Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data

whispersystems.org

Post reply on HN
Print view View original

121–130 of 258 posts

Re: Grand jury subpoena for Signal user data

#121

Post by gnopgnip »

ryanlol wrote: post #92
nnn wrote: post #59

Earlier quoted context omitted.

The cost of running Vuvuzela is dominated by bandwidth, and the paper used AWS prices to estimate the cost; purchasing IP transit directly would lead to about an order of magnitude reduction in costs (still non-trivial, of course).

Order of magnitude? 1Gbit on amazon costs 22k/month. Even an order of magnitude cheaper sounds pretty damn expensive, two orders of magnitude still isn't "cheap". It's really easy to underestimate how big of a ripoff EC2 bandwidth pricing is.

A 10gbit unmetered server can be leased for under $3k a month. 1Gbit can be under $300 a month depending on the hardware.

Re: Grand jury subpoena for Signal user data

#122

Post by erichocean »

yincrash wrote: post #4
woah wrote: post #3

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.

If they were storing that metadata, they would be lying in the response to their subpoena.

> they would be lying in the response to their subpoena

The court can compel a business (or individual) to lie about that sort of thing.

Re: Grand jury subpoena for Signal user data

#123

Post by nindalf »

klapinat0r wrote: post #106
joncp wrote: post #60

So, when is it going to be considered misconduct for Dana Boente and the (not so) honorable Theresa Buchanan to tack on gag orders for no good reason? How do we change that? Calling our representatives in Congress won't help. Signing petitions is laughable. I'm at a loss for how to change this as a regular citizen.

I'm confused. It seems you have more information than the blog post and attached documents entail. Do you know both how long the investigation would be under for? Do you know the timing? Stating there's no good reason is not true - it's quite possible that a gag order is issued to protect the investigation, including identification of suspects, the number of suspects (at least two in this case), change of behavior (e…

I think a middle ground is possible in this specific case. The government could have said "we're placing a selective gag order, meaning you can't publish this notice but you can publish the redacted notice that we've helpfully attached", rather than wait for OWS to file a petition to publish the redacted version.

Re: Grand jury subpoena for Signal user data

#124

Post by AJ007 »

Bartweiss wrote: post #48
StavrosK wrote: post #15

Earlier quoted context omitted.

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

To me, the big question is what a trustworthy political solution would look like. I see this desire raised a lot, in contexts from HN to Valley-mocking pieces on how encryption is no substitute for advocacy. I completely understand the instinct, but every incarnation of it seems to struggle with the same question. Namely: how do you know when you've won? Restrictions against collecting data on US citizens didn't prod…

You can no longer decouple strong cryptography from the global economy, that could be considered a strong political solution because it represents a loss of political control.

Re: Grand jury subpoena for Signal user data

#125

Post by marcosdumay »

Bartweiss wrote: post #105
ryandrake wrote: post #57

Earlier quoted context omitted.

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

I agree, but I'm talking about a scale even shorter than that. Roe v Wade was a clear and unambiguous advance for abortion rights, and the battle lines are now arrayed somewhere different than they were before Roe. The fight isn't over, but it's fairly clear who holds what. I'm talking about even knowing when you've made progress. If a federal directive came through tomorrow expansively forbidding the NSA from collec…

On the current situation on the US, you'll know privacy advocates made progress when people start going to jail. No sooner.

Re: Grand jury subpoena for Signal user data

#126

Post by mi100hael »

5ersi wrote: post #20
CaptSpify wrote: post #12

Earlier quoted context omitted.

That doesn't prove they don't have it though. I'm skeptical of the suggestion as well, but people can lie.

Since their client apps are OSS you can check yourself: https://github.com/WhisperSystems/Signal-Android

Notably, the source for the voice call server is not available as far as I know, and there's no guarantee that the text messaging server is running in an unaltered state on their production servers.

Re: Grand jury subpoena for Signal user data

#127

Post by gagabity »

I really hate that every messaging app nowadays requires a phone number to use, sure it makes some things easier but its very difficult to get a phone number anonymously. They should include an email signup option or even better just a username/password option although that would cause some issues with spammers, which can probably be mitigated in other more creative ways.

Re: Grand jury subpoena for Signal user data

#129

Post by kodablah »

wyager wrote: post #115
eatbitseveryday wrote: post #108

Earlier quoted context omitted.

> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. One recent project that validates this is from ACM SOSP'15 titled "Vuvuzela: scalable private messaging resistant to traffic analysis"[1] (open-access URL): > Vuvuzela has a linear cost in the number…

> Freenet ... which has led to conviction by police, unfortunately. Just for using it? That's crazy! Do you have a source?

No, not just for using it that I am aware of. Just meaning that pure anonymity on Freenet is not the absolute best and they suggest trusted peers only. Traffic analysis (among other things) is a hard problem to solve without introducing noise and requiring large bandwidth. I think what the parent was saying was that [1] is possible is unfortunate (without making any statements supporting the criminals of course).

1 - http://www.thedickinsonpress.com/news/north-dakota/3885239-p...

Re: Grand jury subpoena for Signal user data

#130

Post by mtgx »

feklar wrote: post #56
zeveb wrote: post #11

Earlier quoted context omitted.

Only because they don't store it. They are able to choose to store it at any point; we can only rely on their honesty (and lack of compulsion). It's better to have a protocol in which there isn't any significant metadata to choose to store. I don't distrust them today, but I have no way of knowing what their future behaviour will be. I'd prefer not to have to trust.

Who owns Open Whisper Systems? I know Twitter bought WhisperSys, and with it Textsecure and Redphone though unsure who currently owns Open WhisperSys and it's products Signal (I assume Twitter does). Twitter is also rumoured for sale with Microsoft looking at aquiring it, so the future of Signal not keeping this metadata depends on who aquires it.

Open Whisper Systems is a nonprofit founded by Moxie Marlinspike in 2013, and it's a different entity than the "Whisper Systems" Twitter bought earlier.

Yeah, I wish he went with another name, too. Not only is Open Whisper Systems making it more confusing, but it's also quite a mouthful.

Post reply on HN