Alphabet's cyber unit Jigsaw introduces a new security app to bust censorship

https://techcrunch.com/2018/10/03/googles-cyber-unit-jigsaw-introduces-intra-a-security-app-dedicated-to-busting-censorship/

by sharcerer • 8 years ago

209 133 8 years ago

techcrunch.com

kypro• 8 years ago

Sounds like a cool way to track users wherever they go on the web.

kylnew2• 8 years ago

Without looking into the Privacy Policy for details on tracking, it seems like this would be a lesser of two evils situation. Either experience censorship in your country or see everything, with the caveat that Google logs it.

bad_alloc• 8 years ago

A country that censors content will be very interested in obtaining these logs from Google. Since they seem to be willing to cooperate with state actors, users might set themselves up for reprecussions later on.

lallysingh4• 8 years ago

So choose another DNS server. It's configurable.

m-p-3• 8 years ago

It's basically a DNS-over-HTTPS client for Android, acting as a VPN client to route DNS traffic only.

You can use your own DNS-over-HTTPS server if you want to.

Belphemur3• 8 years ago

I've been using Intra with my own DoH server for months already. It's stable and updated regulary:

https://github.com/Jigsaw-Code/intra

Also, if you're looking for a DoH server that block adverts, here is mine:

https://dns.aaflalo.me/dns-query

Boulth3• 8 years ago

Also, if you're looking for a DoH server that block adverts, here is mine:
https://dns.aaflalo.me/dns-query

Great! I've been looking for something like this for a long time. Is the source code open? Not that I don't trust you with my DNS queries but...

Belphemur3• 8 years ago

I've written the step I used to do the DoH part.

https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https...

Still need to document the PiHole part.

I've also disable all logging for Nginx and Pihole. The server is also listed on https://dnscrypt.info/public-servers

Also, if you're in the American Continent, you might want to use the proxy I setup on Google Cloud Platform:

https://dns-gcp.aaflalo.me/dns-query

sharcerer3• 8 years ago

Does your server allow Google Ads because honestly, I would feel like a hypocrite blocking their ads as those ads basically pay for what Jigsaw does. Just saying.

Belphemur3• 8 years ago

Unfortunately it's the first one present in all DNS blacklist.

I don't think you'll find a dns server that block ads that have whitelisted Google Ads.

sirn• 8 years ago

Just want to add: if anyone running iOS, you might want to try DNSCloak[1] which is a small wrapper over dnscrypt-proxy. I've been using it for a while and it has been reliable so far.

I also run my own DoH server in Singapore that block adverts[2] with Ansible script to deploy it to any FreeBSD servers[3] :-)

Edit: looks like mine doesn't supported running with Intra quite yet. Will work on it tonight.

[1] https://itunes.apple.com/us/app/dnscloak-dnscrypt-doh-client...

[2] https://sg.dns.grid.in.th/dns-query

[3] https://github.com/sirn/gridns-deploy

21• 8 years ago

This is richly ironic. I had to check that this was not an article from The Onion.

Will this tool bypass the censored Google that will be introduced in China?

More likely it will automatically report the user to the Chinese government if used in China.

mtgx• 8 years ago

It probably won't even be available to Chinese users.

394549• 8 years ago

Maybe it will, but have a country-specific feature to report its users to the authorities. After all, gotta comply with those "local laws and regulations."

bilbo0s• 8 years ago

It wouldn't work in China anyway. So it can be available there, or not available there. Would make no functional difference.

bubblethink• 8 years ago

This is about preventing dns manipulation attacks. That assumes that a DNS server (like 8.8.8.8) is generally accessible, but an adversary is trying to manipulate the responses. In China, you anyway can't access regular global dns servers. You need to use official dns supported by the government. So the question of dns manipulation is moot.

ghostly_s2• 8 years ago

So that makes it morally consistent...how?

thisgoodlife• 8 years ago

This is not true. I tried 8.8.8.8 and it worked when I visited China 2 years ago.

samswin• 8 years ago

It will tell the user to the chinese government, in a way.

1. All DNS traffic from intra must go through the chinese national firewall. Although the firewall cannot see or tamper the data, it can tell whether it is encrypted.

2. Most DNS traffic are not encrypted. Intra users will be very easy to discover to the firewall, like a flare in the night.

3. One's name is linked to one's IP in china, and encryption alone cannot hide the user IP.

It may work in some other nations. But not china.

jerkstate• 8 years ago

Given Google's track record of working with oppressive governments, why would anyone rational trust them with this kind of sensitive information?

sharcerer3• 8 years ago

I think Jigsaw has a good record of making tools which work for the oppressed sections or in areas of cybersecurity/censorship etc. Good work must be appreciated. I don't think any other Big Co. has a division dedicated to solving such specific problems. Yeah, the China bit is really saddening/irritating. They're gonna crush their own legacy.

r3bl5• 8 years ago

Don't forget about the Project Zero team!

Regardless of my privacy concerns regarding Google and other Alphabet-owned businesses, Jigsaw and Project Zero teams deserve to be praised by anyone who gives a shit about privacy/security.

pjc50• 8 years ago

What this appears to be is a DNS-over-HTTPs proxy application, which will route your DNS traffic directly to Google bypassing any substitutions or deletions made by your local ISP or government.

Whether the advantages of that outweigh giving google your DNS traffic (and realistically they already know every site you visit, because almost everyone uses google analytics) depends on your local security situation.

Note that your local security situation may include the good old rubber hose attack: https://security.stackexchange.com/questions/194353/police-f...

daveFNbuck• 8 years ago

It can be configured to use any DNS-over-HTTPs server, and has cloudflare hard-coded as an option. When you first install it, they have a short onboarding that ends with asking you to enable needed permissions and informing you that you can use other providers, so you have a chance to change the settings before enabling the permissions.

Ajedi32• 8 years ago

So it's just a way to backport support for DNS-over-TLS to older Android versions? Neat, but not as big a deal as the article headline might lead you to believe.

LethargicStud• 8 years ago

Can someone explain why a government couldn't block the IP of this service? Whether it's a VPN or just dns over https, it seems the servers wouldn't have infinite dynamic ips and could therefore be blocked.

Boulth3• 8 years ago

Yes you're right. That app is just dns over HTTPS for older Android phones. With all its caveats.

kim0• 8 years ago

Yep that's how countries like Egypt block things, lovely reset packets! But activists pretend that doesn't happen sigh

philip1209• 8 years ago

These dual standards for censorship annoy me.

Google on Venezuelan censoring: bad, fight it

Google on Chinese censoring: complicit, support it

malvosenior2• 8 years ago

Google on Google censorship: ship it!

https://www.washingtonpost.com/news/morning-mix/wp/2018/03/2...

notyourday• 8 years ago

You see, Venezuelans dont have enough money for Google to extract.

Shivetya• 8 years ago

Google isn't the only big tech company to cave to China's demands

aikah• 8 years ago

Google is one of these US tech companies claiming they have moral values in their code of conduct, using such words as "evil".

bun_at_work2• 8 years ago

Just a few things:

1) This tool is made by an Alphabet owned company (Jigsaw), not Google, another Alphabet owned company. The companies will have different missions, even if profits flow the same direction.

2) Venezuela doesn't have a huge market where Google is blocked by a nation-wide firewall.

3) China has a nation-wide firewall blocking any Google service, thereby forcing Google to negotiate how their service works if they want to make money there.

Note: Oversimplifying the situation for the sake of pitchforking a company you might not like does no one any good. Venezuela and China are very different companies, in very different environments. Google as a company (and Alphabet, probably more so) is almost certainly anti-censorship, philosophically; they just don't operate in a vacuum.

malvosenior2• 8 years ago

Can I ask you if you work for Google? If so you should probably disclose that because you post history makes this very much look like astroturfing.

Sorry for bringing this up (I never do that on HN) but this is just too questionable of a defense to be putting up.

whatshisface3• 8 years ago

Google as a company (and Alphabet, probably more so) is almost certainly anti-censorship, philosophically; they just don't operate in a vacuum.

Since when was being motivated to do wrong a mitigating condition for having done wrong? "Sorry officer, I wasn't going to steal it at first, but then I started wanting it."

HillaryBriss• 8 years ago

...thereby forcing Google to negotiate how their service works if they want to make money there.

I'm struggling to see how this addresses the point about Google's variable standards. I mean, are you saying that somehow because Google needs to adjust its standard to make money in a particular market that it therefore doesn't have variable standards?

Not quite following you ...

codeisawesome• 8 years ago

Venezuela and China are very different companies

c o m p a n i e s

pretendscholar• 8 years ago

2) Venezuela doesn't have a huge market where Google is blocked by a nation-wide firewall.

How is that a justification?

jackhack• 8 years ago

related to #1 -- I predict if some division of Alphabet threatens the income of another larger division (esp. Google), the smaller one will be shut down.

This is the reason for much of Sony's failure/inability to build a usable mp3 player. They built amazing music playback devices, but the record label division was so terrified of 'piracy' they forced the hardware division to require a proprietary encryption format (no "plain" mp3s) which essentially ruined the usability. So the company that built the walkman was hobbled, deliberately. Even the Poor Sony Aibo robot dog had to use specially modified Sony memory sticks with encryption and keys written into the normally-unwritable boot sector.

xg15• 8 years ago

China has a nation-wide firewall blocking any Google service, thereby forcing Google to negotiate how their service works if they want to make money there.

So if the Chinese demand they get real-time access to all information Google has stored about anyone, or Google gets banned from China, they should do that too?

guelo• 8 years ago

if they want to make money there.

That's the point. Google is willing to throw out their supposed principles in order to make money.

jlarocco2• 8 years ago

I'm not sure I understand what you're getting at.

Alphabet and Google can't claim to be against censorship while they're profiting from it. They can't have their cake and eat it too.

Clearly the only thing Google and Alphabet are "for" is making more money, so there's really no point pretending they have a moral compass guiding them.

freewizard• 8 years ago

Yes, dual standards because of dual internets. Alphabet is contributing to the trend of dual internets predicted by its own ex-CEO Eric Schmidt[1], "a Chinese-led internet and a non-Chinese internet led by America".

[1] https://www.cnbc.com/2018/09/20/eric-schmidt-ex-google-ceo-p...

cmg• 8 years ago

It's blatant hypocrisy. Google has also de-ranked both Russia Today and Sputnik, but apparently doesn't doesn't consider that "censorship."

https://www.pcmag.com/news/357494/google-to-de-rank-rt-sputn...

colordrops• 8 years ago

YouTube is another example of gross censorship.

foobiekr• 8 years ago

Perhaps this project is to create demand for Google-China-like solutions in other countries. Venezuela is not a large market but perhaps they want a demo vehicle for Saudi Arabia to witness to help get them a deal (and a more favorable one than China).

The most profitable SW projects often have a lot of reuse.

CharlesW• 8 years ago

Maybe the strategy is to service Sneetches with both Star-On and Star-Off machines.[1]

[1] https://en.wikipedia.org/wiki/The_Sneetches_and_Other_Storie...

fstonemeyer• 8 years ago

This is the same division of Google that came up with an AI to determine if a comment is "toxic": https://jigsaw.google.com/projects/#perspective

jillesvangurp• 8 years ago

Sounds like a good idea. Most users have so far very little control over android dns and using TLS sounds like a good idea in any case. Makes you wonder why this is not more widespread given that there are a lot of nasty attacks that involve dns hacks.

msravi• 8 years ago

Firefox 62 has DoH support enabled.

https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

Has been plenty useful getting around court -ordered clampdowns on torrent sites in India.

You can configure it to use any publicly known DoH server: https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...

RcouF1uZ4gsC• 8 years ago

I find it ironic that both CloudFlare and Google which this app uses, were involved in the censorship of DailyStormer. It was a vile site and Google and ClouFlare were fully within their rights to terminate their business agreement with them. However, they do not also get to turn around and claim the high moral ground of being anti-censorship in principle. So this is not about censorship vs free speech, it is about government vs corporate censorship.

s73v3r_• 8 years ago

Choosing not to do business with a company is NOT censorship. The only way you could believe it to be so is if you believe that the Daily Stormer has a right to speech, but no one else does.

r3bl5• 8 years ago

Can we get a rename of this story?

"Alphabet's Jigsaw" would be more appropriate. Jigsaw is, at best, a sibling of Google, not a part of Google.

It is explained in the very first sentence, but comments so far don't seem to acknowledge that.

ghostly_s2• 8 years ago

Well, the story also claims there are plans to build it in to Android, so apparently they are at least working in close concert.

briandear• 8 years ago

Semantics. No rational person would believe that anyone other than Larry Page is calling the shots.

mikeash• 8 years ago

This is an interesting communications dilemma.

I don't think most people have really understood the Google/Alphabet transition. When most people think of "Google" they're actually thinking of Alphabet.

If you say "Google" then you're conveying the correct information using the wrong term. If you say "Alphabet" then you're using the right term but a lot of people won't know what you're talking about. What to do?

This is probably less of a problem on HN than it is for TechCrunch.

CydeWeys• 8 years ago

I would really hope that everyone on HN knows what Alphabet is by now. If necessary, it can be written as "Alphabet (Google's parent company)". The TechCrunch crowd is pretty similar and should mostly know this too, right?

blfr2• 8 years ago

Don't know about most people but I understand the idea of a holding company. I don't care though.

It's still Google because it's the most important part. A synecdoche, not a misconception.

r3bl5• 8 years ago

Out of interest, I searched for the Waymo tag in TechCrunch, and they seem to start the related articles with the following:

Waymo, the former Google self-driving project that spun out to become a business under Alphabet, ...

Didn't look through all of them, but couldn't find an instance in which Waymo is represented as Google's Waymo anywhere, let alone in the title.

antidesitter• 8 years ago

This is an interesting communications dilemma. I don't think most people have really understood the Google/Alphabet transition.

If the media consistently referred to Google as Google and Alphabet as Alphabet, people would learn the difference more quickly. Using one term for the other is just delaying this process and sowing confusion.

sctb• 8 years ago

Good point, let's try “Alphabet” in the title here instead.

ccnafr2• 8 years ago

The confusion is also because despite being Alphabet-owned... most of these smaller companies are listed under a Google domain, so people believe they're Google-owned instead of Alphabet-owned.

https://jigsaw.google.com/

samat• 8 years ago

The problem Intra solves is very real. MiTM attack on the DNS are the simplest ways to censor internet access and they are widely used in many countries.

I do despise google's efforts in dismantling any privacy which is left on the internet, but this particular program is very good.

I don't get this attitude of 'don't take a cake from the devil'. A) google is not devil, just another megacorp B) don't be blinded with slogans, evaluate merits of each offer individually. This particular offer is great and helps real people aka 'makes the world a better place', lol.

x2206• 8 years ago

If Google considers handing off private info to China, which is known to execute people with disliked political beliefs, it's not self-evidently wrong to compare Google and their executives to the devil.

Edit: if you want to downvote, please also reply with your ideas and tell me why you disagree with me.

r3bl5• 8 years ago

I've seen no comment here ever praising Google's actions in China here, and I'm very doubtful I will.

That said, this particular product, which has nothing to do Google's business with China, is absolutely crucial for people facing censorship elsewhere, and it is without a doubt a morally good product. You can't even claim that they're doing it solely to gather DNS data (for whatever reason), because if they were making an attempt at that, they would sure as fuck wouldn't allow you to choose Cloudflare.

You can sit here and call that hypocritical because of Google's relationship in China, but that doesn't make their solution any less good to those facing censorship. Nobody else stepped up. Jigsaw did, and they deserve to be thanked for that.

Even if someone's intentions are evil in nature, you're not going to make them less evil by saying "who cares, you're evil" whenever they do something good.

jigaway2• 8 years ago

I couldn't help but guffaw at this headline, given that Jigsaw's current flagship product is an automated censorship bot [1]. This is another example of the absurd belief that only ISPs can censor the internet, and not trillion dollar platform companies with monopolies or near-monopolies in several areas.

[1] https://www.nytimes.com/2017/02/23/technology/google-jigsaw-...

marcusjt• 8 years ago

Play Store URL is https://play.google.com/store/apps/details?id=app.intra

wnevets• 8 years ago

I've been using Jigsaw's VPN Outline, it seems to work pretty good on digital ocean

sigmar• 8 years ago

anyone using this on LineageOS 15.1? Seems to connect okay, but chrome gives "err_network_changed" when I go to any site and I'm not sure how to debug...

ccnafr2• 8 years ago

Source, for a lot more details: https://medium.com/@JigsawTeam/introducing-intra-a-new-app-t...

bArray• 8 years ago

The app itself fails a DNS leak test, is this app trustworthy?

bad_user• 8 years ago

Good job Google.

I'm a very harsh critique of Google due to the threat they pose for privacy, however here they are doing a good thing, along the lines of the public DNS servers they provide, which I know have helped people [1].

Having your requests go through Google is not ideal, however not many people have the capacity to search for better, but more obscure solutions.

Also this isn't about privacy, but about working around censorship at the DNS level. If you want privacy, you use an anonymous VPN or Tor. And frankly, if you can't trust Google's privacy policy for this service, then you shouldn't use a Google phone.

[1] https://developers.google.com/speed/public-dns/

asimpletune• 8 years ago

It’s cool though that they allow you to use cloud flare if you want.

i_phish_cats• 8 years ago

And yet another part of the company is creating a censored version so that the CCP will let them back into china.

anotherevan• 8 years ago

Yes, that irony was not lost on me either. I was thinking that someone should introduce Google's left and right hands to each other.

bduerst2• 8 years ago

I mean, China's the one censoring it. Google could link to the censored websites in the results but that would be a terrible user experience. Wouldn't it be better to do what they do with DMCA takedowns in the US, where they tell you how many results have been removed and why?

And Google already censors search results in the EU with the right to be forgotten, where they've received 41,000 requests from EU politicians, so there is precedence in working with local governments

apeace• 8 years ago

1) What's stopping these countries from blocking the hard-coded Google/Cloudflare IP addresses? Doesn't seem like a great solution technically speaking.

2) I wouldn't use this if I lived in China. Companies operating in China are required to turn over data about their users to the government. And Google is soon going to be partnering with China to release a censored version of their search engine[1]. Now they can provide the government your entire browsing history, not just your searches!

[1] https://theintercept.com/2018/08/01/google-china-search-engi...

tomp• 8 years ago

That makes it easy for oppressive governments — like Turkey, which has used this technique before — to intercept web addresses requests and either kill them in their tracks to stop sites from loading, or redirect to a fake site.

Or "non-oppressive" governments like the UK.

SonnyWortzik• 8 years ago

oh just turn it on an use it huh? And collect all of my web queries. Clever. Yet another mass collection scheme by Alphabet. I have to give it to Google(the real company here), they sure know how to embed themselves everywhere in your life.

codr4• 8 years ago

Security apps from the Alphabet agency's cyber unit, nice. At least they're not mandatory here yet...

e40• 8 years ago

Near as I can tell, can't be used with things like Blokada that create a VPN.

jedisct1• 8 years ago

In other DNS-over-HTTPS news, dnscrypt-proxy 2.0.17 has been released: https://github.com/jedisct1/dnscrypt-proxy

thefounder• 8 years ago

How is this different than simply setting Google's DNS servers on your router or wifi settings ?

Alphabet's cyber unit Jigsaw introduces a new security app to bust censorship

Related Stories