Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Silent Circle removes warrant canary

techcrunch.com

Post reply on HN
Print view View original

171–180 of 197 posts

Re: Silent Circle removes warrant canary

#171

Post by logicallee »

digler999 wrote: post #168
logicallee wrote: post #26

Earlier quoted context omitted.

>That's a great way to end up in prison easy there, cowboy, this isn't East Germany just yet. I think American authorities can tell the difference between what they do and the Stasi. As in, I actually, literally think they can tell the difference. Nobody will be ending up in prison for posting the above. Seriously. Show me a judge who'll do that. You don't get a 4-year philosophy degree before getting a JD in America…

Can you put your money where your mouth is ? Like, can you put an Ethereum "contract" or something that says you bet $5k or more that nobody in the US in the next 5 years will be charged for using a warrant canary ? Suppose there were a way to contract that, would you bet that way ?

yeah I'd bet that way. Go ahead and note down my email somewhere, if in the next five years anybody is charged in the United States for publishing "we haven't been served any secret court orders" (or similar), or for removing that text - which is the two parts of how a warrant canary works - then you can email me and I'll paypal you a token payment.

Re: Silent Circle removes warrant canary

#173

Post by StavrosK »

tptacek wrote: post #131
cocotino wrote: post #116

Earlier quoted context omitted.

Is your resumé ready?

God I hope so. It's a pretty fun time to be Stavros and on the market looking for crypto work.

Thanks, Thomas. It was pretty disheartening to read that reply, especially since people can get into trouble for sharing their experiences. That said, I've done it before here, and SC management saw it, and they thanked me for being honest and speaking up, so I was generally fairly encouraged to do that in the past.

Re: Silent Circle removes warrant canary

#174

Post by StavrosK »

Osiris wrote: post #120
StavrosK wrote: post #104

I work for silent circle, as a backend developer. I speak for myself, and not the company. As far as I know (and, sure, I may not know, although if someone wanted something from the server I'm one of a few guys that could get it), we haven't received any letters. What makes me even more confident, though, is the fact that there really isn't much data to give. All we have is some ciphertexts for attachments, and messa…

Couldn't an NSL force the company to start retaining that information though? You may not have past data but you can certainly collect future information.

I honestly don't know, I'm not a lawyer and I'm not familiar with what the secret courts (the concept of which I openly have much disdain for) can make you do. Keep in mind that SC is a Swiss company, so I don't know how much the US can compel.

Re: Silent Circle removes warrant canary

#175

Post by JshWright »

lazaroclapp wrote: post #163
hendersoon wrote: post #133

Earlier quoted context omitted.

That's true. The only way that he or his company could truly be hurt is if Silent Circle did get a NSL and he admitted to it publicly. If they got a NSL and he lied about it, no harm will come to him. Or if he's telling the truth, obviously.

> The only way that he or his company could truly be hurt is if Silent Circle did get a NSL and he admitted to it publicly. At which point we are talking civil disobedience, so worrying about whether that will land them in trouble with management is missing the point by a mile and a half.

He's not a US citizen, and does not reside in the United States, so the legal risks to him personally are comparatively small.

Re: Silent Circle removes warrant canary

#176

Post by StavrosK »

noonespecial wrote: post #143
StavrosK wrote: post #104

I work for silent circle, as a backend developer. I speak for myself, and not the company. As far as I know (and, sure, I may not know, although if someone wanted something from the server I'm one of a few guys that could get it), we haven't received any letters. What makes me even more confident, though, is the fact that there really isn't much data to give. All we have is some ciphertexts for attachments, and messa…

>We don't even log IPs or other personal information, so I'm not sure what usefulness an NSL would serve. Perhaps you were just ordered to start... and plugging in that little black box from the G-Men somehow, umm, killed the canary process. Somehow.

Perhaps, but, if that were the case, I think our security officer (who is a great guy and great at his work) would have quit immediately on moral grounds.

It's more likely (and I'm just grossly speculating now) that the business weighed the relatively small chance of us being ordered to give the virtually zero amount of data we have on everyone with the chance that something will go wrong updating the canary and there will be a bunch of bad publicity again.

Keep in mind that, while one may think "you're just uploading a text file, how hard can it be", it's much more resource-intensive than that. You need multiple redundant people to make sure the world doesn't freak out because your CSO was on vacation, you need them to coordinate about updating, you need them to (crucially) know how to store the PGP keys securely, you need to keep that number low to make sure the key isn't stolen from one of them, you need good tooling to minimize the chance that there's a mistake while uploading, you need to keep the machines that host it running even after a move, the DNS entries up, monitoring to tell you if the canary is stale, etc.

It's a lot of things to get right and a lot of things that can go wrong, and the failure case for that is "your stock goes down", which is a heavy price. I think the mistake here was that there wasn't a bigger, more explicit and pre-emptive announcement (something like "we'll take the canary down in X weeks because Y"), which I think would have more successfully assuaged fears.

Re: Silent Circle removes warrant canary

#177

Post by 794CD01 »

voxic11 wrote: post #114
794CD01 wrote: post #82

Earlier quoted context omitted.

You have put yourself in a situation where you need to make false statements in order to comply with the law. If you create a deathtrap where you control a deadmans switch that prevents it from killing me, that doesn't absolve you of murder simply because the cause of my death is inaction rather than action.

Good thing he isn't murdering anyone then.

I think everyone agrees that not murdering people is a good thing, yes.

Re: Silent Circle removes warrant canary

#178

Post by 794CD01 »

dang wrote: post #167
794CD01 wrote: post #85

Members of the US military swear to support and defend the Constitution of the United States against all enemies, including domestic ones. Just because your family members might be oathbreakers doesn't mean everyone in the military is.

> Just because your family members might be oathbreakers Personal attacks (which attacking someone's family is) are not allowed on Hacker News. Please don't do this again. We detached this subthread from https://news.ycombinator.com/item?id=12038978 and marked it off-topic.

Are personal defenses, like mentioning your own family similarly not allowed? Or do the rules just make that an irrefutable argument?

Re: Silent Circle removes warrant canary

#179

Post by DavideNL »

linkregister wrote: post #115
DavideNL wrote: post #57

Earlier quoted context omitted.

> I'm not sure warrant canaries are particularly useful anymore > However, any company that stores user information is going to receive such an order or request at some point, it's practically inevitable. I assume you are talking about the U.S. only ? There are many other countries in the world, where gag-orders are not legally possible, or not as common as in the U.S. I would say warrant canaries are still useful th…

Which countries in the world don't have legally possible gag orders?

Quote from the article:

"However other non-US based encrypted comms companies, such as Germany’s Tutanota, do continue to maintain a warrant canary for transparency and good practice purposes, despite not being subject to legal gag orders in the country where they are based."

Re: Silent Circle removes warrant canary

#180

Post by nickpsecurity »

woodman wrote: post #149
nickpsecurity wrote: post #35

Earlier quoted context omitted.

Didn't know that. Icing on the cake of my claim. Not even me having anything against SEAL's: two in my family with one decorated. I just have to assume their loyalty will lead them to side with military or intelligence over Constitutional principles. It would be different if code was all open, jurisdiction + servers non-US, and review by mutually-suspicious parties. Then I could focus on product more than the subvers…

Imagine a long hallway segmented with closed doors, where each door represents a decision made during a mission. As you continue walking down the hallway, opening doors, the morality of each decision becomes more difficult to square with your original frame of reference. Finally you encounter a door that you decide to leave shut. That is roughly how it works, self selection. The SF groups that, to put it charitably,…

Interesting points. Your view on the evaluation process matches my observations of them and their organizations. The only problem is, with that background, what happens to average one when Uncle Sam needs them to kick open another door to protect America or other SEALs? And promises that backdoor will only be used by our spooks with no damage to American or other users?

I know that some would say no. I don't know how to tell ahead of time. It's a hard, general problem that's all probabilities and personality. Yet, with them, it's even harder.

Post reply on HN