realducksoft

realducksoft on Hacker News

Signal ignores proxy censorship vulnerability, bans researchers

Posted by realducksoft on Sunday February 07, 2021 @04:15AM
from the bleepingcomputer.com dept.

https://www.bleepingcomputer.com/news/security/signal-ignores-proxy-censorship-vulnerability-bans-researchers/

( Read More... | 6 comments | 36 points | on HN )

Re:Signal's TLS Proxy Failed to Be Probing Resistant on Saturday February 06, 2021 @04:46AM (#26045451)

Things has been updated. Signal banned @studentmain and @ducksoft from their GitHub organzation.

Re:Signal's TLS Proxy Failed to Be Probing Resistant on Saturday February 06, 2021 @02:11AM (#26044761)

So guys I've been blocked. See: https://web.archive.org/web/20210206065553/https://community...

Re:Signal's TLS Proxy Failed to Be Probing Resistant on Friday February 05, 2021 @05:34PM (#26042072)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

I am DuckSoft on GitHub and I prove my identity by GPG signing this message.

I am not typing too fast, nor pasting all my stuffs into the comment area. I just put a link to the GitHub issue. The discussion board even automatically extracted title and abstract for me, where I thought, 'pretty cool huh'.

Then I got banned. -----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE2H0QtOEy/6QN7CMrejqfpuT9So0FAmAdx9IACgkQejqfpuT9 So1KrQf+M8VzJBj4FgNZB/KZZ/suxNBF9DEkcfR66mwf/YzGGK9Gf2QDBqNoHUJs jJGvRai4ygqtZE3oX3GZmkjRT8LzEiNgmOM+B39SehL7F9rhMGz4lHMrRV5ZnSxp w5ALHSs3L6Gyg5hwNOQV73+STg9Vc2TsWSCS+Xr+BuNYbbLwiKWV9M1pxOynaWx0 J5+JswXaZkEONcKyGKbwc2FrgH1EXRgv+TipHucAkz+1HVMRd9NZ5W38vjASWEwO dEXXmCWyH8rQ69rLU+M7lXiKY0IBVrvVirzC97TpS22A74FDTdEG4xpGHSzPaDFp 3DRJvymGOlHDqhlotR8ox1ndFPzR9A== =ib+f -----END PGP SIGNATURE-----

Re:Help users in Iran reconnect to Signal on Thursday February 04, 2021 @07:37PM (#26031612)

Signal just closed their issue function there. See here: https://github.com/net4people/bbs/issues/60

Re:Help users in Iran reconnect to Signal on Thursday February 04, 2021 @02:54PM (#26029079)

This proxy failed to be probing resistant. The PoC code is released by studentmain: https://github.com/signalapp/Signal-TLS-Proxy/issues/3#issue...

Re:Help users in Iran reconnect to Signal on Thursday February 04, 2021 @01:25PM (#26028249)

Here is an interesting discussion: https://github.com/signalapp/Signal-TLS-Proxy/issues/3

Re:Help users in Iran reconnect to Signal on Thursday February 04, 2021 @12:37PM (#26027679)

Damn, I've read the code. This won't work against an active probe. Censors just use signal domains and non-signal domains to test your proxy. If signal domains get passed and non-signal domains got denied, you are fucked. Besides, TLS in TLS is highly identifiable by simple packet length dpi. I'd hope there's better plan.