Is it safe to assume then that WhatsApp is not secure? Unless their data has been subpoena'd as well?
Grand jury subpoena for Signal user data
21–30 of 258 posts
Re: Grand jury subpoena for Signal user data
#22I love that they gave them the info in unix millis.
A serious question though, how do gag orders work? How do I notify an attorney?
Re: Grand jury subpoena for Signal user data
#23It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…
> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth.
Yeah both of these are a pretty large problem for a messaging service designed to replace SMS on phones. Really anything other than a forum or email replacements will have a very hard time getting adopted if they have too much latency.
Re: Grand jury subpoena for Signal user data
#24Earlier quoted context omitted.
What metadata? All they were able to produce was whether or not a phone number was associated with Signal at all , and the last time that phone number's account pinged the Signal service for any reason . They produced virtually no metadata to the investigation.
They would also be able to figure out what phone numbers it was communicating with, at what times and how often - they do the routing. We're relying on them not to store that metadata, which is the problem.
How would they be able to do that? Can you quote where in the article you got that and how that would happen?
"Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's groups), or any records of who a user has been communicating with."
If they don't store the contacts, or even a hash of the contact, how can you figure out who was talking to who?
Re: Grand jury subpoena for Signal user data
#25Earlier quoted context omitted.
What metadata? All they were able to produce was whether or not a phone number was associated with Signal at all , and the last time that phone number's account pinged the Signal service for any reason . They produced virtually no metadata to the investigation.
Only because they don't store it. They are able to choose to store it at any point; we can only rely on their honesty (and lack of compulsion). It's better to have a protocol in which there isn't any significant metadata to choose to store. I don't distrust them today, but I have no way of knowing what their future behaviour will be. I'd prefer not to have to trust.
Ah, I understand now. Thanks.
Re: Grand jury subpoena for Signal user data
#26Good stuff Moxie and OWS!
And ACLU!
Re: Grand jury subpoena for Signal user data
#27That's very neat and really glad to see privacy enhancing technologies working.
I'm curious what type of metadata Facebook would have from the signal integrations with Whatsapp and Messenger. Is there more, less, or same? Has anyone looked in to this?
Re: Grand jury subpoena for Signal user data
#28Earlier quoted context omitted.
If they were storing that metadata, they would be lying in the response to their subpoena.
That doesn't prove they don't have it though. I'm skeptical of the suggestion as well, but people can lie.
Lying in response to a subpoena would be an EXTREMELY unwise move by OWS, or most other bodies in this position.
Re: Grand jury subpoena for Signal user data
#29FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.
> FYI, Signal has access to all metadata about messages and calls source for this?
It's the way the protocol works and its centralized infrastructure. They for sure have access
Re: Grand jury subpoena for Signal user data
#30FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.
> FYI, Signal has access to all metadata about messages and calls source for this?
The messages and calls are routed through their servers, so they could (but do not) store whatever metadata is required to route messages and calls. This would at least be the recipient's account and IP address, the sender's IP address (but not necessarily their account), and the current time.
I believe the GP is echoing zeverb's sentiment, that it would be preferable if OWS (Signal) could not even be ordered to collect such data.
The thing I don't understand about the GP's post is "but someone else could be storing it". I would expect the entire message (including headers / metadata) to be encrypted in transit, with a pinned key, so that only OWS has access to the routing metadata. Please correct me if I'm wrong.