Amazon threatens to suspend Signal's AWS account over censorship circumvention

Re:Amazon threatens to suspend Signal's AWS account over cen... by apendleton on Tuesday May 01, 2018 @03:42PM (#16970713)

Are you? It looks like the Amazon load balancers don't actually care what your SNI domain is when routing traffic. They terminate your TLS connection, and then use the domain in your actual HTTP request to route it, which is not Amazon's domain. Amazon's ability to allow these two domains to differ, and to mostly ignore the former, is the crux of this whole trick.

[ Parent | on HN ]

Re:Amazon threatens to suspend Signal's AWS account over cen... by textmode on Wednesday May 02, 2018 @12:36AM (#16974084)

Does this mean that Cloudfront does not actually require (correct) SNI?

Example: Sending HTTP request for signal.org over TLS to Cloudfront IP address with SNI as "allergan.com" returns signal.org web page, not allergan.com web page.

[ Parent | on HN ]

Re:Amazon threatens to suspend Signal's AWS account over cen... by computerfriend on Wednesday May 02, 2018 @08:14AM (#16976176)

Yes, this is the premise of domain fronting.

[ Parent | on HN ]

Re:Amazon threatens to suspend Signal's AWS account over cen... by bitCromwell on Tuesday May 01, 2018 @04:06PM (#16970962)

still lying though and it seems like that’s a foundational problem. it’s reasonable for a machine to refuse connections from a machine that has lied.

[ Parent | on HN ]