Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

Post reply on HN
Print view View original

111–120 of 226 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#111

Post by RcouF1uZ4gsC »

mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

> They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc.

So Signal is being used for human trafficking? And they are deliberately making it easy to do that kind of activity on Signal without law enforcement knowing? Sounds like the app stores should ban them and AWS should kick them off.

I disagree with the above sentiment, but I think end to end encryption apps will be treated like that in the near future.

Re: Grand jury subpoena for Signal user data, Central District of California

#112

Post by [deleted] »

roflc0ptic wrote: post #46
mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

The structure of grand juries makes it so that the defense is unable to mount a defense. The fact that grand juries often result in indictment has vanishing little relevance for whether or not it’s a fishing expedition. Further, no one is saying it is a fishing expedition. It’s a request for information that Signal isn’t designed to be able to answer. You’re also just speculating about the nature of the crime, but sa…

[deleted]

Re: Grand jury subpoena for Signal user data, Central District of California

#113

Post by dane-pgp »

uuidgen wrote: post #71
hans1729 wrote: post #30

Earlier quoted context omitted.

>Smartphones in their current form cannot have secure messaging. What about self-hosted matrix/element, used from the browser?

Anything that is in web browser (like e.g most uses of protonmail) offloads all security to the security of the TLS connection. Unless you also ensure proper certificate pining, if someone can get a court order for any accepted CA to give them a valid certificate for your domain you won't notice a thing while that someone gets your browser to run any code and e.g. dump keys, certificates or messages.

What's missing is a way to pin web apps so that you always get the previous version (and can opt in to subsequent versions after checking their hash from a trusted source).

There is a clever way of doing this, using a bookmarklet, a dataURI, and SRI, but the UX isn't great.[0] If something like Hashlinks[1] were supported by browsers, though, this could work quite nicely.

[0] https://news.ycombinator.com/item?id=17776456

[1] https://w3c-ccg.github.io/hashlink/

Re: Grand jury subpoena for Signal user data, Central District of California

#114

Post by [deleted] »

Dah00n wrote: post #63
raverbashing wrote: post #51

Earlier quoted context omitted.

But trial by jury continues to be used in several countries (maybe in more restricted ways but it still a thing) or is there something special about a "Grand Jury"?

To add to the other comment a Grand Jury is also often made up of jurors called in using the prosecutor's private phone contacts. A few ex-cops and former work buddies. People also go to jail because of misuse of power by grand juries. There's a great documentary on Netflix but I can't remember its name right now. Suffice to say there aren't grand juries in any well working and fair justice system. It's abuse and/or…

[deleted]

Re: Grand jury subpoena for Signal user data, Central District of California

#115

Post by rocqua »

motohagiography wrote: post #110

It's probably unwise to think prosecutors and federal agents are stupid. They were in the 1990s crypto wars, but not now. What we tend to perceive as 'stupid' is in reality, 'powerful.' They don't need to explain themselves, because they put the onus of compliance on you. Gaming out the subpoena, Signal does not have this user information because it does not exist, but it does have server locations, 3rd party service…

The subpoena is dated 29 march. That puts it before the celebrite blog. Hence, it cannot be a response to that blog.

Re: Grand jury subpoena for Signal user data, Central District of California

#116

Post by bberenberg »

mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

Having sat on a grand jury, the 95% is because it's a rigged system. The DA has to convinces 50% of the people that there is a 50% chance that their one sided story is possibly true. This is a lower bar than individuals are held to at cocktail parties.

Re: Grand jury subpoena for Signal user data, Central District of California

#117

Post by motohagiography »

rocqua wrote: post #115
motohagiography wrote: post #110

It's probably unwise to think prosecutors and federal agents are stupid. They were in the 1990s crypto wars, but not now. What we tend to perceive as 'stupid' is in reality, 'powerful.' They don't need to explain themselves, because they put the onus of compliance on you. Gaming out the subpoena, Signal does not have this user information because it does not exist, but it does have server locations, 3rd party service…

The subpoena is dated 29 march. That puts it before the celebrite blog. Hence, it cannot be a response to that blog.

Fair and astute observation, and it implies prosecutors have been rounding on Signal for months at least before the Cellebrite blog post as well. However, it also means there was already a snare set for them before the post. I would still not underestimate what these people are capable of. If they want to get you, they will find a way to get you.

Re: Grand jury subpoena for Signal user data, Central District of California

#118

Post by merpnderp »

cptskippy wrote: post #105
auiya wrote: post #90

It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…

> It's unlikely that prosecutors don't realize how Signal works. Why would you expect them to understand how Signal works? A lawyer does not and cannot become a subject matter expert for every aspect of a case they undertake. A lawyer's job is to investigate every possible avenue for evidence to support their case. They're going to ask Signal for everything imaginable and have legal recourse if they discover at a lat…

Because a prosecutor calls up the IT crime lab and asks for the rundown. And since they have massive budgets, there actually is a well trained head of the IT crime lab who is perfectly capable of understanding and explaining (to a jury) how Signal works.

Re: Grand jury subpoena for Signal user data, Central District of California

#119

Post by mdavis6890 »

This is scary, intentional bullying. It costs the govt none of their own money (they have unlimited taxpayer money) to launch these attacks, but it costs Signal or other organizations a lot of their own money to defend against them.

It will continue until Signal agrees to become part of the surveillance state or goes broke and goes away.

Re: Grand jury subpoena for Signal user data, Central District of California

#120

Post by dane-pgp »

capableweb wrote: post #69
kodablah wrote: post #49

Earlier quoted context omitted.

You can use existing decentralized systems, e.g. bittorrent DHT or IPFS DHT, to handle signaling and not require a centralized server. STUN is only needed to retrieve the public IP, which you may not need to use (and didn't have to be centralized). In some heavily NATd cases, you'd need a TURN proxy, but not often.

Both of those DHTs are using centralized signalling servers to first be able to establish any P2P connections. Maybe there has been some recent invention in DHTs, but AFAIK, 100% P2P discovery is still not "there" (meaning "accessible, fast, not using too much resources and can find other peers")

I don't know if any systems actually work like this, but wouldn't it be possible to include in the client a short hardcoded list of entry points to the network which are all run by different entities (in different jurisdictions)?

Each entity could have their own public key (also hardcoded into the client), and the client could pick one at random and then bootstrap you up to the entire P2P network, where it would find the other hardcoded identities (or N out of M of them) to confirm you were seeing the whole network.

Post reply on HN