Hacker News Reader

Comment by nrvn | Hacker News Reader

Signal could learn a lot from Telegram in this regard.

Russian govt had tried to block Telegram but telegram servers just keep jumping over various cidrs and users got the ip addresses for connecting over push updates and the only thing the govt succeeded in was blocking a wide range of subnets including AWS ranges and GCP ranges thus disrupting a whole lot of businesses and even some government services.

They gave up and lifted the ban eventually.

https://www.schneier.com/blog/archives/2018/06/russian_censo...

View on HN

That article notes that Signal has been domain fronting since 2016. I think google has cracked down on it more recently though, and hence Signal has had to circumvent censors in a new way

Correct, both Google and Amazon told Signal not to use them for domain fronting: https://signal.org/blog/looking-back-on-the-front/

Gross! I wonder what motivated these decisions inside Amazon & Google. This likely affects the Tor project domain fronting as well.

We really should not have let the majority of internet traffic be served by a small handful of giant companies without some legal protections as to what they're allowed to do.

Believe me, I'm all about reigning in big tech.

But I would be 100% against any law that required them to allow domain fronting. It's fine if they want to, but requiring them to basically open up/leave open a hole in their systems is not right.

Probably malware using domain fronting techniques for C2 traffic played a role in that decision. E.g. https://threatpost.com/apt29-used-domain-fronting-tor-to-exe...

In general there are many things that are beneficial when used by good actors and harmful when used by bad actors. That's just the nature of power.

I'm really bothered by blanket policies that prevent beneficial uses of a tool because it can also be used to cause harm. Google and Amazon need to figure out how to disambiguate the two.

What I recall from the discussion back then is, that domain fronting basically means, that Signal would disguise itself as google or amazon traffic. So I would say, it is understandable, that they decided this is not good for their buisness.

So it was not an act by google and amazon to activly harm Signal, but rather canceling ongoing support of Signal, that could put their buisness to harm, which is something different.

I don't know.

In the grand scheme of things, I don't like how much infrastructure technology giants control.

In this specific case, however, domain fronting is basically saying "if you want to ban me, you have to ban all of us", without asking if the rest of "us" consent to be put on the same boat.

It would be cool if they are, but it's perfectly understandable for them to disagree.

What about Cloudflare?

Answer from Cloudflare team seems to be "No" - https://community.cloudflare.com/t/could-cloudflare-support-...

Surprised by that considering their willingness to work with ethereum on resolving .eth domains through .eth.link domains.

There has to be a cleverer way to solve the problem of having several domain names on the same IP than just sending the desired domain name in plaintext.

And this new way, while less convenient, is arguably superior due to its decentralisation. They’re not just going after one service they’re now going after people all around the world running these proxies.

Just set one up myself took 15 minutes and that includes setting up a fresh VPS.

Just thinking what the best way to share it is.

I've been mulling this over today, as your ability to get the name/IP of the proxy has to be censorship resistant as well.

The best idea I've had so far is using a CNAME response to a very common DNS query which would pass a basic filter, like I'd ask for "mail.mydomain.com" and it would respond with a CNAME pointing to the actual proxy. I have dead domains which I have configured with null records for MX and stuff (so spammers can't abuse them), I could hide the name of my proxies in the MX records a CNAMEs and nobody would be the wiser...

The trick is getting the word out on how to do it - like "hey everyone, just ask random domains for "mx.domain.com" and use the 30 level MX" or something which would pass as legit traffic. Maybe...

Using innocent sounding CNAMEs on abandoned domains is definitely a smart idea.

I’ve definitely got some old domains kicking about, I’ll see how far off they are from expiration and do something similar if they have at least a few months left in them.

The proxies themselves can also be hosted at normal sounding domains and subdomains like cdn.technology.memes or whatever.

And when you point other domains to them as CNAMEs use equally regular looking subdomains no algorithm would pick up as a proxy like webmail.abandoned.tld.

If your scheme for conveying innocent sounding proxy domains requires it's own innocent sounding domains what have you added?

To my thinking, it creates a chain of "it's really hard to block them all" - as soon as I saw (via the link) that you submit your new proxy to https://signal.tube I thought "...so the Iranian gov't just has to block any and all access - DNS, HTTP - to that domain" and people can't even see what proxies are out there. So if my friendly domain name is "learned as a Signal proxy" they just block my domain (personally, I'd use two domains to double-blind it).

My conceptual idea is that how you get the person the name of the proxy to use has to hide as signal amongst the noise and not get trapped in DNS/domain blocking filters - and if it's keyword blocked by the Great Firewall, you just start asking other random domains for their MX records etc. I believe it's generally referred to as steganography: https://en.wikipedia.org/wiki/Steganography

Re-read the OP. No connection is actually made to `signal.tube`, it's only a placeholder domain for triggering an Android registered link handler so that it will open in their app.

Thought following yours, I like the CDN idea - if you add in some dynamic DNS updates with random CNAME results it could also help - ask for cdn.example.com, get node182.example.com and 5 minutes later get a different CNAME result injected from some cron job...

lol i accidentally rented a decent VPS for 30 days in switzerland and now I have a use case for it whoo

Thank you. It's heartwarming to read about successes like this.

Immediate recalling John Gilmore (GNU/EFF/etc.) in 1993:

"The Net interprets censorship as damage and routes around it."

I believe telegram itself is blocked in Iran, though.

It is indeed. Iran does not shy away from blocking large swaths of the internet in order to make sure the parts they want blocked will remain blocked. For example, before 2009, there were specific blogs on wordpress.com which were blocked and making sure the content the government wanted inaccessible would remain inaccessible had turned into a whack-a-mole game. In 2009, they simply blocked the entirety of Wordpress, Facebook, YouTube, etc. and made their jobs much easier.

Iran would not hesitate to block all AWS IP addresses as a solution (I don't know if that is how they block Telegram now). GCP resources would not load in Iran anyway because Google has a very strict (much more strict than AWS and Azure) interpretation of the sanctions, so they don't have to worry about them.

Telegram blocking in Iran is theoretical. There are still a great many Iranians successfully using Telegram (via proxies or modified versions of the app).

> It is indeed. Iran does not shy away from blocking large swaths of the internet

> ran would not hesitate to block all AWS IP addresses as a solution

DNS will not resolve any .ir (.coms that are iranian) domains here in US, afaikt.

Not at all true. Try http://www.president.ir/en

That does not resolve for me. Neither do any of the news sites. I even tried government ministries, such as en.mop.ir.

    simple$ ping president.ir/en
    ping: cannot resolve president.ir/en: Unknown host  
    simple$ ping en.mop.ir
    ping: cannot resolve en.mop.ir: Unknown host   
    simple$ ping tehrantimes.com
    ping: cannot resolve tehrantimes.com: Unknown host
    simple$ ping presstv.com
    ping: cannot resolve presstv.com: Unknown host

That might be something your ISP is doing. Try

  dig www.president.ir @8.8.8.8

Thanks. That got me the ip but browser won’t connect to it. So it’s blocked at the ip level. (Why would an ISP do this? Mine is one of the majors. Curious.)

Feels like there could be a good business in providing this CIDR-hopping push-updating proxy as a service other apps could embed. Like what CloudFlare does for DDoS protection, but as a forward-proxy + client middleware, instead of a reverse-proxy.

Depends on your definition of "good."

Dealing with hostility from government bodies is probably no fun.

While it worked in that case, it is not an invincible method.

Reply on news.ycombinator.com