Live data from Hacker News

Grand jury subpoena for Signal user data

whispersystems.org

31–40 of 258 posts

Re: Grand jury subpoena for Signal user data

#31

I love that they gave them the info in unix millis. A serious question though, how do gag orders work? How do I notify an attorney?

At the bottom of the gag order is states that OWS "may disclose the attached subpoena to an attorney for [OWS] for the purpose of receiving legal advice".

Re: Grand jury subpoena for Signal user data

#33
post #21

Is it safe to assume then that WhatsApp is not secure? Unless their data has been subpoena'd as well?

WhatsApp does store metadata in plaintext which makes it susceptible to law enforcement or 3rd parties. The contents of the messages are still end-to-end encrypted; that being said WhatsApp does default to backing up chats in the cloud and those could be subpoenaed by a government.

Re: Grand jury subpoena for Signal user data

#34
post #3

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.

Yes, some mitm entity between OWS and the internet would be able to deduce who is speaking with whom once a big enough number of messages have been sent. In fact, any big ISP could do that for parties communicating from inside its network.

Re: Grand jury subpoena for Signal user data

#35
post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

I trust a well designed protocol over some murky promise not to collect data on me. They collected data when they weren't supposed to before...

Re: Grand jury subpoena for Signal user data

#36
post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

Political solutions change as politics change: I think it's better to be mathematically secure than politically secure, since the one is forever and the other only sure until the next election.

Re: Grand jury subpoena for Signal user data

#37
post #9

Earlier quoted context omitted.

They would also be able to figure out what phone numbers it was communicating with, at what times and how often - they do the routing. We're relying on them not to store that metadata, which is the problem.

How would they be able to do that? Can you quote where in the article you got that and how that would happen? "Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's…

Yes, but zeveb makes the following points:

1. "the contacts, or even a hash of the contact" are being not stored by choice rather than by necessity.

2. If OWS chose to start storing these metadata in the future, they could.

3. A protocol where the metadata could not be stored intrinsically would be preferable.

Re: Grand jury subpoena for Signal user data

#38

Earlier quoted context omitted.

That doesn't prove they don't have it though. I'm skeptical of the suggestion as well, but people can lie.

Lying in response to a subpoena would be an EXTREMELY unwise move by OWS, or most other bodies in this position.

I don't disagree. But it still doesn't prove that they don't have the data. You can't prove a negative like that.
Post reply on HN