Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

Post reply on HN
Print view View original

121–130 of 226 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#121

Post by psanford »

dane-pgp wrote: post #108
tialaramex wrote: post #60

Earlier quoted context omitted.

You can build the core code, reproducibly. As I understand it if you take this code, and the binary blobs of the code that does stuff like video calls, you can verify that's what is inside your Play Store APK. Now, if you're a tinfoil hat wearer obviously you can consider that maybe the video call code secretly reads your messages and sends them to the FBI, or indeed that the Android OS just ignores this APK and when…

It would be nice if Android let you check the hash of the APK against a Binary Transparency log hosted by a third party. Google have even written extensively about this idea: https://transparency.dev/application/add-tamper-checking-to-...

Android does verify that any new versions of an APK are signed with the same signing key as previously installed versions. So you would have to compromise the signing key held by the developer in order to push an evil APK.

Re: Grand jury subpoena for Signal user data, Central District of California

#122

Post by Mc_Big_G »

motohagiography wrote: post #110

It's probably unwise to think prosecutors and federal agents are stupid. They were in the 1990s crypto wars, but not now. What we tend to perceive as 'stupid' is in reality, 'powerful.' They don't need to explain themselves, because they put the onus of compliance on you. Gaming out the subpoena, Signal does not have this user information because it does not exist, but it does have server locations, 3rd party service…

I'm glad Signal doesn't have this defeatist attitude.

Re: Grand jury subpoena for Signal user data, Central District of California

#123

Post by psanford »

danpalmer wrote: post #54

Interesting that they provide last login dates as Unix milliseconds, but rounded to day boundaries (each of these is at midnight UTC). I'd assume that's what they store, which is good, but it's odd that they provide the data with such unnecessary precision if so. I wondered originally if this would help disambiguate accounts, perhaps if two numbers last logged in at the same timestamp one could guess that they were o…

The source code for storing the last login timestamp is here: https://github.com/signalapp/Signal-Server/blob/master/servi...

Re: Grand jury subpoena for Signal user data, Central District of California

#124

Post by Sleepytime »

motohagiography wrote: post #110

It's probably unwise to think prosecutors and federal agents are stupid. They were in the 1990s crypto wars, but not now. What we tend to perceive as 'stupid' is in reality, 'powerful.' They don't need to explain themselves, because they put the onus of compliance on you. Gaming out the subpoena, Signal does not have this user information because it does not exist, but it does have server locations, 3rd party service…

> They may even be able to compel friendly app stores to patch apps before they are distributed.

Google's apk signing changes comes to mind.

Re: Grand jury subpoena for Signal user data, Central District of California

#125

Post by korethr »

Dah00n wrote: post #63
raverbashing wrote: post #51

Earlier quoted context omitted.

But trial by jury continues to be used in several countries (maybe in more restricted ways but it still a thing) or is there something special about a "Grand Jury"?

To add to the other comment a Grand Jury is also often made up of jurors called in using the prosecutor's private phone contacts. A few ex-cops and former work buddies. People also go to jail because of misuse of power by grand juries. There's a great documentary on Netflix but I can't remember its name right now. Suffice to say there aren't grand juries in any well working and fair justice system. It's abuse and/or…

I will offer a counter-example to this. I was an alternate for my local county's grand jury for a year. I was selected through the same voir dire process used to place me on a petit jury for a criminal trial years later. It was wholly random. AFAIK, I didn't end up in the jury pool because I knew a prosecutor or cop. Were "I know a guy who knows a guy" the selection criteria, I would have never ended up on the grand jury, as my father was personal friends with a local defense attorney; the question posed to me wouldn't have been if I hate cops, but whether I knew or was associated with anyone sharing the same name as my father.

Re: Grand jury subpoena for Signal user data, Central District of California

#126

Post by captainmuon »

motohagiography wrote: post #110

It's probably unwise to think prosecutors and federal agents are stupid. They were in the 1990s crypto wars, but not now. What we tend to perceive as 'stupid' is in reality, 'powerful.' They don't need to explain themselves, because they put the onus of compliance on you. Gaming out the subpoena, Signal does not have this user information because it does not exist, but it does have server locations, 3rd party service…

If I were really concerned about my users' rights as Moxie and Signal are, I would probably put something into my bylaws that immediately dissolves the company the second we were compelled to act against our convictions. (Sidenote: can you somehow legally destroy non-material property?)

I know they are very much against decentralisation (technially), but in order to keep the service going even in that case it would probably make sense to create dozens or hundreds of legal entities. I know it sounds like a joke, but I know for sure in real estate or meatpacking businesses you have people register companies like "Joes Sausages #1", "Joes Sausages #2", ... "#400" - mainly to get around labor laws but also to make it complicated to determine ownership.

And don't underestimate how utterly dependent our governments are on the online industries - it is todays equivalent of the railroad, and getting control of the railroads was one of the important milestones in the october revolution.

Long story short, I don't think it is quite so one-sided, and I'm going to grab some popcorn...

Re: Grand jury subpoena for Signal user data, Central District of California

#127

Post by refurb »

bberenberg wrote: post #116
mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

Having sat on a grand jury, the 95% is because it's a rigged system. The DA has to convinces 50% of the people that there is a 50% chance that their one sided story is possibly true. This is a lower bar than individuals are held to at cocktail parties.

So it may not be great, but what’s the alternative? The prosecutor decides independently when to bring charges? Is that better? It just seems to skip a step.

Re: Grand jury subpoena for Signal user data, Central District of California

#129

Post by infogulch »

auiya wrote: post #90

It's unlikely that prosecutors don't realize how Signal works. It's more likely they assume that, much like the rest of the tech world, there has been an increase in data collection efforts and they want to test the waters again to confirm/deny this data is available via Signal internals. Subpoenas are the only mechanism by which they're able to do so. That Signal are able to pivot to the media and say "yup, still co…

If I may restate this slightly:

> Subpoenas are the only mechanism by which prosecutors are able to test the waters to confirm/deny whether they can demand production of this data

I think many people fail to appreciate the importance of setting a precedent in the courts. Maybe this is because our legislators have been shirking responsibility for decades and pushing what should be their work off onto the executive and judicial branches, but regardless this is where we are today: If a demand like this is not challenged in court then nobody knows whether it's legal or not. *This is the process by which we learn whether Signal's implementation is allowed in our country.* It may seem clear to you what the right answer should be, but until its tested it's not clear to our government.

Re: Grand jury subpoena for Signal user data, Central District of California

#130

Post by dharmab »

mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

Having served on a grand jury, one of the first things we did was delegate the management of documents (including subpoenas) to the court staff. We didn't issue our own subpoenas; that would have been thousands of documents we didn't have the time to manage.

> Grand juries historically result in a 95%+ chance of indictment so this isn't a fishing expedition.

There were cases presented to us which did not result in any indictment vote as new information was discovered or persons involved made deals with the prosecutors. The prosecutors didn't have us vote on things they weren't sure about, but that doesn't mean they never made mistakes.

Post reply on HN