Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

121–130 of 163 posts

Re: Cloudflare expands its government warrant canaries

#121

Post by LinuxBender »

SahAssar wrote: post #80
LinuxBender wrote: post #42

Earlier quoted context omitted.

They are just good for business. No company is going to defy an order from a secret court or a NSL that states they are not to modify statements on their website until further notice. People will dispute the legality of such orders, but companies know how long they can be off the internet before going out of business. At least, that is based on conversations I have had with a corporate legal executive.

> order from a secret court or a NSL that states they are not to modify statements on their website until further notice That's the point. The theory is that a NSL can compel you to not speak, but it can't compel you to speak. Not updating a canary is the latter, not the former. If a canary isn't updated in the period it is expected to update it is considered "dead" or "tripped".

Assuming they can't compel speech, this would require the canary to be updated and PGP signed daily by someone that can represent the company. Perhaps a principal officer or a board member?

Even then, unless your contract states that the canary is managed in a particular way, they can simply lie. I can put a "canary" on a site and update it daily, even if every three letter agency were logged in and watching you real time. A recent example of this was that VPN provider that stated they don't log anything. Turned out they did and someone got nailed.

Re: Cloudflare expands its government warrant canaries

#122

Post by komali2 »

I wonder about this loophole:

Fully public communication, 24/7. Absurd, sure, but could it work? Set up your email so that anybody in the world can read it (not send from your address, though). Have a camera in your mailroom that streams to the internet that's high def enough to read off your letters as you open them (oops, top secret! Too late I already opened it here!). Have all your phone audio streaming to the internet.

Absurd, silly, but a fun thought experiment - is this a way to become "immune" to the type of requests the US government is allowed to make where you can't tell anyone?

Re: Cloudflare expands its government warrant canaries

#123

Post by ypolito »

What prevents NSA from requesting Cloudflare, under the table, put a false message?

If I owned Cloudflare, I wouldn't mind lying to my customers if it was related to the national security or if it gave me some kind of unfair advantage or special treatment against my competitors.

Re: Cloudflare expands its government warrant canaries

#124

Post by dragonwriter »

ypolito wrote: post #123

What prevents NSA from requesting Cloudflare, under the table, put a false message? If I owned Cloudflare, I wouldn't mind lying to my customers if it was related to the national security or if it gave me some kind of unfair advantage or special treatment against my competitors.

> What prevents NSA from requesting Cloudflare to put a false message?

The fact that the FBI would be the one doing that part of the NSL dance.

Re: Cloudflare expands its government warrant canaries

#127

Post by SahAssar »

LinuxBender wrote: post #121
SahAssar wrote: post #80

Earlier quoted context omitted.

> order from a secret court or a NSL that states they are not to modify statements on their website until further notice That's the point. The theory is that a NSL can compel you to not speak, but it can't compel you to speak. Not updating a canary is the latter, not the former. If a canary isn't updated in the period it is expected to update it is considered "dead" or "tripped".

Assuming they can't compel speech, this would require the canary to be updated and PGP signed daily by someone that can represent the company. Perhaps a principal officer or a board member? Even then, unless your contract states that the canary is managed in a particular way, they can simply lie. I can put a "canary" on a site and update it daily, even if every three letter agency were logged in and watching you real…

A canary in itself does not offer any cryptographic proof. The entire foundation is that the government cannot legally compel speech.

The canary does not protect you against the service provider and nobody has claimed that. The theory is that it protects you against NSLs that would otherwise force the service provider to not disclose the NSL.

Sometimes a canary is attached to a public financial report or something else that it is already illegal to lie in, so that would require the government to compel you to break a separate law.

It seems like you are thinking of canaries in the engineering, cryptographic or social sense, in which case the are useless. They only have purpose in a legal sense as a literal "canary in the coalmine".

Re: Cloudflare expands its government warrant canaries

#128

Post by KozmoNau7 »

crankylinuxuser wrote: post #88
Sir_Cmpwn wrote: post #8

>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.

Neonazis/Daily Stormer was a canary. I think back to the Skokie Nazi trial on how this should have played out. The Constitution wasn't for protecting when times and situations were good, but when they were off the rails and terribad. https://en.wikipedia.org/wiki/National_Socialist_Party_of_Am... Cloudflare tried to be this impartial "we're only a data delivery agent - we make no ethics claims of anyone who uses our…

Cloudflare are still providing services to a lot of politically noxious sites.

What The Stormer did was claim that since Cloudflare accepted them as customers, Cloudflare must have been sympathetic to their ideology and secretly Nazis themselves. The Stormer made a pretty big deal out of this, potentially doing severe damage to Cloudflare's reputation and driving away customers.

If The Stormer had kept their mouth shut and not made a big public thing out of it, Cloudflare would probably still be providing services to them.

Instead, they forced Cloudflare's hand by claiming them as ideological allies.

Re: Cloudflare expands its government warrant canaries

#129

Post by mirimir »

gonehome wrote: post #39
balabaster wrote: post #31

Earlier quoted context omitted.

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest…

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…

OK, what if you provided total read-only access, to everything on all of your machines, networks, communications and so on, to someone like me. Someone who you could trust 100%. And whose reputation depended on that. Someone who was totally anonymous (which I'm not, but I could have another persona that was). And someone with such deep backdoors into your stuff that they couldn't be evicted.

And so it's that person who maintains the warrant canary.

Or instead, it could be an ~undocumented feature of your outside counsel. Because you do have the right to outside counsel, I think, even regarding NSLs.

Edit: For example http://www.cryptohippie.net/AnonAdmin.html

Re: Cloudflare expands its government warrant canaries

#130

Post by ijpoijpoihpiuoh »

grecy wrote: post #117
rsync wrote: post #78

Earlier quoted context omitted.

"The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure." I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith. YMMV.

> falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith. Except that in the case of the canary, there might be the very real threat of violence or jail time for you or your loved ones. If it were me, I can see a world where I would do things I think are morally negative if it keeps me…

> might be the very real threat of violence or jail time for you or your loved ones

I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.

Post reply on HN