Encryption App 'Signal' Fights Censorship With A Clever Workaround

Wired ^ | 21 December 2016 | Andy Greenberg

[Lorianne]

Any subversive software developer knows its app has truly caught on when repressive regimes around the world start to block it. Earlier this week the encryption app Signal, already a favorite within the security and cryptography community, unlocked that achievement. Now, it’s making its countermove in the cat-and-mouse game of online censorship.

On Wednesday, Open Whisper Systems, which created and maintains Signal, announced that it’s added a feature to its Android app that will allow it to sidestep censorship in Egypt and the United Arab Emirates, where it was blocked just days ago. Android users can simply update the app to gain unfettered access to the encryption tool, according to Open Whisper Systems founder Moxie Marlinspike, and an iOS version of the update is coming soon.

Signal’s new anti-censorship feature uses a trick called “domain fronting,” Marlinspike explains. A country like Egypt, with only a few small internet service providers tightly controlled by the government, can block any direct request to a service on its blacklist. But clever services can circumvent that censorship by hiding their traffic inside of encrypted connections to a major internet service, like the content delivery networks (CDNs) that host content closer to users to speed up their online experience—or in Signal’s case, Google’s App Engine platform, designed to host apps on Google’s servers.

“Now when people in Egypt or the United Arab Emirates send a Signal message, it’ll look identical to something like a Google search,” Marlinspike says. “The idea is that using Signal will look like using Google; if you want to block Signal you’ll have to block Google.”

[Celerity]

I use it. The problem is that when one of my contacts install it, it tells me without their consent.

[AnotherUnixGeek]

I use it. The problem is that when one of my contacts install it, it tells me without their consent.

I also use Signal, on general principle. Unfortunately (or fortunately), nothing I have to say is really worth spying on.

[Squantos]

Signal, hushmail, gnupgp, tails, tor, hopping VPN’s et cetera ......

Drive the 5 eyes crazy.

https://en.wikipedia.org/wiki/Five_Eyes

Pretty sure its 14 eyes now....

https://www.my-private-network.co.uk/vpn-provider-14-eyes-country-something-know/

[Secret Agent Man]

There are different tiers of cooperation.

[Celerity]

” also use Signal, on general principle. Unfortunately (or fortunately), nothing I have to say is really worth spying on.”

I’ll be exercising this platform in a bit, right now I have built my own SMS server (And have applied for MM7 network access through the company that I own).

The SMS/MMS headers are easily cracked and spoofed, so I will be testing this app for holes. I may have already found those holes - but in order to TRULY encrypt the messages you should be sending MMS all the time anyway, which requires your data chipset to be turned on all the time.

[Squantos]

The “Its illegal for me to spy on mine” so you spy on mine and I’ll spy on yours society and then we will trade baseball cards over kool aid et cetera.

[mrsmith]

There’s no stopping encryption.
By trying to kill it- instead of encouraging a market for responsible encryption- governments are just guaranteeing an irresponsible market.

[LonePalm]

I also use Signal, on general principle. Unfortunately (or fortunately), nothing I have to say is really worth spying on.

And that is exactly the purpose of encrypting EVERYTHING you can. It forces the enemy (government or whatnot) to waste resources.

We did this to the Soviets. We encrypted EVERYTHING from operations messages, to pay records, to complaints about the quality of instant mashed potatoes to the same TS level. It becomes exponentially more difficult to break the encryption when you have no clue as to the subject of the target communications.

Everything looks the same so you then have to record EVERYTHING, every day, in the hope that you might be able to read that day's traffic in the future. Then, if you do break the encryption, you have to decrypt EVERYTHING and then sort through it to separate the gold from the dross. In the end you might well have spent more resources to get a nugget than the nugget is worth.

"Ceterum censeo Islam esse delendam."

Garde la Foi, mes amis! Nous nous sommes les sauveurs de la République! Maintenant et Toujours!
(Keep the Faith, my friends! We are the saviors of the Republic! Now and Forever!)
LonePalm, le Républicain du verre cassé (The Broken Glass Republican)