running an opposition movement it doesn't matter if there's no encryption. Since you are open to the public your adversaries are going to be in your groups anyway. Another bonus is that most of your followers aren't already using it, which makes them more free to act. If a different messenger is popular in your country you might not want to tie the long held account that everyone in real life knows you as to your freedom fighting activity.

Or is it just a matter of market share ? lots of people use telegram, it's encrypted, 'strict' government decides to block it because they don't know much else about the field.

Let's see how long until they hear about signal

On a related note, people should download and run OONI Probe to monitor and record censorship on networks around the world. OONI Probe has tests for Telegram and WhatsApp, as well as middle boxes, blocked websites, etc.

Link: https://ooni.org/

Saved you a click: It's an Electron app.

Does it matter what platform it is build on?

To me, yes. I avoid Electron like the plague. I know others feel the same way, so think of it as community service.

Javascript-on-desktop arguments are probably already taking up gigabytes of space in the HN database, so I'll just say it's for all the usual reasons.

youd be surprised how well text compresses

Especially text with a lot of repetition.

There's also a lot of people who don't feel the same way and I think you know it. So probably no need for "saved the click" part in your community service.

People not liking electron isn't an affront to the people who do. Let's not police people's speech.

It’s not JavaScript-on-desktop that’s the problem- this was a suspicion often cast at Gnome’s bad performance, until Canonical got involved, started fixing performance issues, and it was discovered that most of those issues stemmed from inefficient waits and stuff. The reason why Electron apps gets such a bad rap (and I fully agree, I hate them too) is because they carry basically an entire Chromium with them in addition to whatever you wanted to accomplish. HN is pretty split on Electron afaik because whilst it killed native apps for Windows and Mac, it has brought a lot of them to Linux.

Precisely. I would hate Electron less, if it shipped as a runtime like Java. Though I still think shoehorning web tech onto the desktop is stupid.

Memes aside: thanks, you really did save me a click.

There's an open-source Android app which is published on F-Droid.

Oh! I had no idea it there was an Electron app for desktop. I've been using it on Android for years. I make a point to run it on wireless and mobile connections in every country I travel on. Also, I've made pull requests to https://github.com/citizenlab/test-lists with new URLs that are blocked in certain countries when I find them.

Short quick start for the lazy ones (also, no Electron so everyone rejoices):

  $ wget https://github.com/ooni/probe-cli/releases/download/v3.0.8/ooniprobe_v3.0.8_linux_amd64.tar.gz
  $ # sha512 => 4f215347022028cf5328446d15e59f2141d1a41e59110c0b85c67b711953d115  ooniprobe_v3.0.8_linux_amd64.tar.gz
  $ tar xfv ooniprobe_v3.0.8_linux_amd64.tar.gz
  $ # Move to $PATH
  $ mv ooniprobe ~/bin
  $ # Add crontab to run daily
  $ (crontab -l 2>/dev/null; echo "$(( ( RANDOM % 60 )  + 1 )) $(( ( RANDOM % 24 )  + 1 )) * * * ooniprobe run") | crontab -

Mostly just stolen directly from the readme of the CLI probe: https://github.com/ooni/probe-cli#ooni-probe-cli

Also, make sure you're not on a network where someone will report you for visiting the "wrong" websites. It does requests to a lot of websites you don't want to be caught with in your history.

Why can't it be just

  $ curl -L https://ooni.org/install | sh

That'd be a great addition! Give it a try and implement it: https://github.com/ooni/probe-cli/new/master

Don't forget to think about all the different OSes and the way the handle scheduling!

So I'm probably not going to Egypt as Telegram is the main (in fact - the only) way communicate to members of my family remotely.

There are plenty of ways to proxy the traffic. Apparently Telegram has it built in but for anything else I usually use ProtonVPN

ProtonVPN uses OpenVPN, right? That's been blocked in Egypt for some time. I had good success with Wireguard, which they didn't block (as of a year ago).

Really? Last time I was there around a year ago I was able to connect Proton.

I believe the paid plan of ProtonVPN also offers TOR connections. Not a specialist on this, though.

The traffic over your phones data connection is encrypted and routed directly through your provider in your own country. So these filters don’t affect it.

Typically the way to prevent people doing this is to make data roaming charges astronomically high.

Data roaming charges are not set by governments. It’s not even necessary because typically the economies of countries that desire this kind of control are so bad getting a subscription abroad is not affordable for common people anyway.

They’re not directly set by governments. But governments have a lot of influence over how mobile providers operate and, depending on government in question (e.g. China), if you want to keep your license you better do as you’re told.

So when will chat apps finally adapt to using TOR or I2P or Scuttlebut or any protocol that can not so easily be blocked?

Unfortunately unless there are financial incentive to do that it will not be adopted. Maybe try to get the porn industry to adopt these services first, maybe others will follow.

Telegram has proxies built in. You can activate it with a tap.

This reminded me of something I hadn't thought of in a long time. In the earlier days of bitcoin, there was a chat app that was using encrypted messages on the blockchain... I just spent ~5mins searching for it but can't remember the actual name. Is there anything else using the blockchain for chat?

I think you talk about bitmessage. It doesn't use blockchain, though, which is kinda useless, there is no need to store messages permanently without the way to remove them.

These systems mostly use blockchain as PKI or similar to bitcoin mempools with public crypto, but not store messages on blockchain.

Ah yes, seems I was misremembering. Thanks for the info.

Could it have been Status? [1]

[1] https://status.im/private-messenger/

Briar[1] supports Tor and works really well, but at the moment is limited to text-only chats.

1: https://briarproject.org/

Why don't messaging apps like Telegram use P2P, wouldn't that make it much harder to "block" people from using it, if the connection is directly between two devices?

Leaving aside the fact that p2p is certainly not feasible in mobile devices, something being p2p or federated does not improve the service's ability to evade censorship.

How would you block a p2p network like TOR? Just ban all the entry points. You can use proxies to access those, but then you can use the same proxies to access a centralized service.

How do you ban a federated network like Matrix or e-mail? Ban all the servers you can find, then you're back to proxies.

Why isn’t P2P chat feasible for mobile devices? Genuinely curious.

Apps on mobile devices are generally unable to maintain network connections while not in focus.

Is this due to the nature of iOS and Android and them not allowing apps to do that, or is there another limitation at play here?

iOS does not allow apps to be kept alive in background at all. On Android you can (mostly) keep an app open in background, but you should not, as it affects battery life.

Of course, another issue is that no device is always online, so you can't base the system entirely on devices communicating with each other peer-to-peer. You want to at least have supernodes. When you do, it effectively becomes a "dynamic federated network".

I remember reading something about a ban-evading technology that telegram used, that 'happened' to be ready just in time for russia to 'ban' it two years ago?

As I recall it, telegram was indeed banned, and was coming on and off line as it jumped servers among major cloud providers, resulting in major part of AWS and Azure IPs being banned as a collateral damage.

Then Telegram team came up with smart improvements to the protocol, like delivering individual IPv6 endpoint for each user via invisible push notifications.

https://www.theverge.com/2018/4/17/17246150/telegram-russia-...

https://www.reuters.com/article/us-russia-telegram-ipaddress...

> 'happened' (...) 'ban'

I'd like to understand the use of inverted commas here, as if things were not what they seemed. What gives?

the idea is that telegram is controlled opposition, with russia making a big show of banning it (ip blocking hugh suafs of aws) just in time for countermeasures to be completed

other background is that telegram was started by the same guy who founded vkontakt, russia's facebook, and that it advertises itself as having secure e2e chats, which are not default and are difficult to use

Is whatsapp blocked? If not, the question is why since that is supposed to be end to end encrypted.

I have no idea how the block works, but I learned that WhatsApp video calls are blocked in the United Arab Emirates, along with almost every other video chat app. There’s a UAE sponsored app called Totok that works, although it is/was removed from the Apple Store for privacy reasons. Recently they started allowing Zoom calls to go through.