News for hackers. Stuff that matters.

A comment on Amazon threatens to suspend Signal's AWS account over censorship circumvention. Parent comment

Re:Amazon threatens to suspend Signal's AWS account over cen... by zaroth on Tuesday May 01, 2018 @07:54PM (#16972860)
Interesting. Reading their developer guide [1] pg 293 - CloudFront servers have all the private keys anyway, so it hardly matters—from a security perspective—which key is used to establish the TLS connection to the CloudFront endpoint. The connection between CloudFront and Signal’s own severs would be encrypted with Signal’s key.

I also found this paper on domain fronting to be a very good read - Blocking-resistant communication through domain fronting [2]

[1] - https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...

[2] - https://www.bamsoftware.com/papers/fronting/

[ Parent | on HN ]
Re:Amazon threatens to suspend Signal's AWS account over cen... by caf on Tuesday May 01, 2018 @08:58PM (#16973213)
Exactly. This works because the point of TLS in this instance is for the Signal client to be sure it's talking to Amazon CloudFront. The certificate for an Amazon service also hosted on CloudFront is certainly good enough to prove this, provided the client knows to expect it, which it does.
[ Parent | on HN ]