Signal hid its traffic inside Google's, so blocking the app meant blocking Google

In December 2016 the encryption app Signal, a favorite of the security community, hit the milestone every subversive developer knows: repressive regimes started blocking it. Egypt and the UAE had put it on their blacklists within days of each other. Open Whisper Systems answered that Wednesday with an Android update that restored unfettered access in both countries using a trick called domain fronting; an iOS version was close behind.

Founder Moxie Marlinspike explained the mechanics: a country like Egypt, with a few small government-controlled internet service providers, can block any direct request to a blacklisted service. But inside a TLS connection to Google's App Engine, the request that redirects to Signal's domain is encrypted, so the provider sees only a connection to google.com. 'Now when people in Egypt or the United Arab Emirates send a Signal message, it'll look identical to something like a Google search,' Marlinspike said. 'If you want to block Signal you'll have to block Google.'

Signal was not inventing alone: Tor, Psiphon and Lantern already used domain fronting, and it works over CDNs like Cloudflare, Akamai and Amazon CloudFront. 'All of that together represents a large chunk of internet traffic,' Marlinspike said — 'Eventually disabling Signal starts to resemble disabling the internet.' Wholesale shutdowns do happen: Egypt cut its entire internet during the 2011 Arab Spring protests, and Brazil blocked WhatsApp during a drug investigation. Both blocks were short-lived; only a few states are willing to censor the internet wholesale for long.

Marlinspike said countering new blocks was a high priority — he had rushed out Arabic versions of Signal's predecessor apps for Arab Spring protesters five years earlier — and bet that in countries not willing to shut down the internet entirely, the technique would hold: 'It's possible that these countries will respond. But the endgame is that we'll win.'

Route censored traffic through a giant nobody dares block: inside TLS the hostname is invisible, so a Signal message looks like a Google search.

TLS encrypts the hostname, so the censor's block decision can only use the IP address — and the IP belongs to Google.

Borrowed scale is the shield: the front is a service the censor's own population depends on and cannot easily lose.

The trick is portable across Google, Cloudflare, Akamai and CloudFront, so blocking one front leaves the others standing.

Camouflage beats armor: instead of resisting the censor, make your traffic indistinguishable from flows the censor cannot afford to block. Borrowed scale is a shield no blacklist can work around.

Android users in Egypt and the UAE could update around the block immediately, with iOS to follow. The technique remained in the censorship-evasion toolkit, and Marlinspike's framing — block Signal or block Google — became the canonical statement of the censor's dilemma.