Hacker News Reader

Comment by superkuh | Hacker News Reader

What happens when Iran's government itself runs a bunch of these proxies?

Even worse, what happens when they MITM all of the installs because the docker container has really bad security such as:

RUN wget http://nginx.org/download/nginx-1.18.0.tar.gz

https://github.com/signalapp/Signal-TLS-Proxy/blob/master/ng...

Installing via HTTP, with no verification of installer seems like a reallyyyyy bad idea.

That’s awful.

I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not).

[1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6

They have completely disabled issues on that repository. Wow I used to really like Signal...

And it seems they've fixed the issue, without any kind of public comment.... still not great: https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97da...

I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2), and it looks like they welcome contributions, because they merged mine.

Sorry for not noticing your PR before filing the bug.

I still find the way they (partially) dealt with this a bit worrisome.

Wouldn't it be saner to also verify the downloaded archive hash? It looks like the domain resolving of nginx.org is trusted without doubt.

Sure! I also opened another PR to check the archive signature: https://github.com/signalapp/Signal-TLS-Proxy/pull/10

You'd be building and running these outside of Iran for them to work, which would limit the Iranian government's ability to perform the attack you describe.

If all the traffic going via the proxies is e2e encrypted is there much that can happen?

But the fact that you are in Iran and using Signal may get you added to a watchlist. They can trace the IP addresses connecting to the proxy server back to a household or phone, no?

I don't think Iran is as oppressive a regime as you make it out to be. AFIAK the act of using (or attempting to use) Signal is not illegal. The resources required to trace an IP and track down the user simply because they used a messaging app seems unfeasable. Not to mention IP addresses on mobile devices are highly dynamic especially if you're jumping between wifi and cellular. Correct me if I'm wrong but I think in practice it's pretty hard to link IP addresses to actual individuals.

Not much. It's 99% certain that Iran already has the IPs of all Signal users, and they haven't penalized people for using encrypted messaging as of now.

Reply on news.ycombinator.com