Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data

whispersystems.org

Post reply on HN
Print view View original

71–80 of 258 posts

Re: Grand jury subpoena for Signal user data

#71

Post by falcolas »

TeMPOraL wrote: post #52
zeveb wrote: post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Can someone explain how people are imagining protocols that do not to create / store metadata? This seems like something fundamentally impossible on a packet-switched network. After all, the data has a source and a destination, and goes through the infrastructure that's tappable (and in big part already tapped) by a state-level actor. About the only thing that comes to my mind would be a digital equivalent to broadca…

One way your broadcast can be achieved is through a newsgroup. The best you can do is identify who is a member and who posts messages. But so long as the messages are encrypted, you can't tell who gets which message, since everyone in the newsgroup gets every message.

Still not perfectly metadata proof, but it carries a lot less metadata than peer-to-peer messages.

Re: Grand jury subpoena for Signal user data

#72

Post by rurban »

Funny that Open Whisper Systems wrote in the last chapter that they essentially should come back with a court order or search warrant to get more data, but forgot to include the critical information, that even then the FBI will not get more information, because Open Whisper Systems has no technical ability to provide that data at all.

It's volatile data exchanged between the clients only, but not centrally stored anywhere (contrary to all other secure chat systems out there). The FBI has probably no idea how Signal works, what is stored and what not.

Even a grand-jury subpoena has no chance to produce more data. But maybe they can force them to re-implement Signal with a government backdoor (because it's a police state after all), and that's what Open Whisper Systems is really objecting to? Or just logging the metadata? (Which btw. duckduckgo does, even if it slows down their webserver by at least 20%).

Or did they just try to mess with the FBI lawyers?

Re: Grand jury subpoena for Signal user data

#73

Post by zAy0LfpBZLC8mAC »

StavrosK wrote: post #15
zeveb wrote: post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

I don't think there is.

Think democracy. We have to fight for democracy over and over, and we have a technical solution in the form of an election process that's designed to make tampering hard and in the form of institutions controlling each other for a good reason. There is no political solution to the risk of putting all your trust in a single person, aka a dictatorship, there is only a technical solution, and that is democracy: A system of government that avoids the single point of failure at great cost.

Re: Grand jury subpoena for Signal user data

#74

Post by falcolas »

woah wrote: post #3

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.

Even if they don't store it now, they could be forced by court-order to start storing it, even if for a limited number of endpoints.

Remember LavaMail? This is pretty much what happened to them.

Re: Grand jury subpoena for Signal user data

#76

Post by ptero »

zeveb wrote: post #36
StavrosK wrote: post #15

Earlier quoted context omitted.

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

Political solutions change as politics change: I think it's better to be mathematically secure than politically secure, since the one is forever and the other only sure until the next election.

A political decision to stop sabotaging technological solutions would be a good starting point. Even if changed later, all the technologies already developed would still be available.

Being provably secure is great, but this is a tall order -- there are always conditions to satisfy (solution is secure if A, B and C and governments and other attackers might invalidate those by a tap point, decree, a court action, etc.).

Re: Grand jury subpoena for Signal user data

#77

Post by module0000 »

joncp wrote: post #60

So, when is it going to be considered misconduct for Dana Boente and the (not so) honorable Theresa Buchanan to tack on gag orders for no good reason? How do we change that? Calling our representatives in Congress won't help. Signing petitions is laughable. I'm at a loss for how to change this as a regular citizen.

Political actors usually only respond when they are or their colleagues are harmed in some fashion. When people successfully affect politicians, they tend to do so from a grassy knoll.

Summary: Oppressive bullies only respond to equal or greater oppressive bullying.

edit:typo

Re: Grand jury subpoena for Signal user data

#78

Post by Niten »

kyledrake wrote: post #75

I'm really happy they provided documentation on how to fight an unconstitutional gag order on a subpoena. They put gag orders on subpoenas they're not supposed to all the time , and it's good to show people an "easy" way to fight them.

I agree, although my takeaway was that the way to fight them is to respond on ACLU letterhead.

Re: Grand jury subpoena for Signal user data

#79

Post by andars »

the_watcher wrote: post #70
fweespeech wrote: post #45

Earlier quoted context omitted.

They can just make it illegal to own a mathematically secure piece of software without a license.

Ex post facto laws are unconstitutional, and something like this (where millions would instantly be in violation) would absolutely, 100% end up in front of the Supreme Court.

Except for when they aren't. There are several examples of ex post facto laws that have been upheld. The Supreme Court would definitely get involved.

Re: Grand jury subpoena for Signal user data

#80

Post by rurban »

guelo wrote: post #46
yincrash wrote: post #4

Earlier quoted context omitted.

If they were storing that metadata, they would be lying in the response to their subpoena.

I think you misread woah's comment. Signal has access to the metadata but chooses not to store it in order to be able to remain unresponsive to queries like this.

So the real threat here is that the FBI wants to come in with a search warrant, install one of their famous splitters (a Windows machine btw) and routes all metadata traffic to the NSA. To legally get contact data in real-time for one criminal under investigation. Essentially the Lavabit case.

Or is that what they called PRISM? Legal route splitting at the endpoint, i.e. legally declared as such by the secret FISA court, because there's oversight...

Post reply on HN