Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data

whispersystems.org

Post reply on HN
Print view View original

101–110 of 258 posts

Re: Grand jury subpoena for Signal user data

#101

Post by rhizome »

ryandrake wrote: post #57
Bartweiss wrote: post #48

Earlier quoted context omitted.

To me, the big question is what a trustworthy political solution would look like. I see this desire raised a lot, in contexts from HN to Valley-mocking pieces on how encryption is no substitute for advocacy. I completely understand the instinct, but every incarnation of it seems to struggle with the same question. Namely: how do you know when you've won? Restrictions against collecting data on US citizens didn't prod…

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

After Roe, antiabortion strategies had to change. You can say that this was a weakness of Roe, but I think it's complex enough of a situation not to attribute it to a root cause. I prefer to think of this in terms of the Red Queen Syndrome[1]: solving problems reveals new ones.

1. https://en.wikipedia.org/wiki/Red_Queen_hypothesis

Re: Grand jury subpoena for Signal user data

#102

Post by joering2 »

subliminalpanda wrote: post #33
MyMan1 wrote: post #21

Is it safe to assume then that WhatsApp is not secure? Unless their data has been subpoena'd as well?

WhatsApp does store metadata in plaintext which makes it susceptible to law enforcement or 3rd parties. The contents of the messages are still end-to-end encrypted; that being said WhatsApp does default to backing up chats in the cloud and those could be subpoenaed by a government.

.. and how easy to frame someone... just keep sending them some messages until they block you.

in the eyes of LE... they have metadata that you spoke with suspected individual :)

Re: Grand jury subpoena for Signal user data

#103

Post by retox »

valarauca1 wrote: post #61
frandroid wrote: post #54

Earlier quoted context omitted.

A blockchain, of sorts...

Blockchains can do this. But they create relatively absurd systems of who can/can't send messages based on how much they've mined. Block chains are HORRIBLE for encrypted messaging. Since your message is PERMANENTLY part of the chain. So if a encryption is broken, or your password gets leaked. ANYONE can read your messages. In most cases a DHT is far simpler. But naturally some nodes can be evil and log metadata. Thi…

This trend of proposing a blockchain to solve every problem is hilarious to me. Hammer/nail syndrome.

Re: Grand jury subpoena for Signal user data

#104

Post by marketanarchist »

fweespeech wrote: post #83
marketanarchist wrote: post #65

Earlier quoted context omitted.

That would backfire economically and politically I think, especially long term. Let them ban it if they are so foolish.

They license it to businesses that cooperate with the government. It wouldn't backfire, honestly. The fact no one has done anything major about any of the other surveillance state BS is proof enough of that.

Well, one could argue that rise of Trump, Bernie, backlash against mainstream media etc are partially due to the surveillance state BS.

In any case, there are still the negative economic consequence which important alone, but also affect politics.

Re: Grand jury subpoena for Signal user data

#105

Post by Bartweiss »

ryandrake wrote: post #57
Bartweiss wrote: post #48

Earlier quoted context omitted.

To me, the big question is what a trustworthy political solution would look like. I see this desire raised a lot, in contexts from HN to Valley-mocking pieces on how encryption is no substitute for advocacy. I completely understand the instinct, but every incarnation of it seems to struggle with the same question. Namely: how do you know when you've won? Restrictions against collecting data on US citizens didn't prod…

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

I agree, but I'm talking about a scale even shorter than that.

Roe v Wade was a clear and unambiguous advance for abortion rights, and the battle lines are now arrayed somewhere different than they were before Roe. The fight isn't over, but it's fairly clear who holds what.

I'm talking about even knowing when you've made progress. If a federal directive came through tomorrow expansively forbidding the NSA from collecting data on US citizens, privacy advocates wouldn't even hope that bulk surveillance of citizens would stop. They know better, because it basically happened, and the definitions of words got rearranged until the program could continue unabated.

Political issues aren't settled until they fade into consensus belief, but it's usually possible to make progress and then defend it. On surveillance and privacy, there's no law or court decision or whistleblower or even prosecution that can guarantee things aren't continuing exactly the way you didn't want them to.

Re: Grand jury subpoena for Signal user data

#106

Post by klapinat0r »

joncp wrote: post #60

So, when is it going to be considered misconduct for Dana Boente and the (not so) honorable Theresa Buchanan to tack on gag orders for no good reason? How do we change that? Calling our representatives in Congress won't help. Signing petitions is laughable. I'm at a loss for how to change this as a regular citizen.

I'm confused. It seems you have more information than the blog post and attached documents entail.

Do you know both how long the investigation would be under for? Do you know the timing?

Stating there's no good reason is not true - it's quite possible that a gag order is issued to protect the investigation, including identification of suspects, the number of suspects (at least two in this case), change of behavior (e.g. switch from Signal to smoke signals, fax, or just lay low for a while), etc.

What happens when two days after a terrorist attack, OWS publishes a subpoena for the first time? I for one welcome that they go through the official channels to get the redacted version approved. Let's not botch investigations for the sake of pitchforking the "everything should be public" slogans.

Re: Grand jury subpoena for Signal user data

#107

Post by Canada »

TeMPOraL wrote: post #52
zeveb wrote: post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

Can someone explain how people are imagining protocols that do not to create / store metadata? This seems like something fundamentally impossible on a packet-switched network. After all, the data has a source and a destination, and goes through the infrastructure that's tappable (and in big part already tapped) by a state-level actor. About the only thing that comes to my mind would be a digital equivalent to broadca…

Look into verifiable shuffles, private information retrieval, and dining cryptographer networks.

By combining such techniques, it's possible to be much much better than naive broadcast, and also possible to use a client/server architecture so that low bandwidth endpoints can participate.

Have a look at systems such as Dissent and Riffle.

Re: Grand jury subpoena for Signal user data

#108

Post by eatbitseveryday »

zeveb wrote: post #5

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandw…

> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth.

One recent project that validates this is from ACM SOSP'15 titled "Vuvuzela: scalable private messaging resistant to traffic analysis"[1] (open-access URL):

> Vuvuzela has a linear cost in the number of clients, and experiments show that it can achieve a throughput of 68,000 messages per second for 1 million users with a 37-second end-to-end latency on commodity servers.

> Vuvuzela works by routing user messages through a chain of servers, as shown in Figure 1, where each of the servers adds cover traffic to mask the communication patterns of users.

Similar to the P2P project Bitmessage[2] where clients receive and forward traffic not related to themselves.

There were some comments on HN discussing FreeNet and how it similarly forwards traffic unrelated to an individual client, but which has led to conviction by police, unfortunately.

[1] http://dl.acm.org/authorize?N93273

[2] https://www.bitmessage.org/

Re: Grand jury subpoena for Signal user data

#109

Post by cloudjacker »

the_watcher wrote: post #70
fweespeech wrote: post #45

Earlier quoted context omitted.

They can just make it illegal to own a mathematically secure piece of software without a license.

Ex post facto laws are unconstitutional, and something like this (where millions would instantly be in violation) would absolutely, 100% end up in front of the Supreme Court.

Some examples of when a law can be retroactively applied:

When the Securities Exchange Commission decides that something is a security, it retroactively applies the civil and criminal compliance back to 1934 because it was always a security. I mean, you can argue it in front of a judge if you want, but thats how they established jurisdiction.

Same goes for discretionary tax law at the IRS

or any regulatory agency

I agree its a problem, but if you live your life under your version of reality it is easy to get railroaded in the dragnet

Re: Grand jury subpoena for Signal user data

#110

Post by TeMPOraL »

Canada wrote: post #107
TeMPOraL wrote: post #52

Earlier quoted context omitted.

Can someone explain how people are imagining protocols that do not to create / store metadata? This seems like something fundamentally impossible on a packet-switched network. After all, the data has a source and a destination, and goes through the infrastructure that's tappable (and in big part already tapped) by a state-level actor. About the only thing that comes to my mind would be a digital equivalent to broadca…

Look into verifiable shuffles, private information retrieval, and dining cryptographer networks. By combining such techniques, it's possible to be much much better than naive broadcast, and also possible to use a client/server architecture so that low bandwidth endpoints can participate. Have a look at systems such as Dissent and Riffle.

Thanks!
Post reply on HN