Meredith WhittakerOct 27

šŸ“£THREAD: Itā€™s surprising to me that so many people were surprised to learn that Signal runs partly on AWS (something we can do because we use encryption to make sure no one but youā€“not AWS, not Signal, not anyoneā€“can access your comms).

Itā€™s also concerning. 1/

Show threadMeredith WhittakerOct 27
Concerning, bc it indicates that the extent of the concentration of power in the hands of a few hyperscalers is way less widely understood than Iā€™d assumed. Which bodes poorly for our ability to craft reality-based strategies capable of contesting this concentration & solving the real problem. 2/
Show threadMeredith WhittakerOct 27
The question isnā€™t "why does Signal use AWS?" Itā€™s to look at the infrastructural requirements of any global, real-time, mass comms platform and ask how it is that we got to a place where thereā€™s no realistic alternative to AWS and the other hyperscalers. 3/
Show threadMeredith WhittakerOct 27
Running a low-latency platform for instant comms capable of carrying millions of concurrent audio/video calls requires a pre-built, planet-spanning network of compute, storage and edge presence that requires constant maintenance, significant electricity and persistent attention and monitoring. 4/
Show threadMeredith WhittakerOct 27
Instant messaging demands near-zero latency. Voice and video in particular require complex global signaling & regional relays to manage jitter and packet loss. These are things that AWS, Azure, and GCP provide at global scale that, practically speaking, others (in the western context) donā€™t. 5/
Show threadMeredith WhittakerOct 27
This isn't ā€˜'renting a server.' It's leasing access to a whole sprawling, capital-intensive, technically-capable system that must be just as available in Cairo as in Capetown, just as functional in Bangkok as Berlin. Particularly given the high stakes use cases of many who rely on Signal. 6/
Show threadMeredith WhittakerOct 27
Such infrastructure costs billions and billions of dollars to provision and maintain, and itā€™s highly depreciable. In the case of the hyperscalers, the staggering cost is cross-subsidized by other businessesā€“themselves also massive platforms with significant lockin. 7/
Show threadMeredith WhittakerOct 27
Meaning that infrastructure like AWS is not something that Signal, or almost anyone else, could afford to just ā€œspin up.ā€ Which is why nearly everyone that manages a real-time serviceā€“from Signal, to X, to Palantir, to Mastodonā€“rely at least in part on services provisioned by these companies. 8/
Show threadMeredith WhittakerOct 27
But even if Signal had the billions needed to recreate AWS, itā€™s not just about money. The talent to run these systems is rare & concentrated. The expertise, the tooling, the playbooks, the very language of modern SRE came out of these hyperscalers, and is now synonymous with 'the cloud.' 9/
Show threadMeredith WhittakerOct 27
o, yes, Signal runs on AWS. It also runs on your phone, which runs on iOS (Apple) or Android (Google). And on Dekstop, via Windows (Microsoft). Each of these presents similar dependencies on large entrenched tech companies, and concomitant barriers and risks. 10/
Show threadMeredith WhittakerOct 27
In short, the problem here is not that Signal ā€˜choseā€™ to run on AWS. The problem is the concentration of power in the infrastructure space that means there isnā€™t really another choice: the entire stack, practically speaking, is owned by 3-4 players. 11/
Show threadMeredith WhittakerOct 27
So, Signal does what we can to provide a service w integrity in the concentrated ecosystem we're working in. We protect your comms w end-to-end encryption, so that we can use AWS and others as a highway across which to send Signal data in ways that donā€™t let AWS, or anyone else, gain access. 12/
Show threadMeredith WhittakerOct 27
To conclude: my silver lining hope is that AWS going down can be a learning moment, in which the risks of concentrating the nervous system of our world in the hands of a few players become very clear. And that this can help us craft ways of undoing this concentration and creating real choice ā¤ļø 13/
Show threadyawnboxOct 27

@Mer__edith

The tor network has had 100% uptime. 100%

Show threadDavid Penfold Oct 27
@yawnbox @Mer__edith Try running video calls over Tor.
Show threadArneBabOct 27

@davep You can run video calls over jitsi.

IPv6 was supposed to solve NAT, so fewer servers would be needed. Supposed to.

@yawnbox

Show threadDrYakOct 27

@ArneBab @davep @yawnbox Note that in the specific use case of Signal: given their threat model, "direct peer-to-peer connections by default" are not desirable. You'll need to bounce the audio&video traffic by default to make it more costly to infere who is talking with whom.

So the fact that working NAT and IPv6 help rely less on TURN servers won't help decentralize that much.

Show threadArneBab

@dryak Maybe a start could be to switch to direct peer-to-peer connection if Signal sees that both sides are in the same subnet (i.e. on the same wifi).

In that case they connect to the signal server for connection with a voice-data profile *at the same time* which already gives away that they are talking, so staying in the subnet with a direct peer-to-peer connection would reduce the total privacy loss.

@davep @yawnbox

Oct 27 at 2:36pmWeb
Show threadArneBabOct 27

@dryak but firstoff, to stop discussing with too little information: the reason they use a forwarding server is that a single device canā€™t send video to 40 people via direct connections.

Hereā€™s their description: https://signal.org/blog/how-to-build-encrypted-group-calls/

That also shows the level of complexity involved already.

@davep @yawnbox

How to build large-scale end-to-end encrypted group video calls

Signal released end-to-end encrypted group calls a year ago, and since then weā€™ve scaled from support for 5 participants all the way to 40. There is no off the shelf software that would allow us to support calls of that size while ensuring that all communication is end-to-end encrypted, so we bui...

Signal Messenger
Show threadDavid Penfold Oct 27
@ArneBab @dryak
A mutual friend sent me Moxie's original white paper for Signal's use of TPMs, but I lost it and can't find reference to its use now (it's been nearly a decade...). Anyone got any resources? It's potentially an impediment to decentralisation, but my memory is hazy.
Show threadDavid Penfold Oct 27

@ArneBab @dryak

Things may have moved on since then, "attest: Functionality for remote attestation of SGX enclaves and server-side HSMs."

https://github.com/signalapp/libsignal?tab=readme-ov-file

Show threadKevin Karhan Nov 4

@davep @ArneBab @dryak yeah, the same #proprietary shitboxes thar get hacked so often.that #Intelcyeeted that from #Consumer #CPU|s and now there's no "legal" way to play #4K #BluRayDisc|s on modern systems.

Moxie trusts too much into the silicon of parties who's goals are irreconcileable at odds with his demands.

But I guess that's normal with @signalapp folksā€¦
https://infosec.space/@kkarhan/114935952643402592
https://infosec.space/@kkarhan/115492122419368937
https://infosec.space/@kkarhan/115492154062048948

Kevin Karhan :verified: (@[email protected])

My [reservations](https://infosec.space/@kkarhan/114234551915193036) and [criticism](https://infosec.space/@kkarhan/114862595629371002) re: #Signal are not just valid, but the reality is *even worse than I thought*: - The fact that @[email protected] requires not only their shitty #Android #App, and a #PhoneNumber but literally won't allow people to use their shitty #Desktop-App unless they have an Android device with a camera pointed at it makes it utterly unuseable for certain users *who don't have a fucking #camera in their Android*ā€¦ Seriously, do they expect folks to deal with that shit? - It's already worse in terms of #UX than #telegram and #discord and that too makes #XMPP+#OMEMO clients like @[email protected] / #monoclesChat & @[email protected] / #gajim easier and faster to onboard #TechIlliterates onto. - Whichever asshole decided that a *replacement for #SMS* should mandate #PII like a #PhoneNumber & not be natively cross-platform should be banned from doing any #tech in their life. Trying to circumvent this shit and helping folks with it makes me so fucking angry that I'm now explicitly refusing to support it! FIX THAT SHIT, @[email protected], and if it means you need to kick some devs in their crouch then consider this a necessary *"investment"*ā€¦ #sarcasm #TechSupport #TalesFromTechSupport #Enshittification #SignalSucks #TelegramSucks #Messengers

Infosec.Space