Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data

whispersystems.org

Post reply on HN
Print view View original

181–190 of 258 posts

Re: Grand jury subpoena for Signal user data

#181

Post by faktorialas »

Jarwain wrote: post #152

> All message contents are end to end encrypted, so we don't have that information either. The way I'm reading/understanding this is that they have the encrypted messages, but don't specify whether they are stored. However, since the messages are encrypted, they don't have the message contents/that information. Concluding, they may have all the messages saved, albeit in an encrypted format and with minimal metadata.…

Considering the way they claim to minimize the metadata stored, I wouldn't expect them to store encrypted message content after it is delivered to the client.

It'd be difficult to delete metadata about a message, but still keep the content. And they are claiming to not retain message metadata.

Re: Grand jury subpoena for Signal user data

#182

Post by gnarbarian »

Bartweiss wrote: post #105
ryandrake wrote: post #57

Earlier quoted context omitted.

You never win. To use a controversial example: Who thinks abortion rights people "won" with Roe v Wade? Their opponents have been relentlessly chipping away at that "victory" ever since. When you make something a political issue, you are guaranteeing that it cannot be won with any kind of finality.

I agree, but I'm talking about a scale even shorter than that. Roe v Wade was a clear and unambiguous advance for abortion rights, and the battle lines are now arrayed somewhere different than they were before Roe. The fight isn't over, but it's fairly clear who holds what. I'm talking about even knowing when you've made progress. If a federal directive came through tomorrow expansively forbidding the NSA from collec…

Exactly. This is why the fight to maintain gun rights is a never ending battle as well. Arming yourself with a gun is the best defense against a violent attacker. Legally enshrining that right is important. But even if we didn't have that right, we could still defend ourselves clandestinely via illegal means and home made weapons.

Similarly when it comes to security, privacy, and anonymity the best defense is to arm yourself with mathematical security.And to enshrine our right to those defenses in law. A subpoena only works if there is information that can be handed over in the first place. If strong and private encryption is made illegal then the best defense is still to use that technology clandestinely.

Re: Grand jury subpoena for Signal user data

#183

Post by dragonwriter »

h4nkoslo wrote: post #164
dragonwriter wrote: post #148

Earlier quoted context omitted.

> When the Securities Exchange Commission decides that something is a security, it retroactively applies the civil and criminal compliance back to 1934 because it was always a security. That's not a retroactive application of the law. If they are correct in their interpretation of the law, it was already the law. If they are incorrect, the courts will not allow it (whether the enforcement concerns acts before or afte…

The issue is that they, and other administrative organs, often change their interpretation of what the law "has always meant". Particularly irksome when they issue private letters with differing interpretations and then override all of them with subsequent administrative rulings. The ATF is particularly notorious for this.

> The issue is that they, and other administrative organs, often change their interpretation of what the law "has always meant".

Yes, and if that conflicts with what the courts believe the law has always meant, those decisions won't survive contact with the legal system. An ex post facto law is a law creating (or enhancing) criminal penalties for acts that exist before the law is passed. Changing administration interpretations are like changing prosecutorial priorities (and the former comes with a lot more notice and specificity than the latter) -- they only have effect so long as they are within the bounds of what the courts will accept was covered by the law when it was passed.

Re: Grand jury subpoena for Signal user data

#184

Post by curun1r »

Bartweiss wrote: post #48
StavrosK wrote: post #15

Earlier quoted context omitted.

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

To me, the big question is what a trustworthy political solution would look like. I see this desire raised a lot, in contexts from HN to Valley-mocking pieces on how encryption is no substitute for advocacy. I completely understand the instinct, but every incarnation of it seems to struggle with the same question. Namely: how do you know when you've won? Restrictions against collecting data on US citizens didn't prod…

> what does winning look like?

At this point, winning looks like the people responsible for abusing their power and overstepping their constitutional authority going to jail. And for a long time.

As long as the only consequence of illegal activity that violates the constitutional rights of citizens is being told to stop, there will be continued efforts to chip away and push the envelope for what they can get away with. If it were made apparent that there are personal consequences above and beyond the scope of their jobs, perhaps some of the people in those jobs would more carefully consider the constitutionality of their actions.

Re: Grand jury subpoena for Signal user data

#185

Post by zaroth »

problems wrote: post #19
zaroth wrote: post #16

Earlier quoted context omitted.

We're relying on them not being successfully compelled to retain that metadata -- which is a significantly different proposition.

No, not really - they can decide at any time to start storing that metadata of their own will, use it internally, sell it to advertisers or turn it over via a direct law enforcement portal if they want. Their access alone is in many ways a problem.

Of course, we are agreeing. But as the other front page story shows us, even companies with the best of intentions and made up of people with strict moral codes devoted to providing their users a secure product can be usurped by government forces with ulterior motives.

I believe Whisper doesn't want this data. I can even trust that they would never collect it of their own volition. But it's irrelevant if they can simply be compelled to collect it, or even worse, someone within their organization can be compelled to secretly collect it and may even do a better job at this secret collection than Mayer's lackies at Yahoo!.

Re: Grand jury subpoena for Signal user data

#186

Post by dredmorbius »

moxie wrote: post #39
throwawayIndian wrote: post #32

Worry not, 'Murica! Hillary is considering to drone this guy as well. So that you can be safe. :-)

http://fortune.com/2016/08/29/clinton-campaign-signal/

Since GP risks flag death: the implication was that Hillary Clinton would seek to have Signal shut down, or more specifically: target Moxie directly.

Moxie's link shows her campaign is in fact relying on the service.

Re: Grand jury subpoena for Signal user data

#187

Post by nickpsecurity »

fweespeech wrote: post #45
zeveb wrote: post #36

Earlier quoted context omitted.

Political solutions change as politics change: I think it's better to be mathematically secure than politically secure, since the one is forever and the other only sure until the next election.

They can just make it illegal to own a mathematically secure piece of software without a license.

It already is for exports unless you get license. They probably approve it but they left high-assurance security + a bunch of other stuff classified as munitions. The "victory" of the Crypto Wars was for mass market stuff that's basically insecure.

Detailed analysis with appropriate links:

https://www.schneier.com/blog/archives/2014/11/the_return_of...

Note: I could be really misreading the material due to not being a lawyer or pouring through regs all the time. I think it says all this stuff is still 5A002 (munition) outside the exemptions they compromised on.

Re: Grand jury subpoena for Signal user data

#188

Post by nickpsecurity »

cloudjacker wrote: post #132
zeveb wrote: post #119

Earlier quoted context omitted.

That just goes to show that the Constitution, while imperfect, is better than what we have now.

I'm not sure what you mean, all of those agencies are formed under the constitution and the systems that support them are also abiding by the constitution

They're definitely not. They've resisted due process for some time. NSA's reps even argued in Jewel case that judicial branch shouldn't be allowed involvement at all. Which is sort of the status quo for intelligence agencies and courts. Prosecutors similarly have a combo of broad powers, immunity in common abuses, and virtually no accountability. The government as it exists certainly doesn't run in the framework of the Constitution except in a partial way.

Re: Grand jury subpoena for Signal user data

#189

Post by phs318u »

burkaman wrote: post #99
module0000 wrote: post #77

Earlier quoted context omitted.

Political actors usually only respond when they are or their colleagues are harmed in some fashion. When people successfully affect politicians, they tend to do so from a grassy knoll. Summary: Oppressive bullies only respond to equal or greater oppressive bullying. edit:typo

When has assassination ever accomplished what the assassin wanted? Most successful political movements, at least in recent history, do not involve killing anybody.

Your first sentence assumes we know the assassins' motives. I question that.

Your second sentence assumes that any assassinations would be publicly known (eg assassination of a public figure). Assassination of non-public figures may well be impactful and yet go largely unheeded.

Re: Grand jury subpoena for Signal user data

#190

Post by nickpsecurity »

marketanarchist wrote: post #65
fweespeech wrote: post #45

Earlier quoted context omitted.

They can just make it illegal to own a mathematically secure piece of software without a license.

That would backfire economically and politically I think, especially long term. Let them ban it if they are so foolish.

RSA, ATT, and Verizon all took bribes from the NSA to screw over their users. At least one worked with DEA as well. These were leaked in prominent media with exposure to millions of American consumers and business people. So, let's test your theory:

RSA Net Income (2011-2015): 426M 320M -306M -115M 79M

Verizon Net same period: 2.4B 875M 11.5B 9.63B 17.88B

ATT Net same period: 3.94B 7.26B 18.25B 6.22B 13.35B

RSA took quite a hit but it could be market as well. I don't know what it's status was pre-Snowden but much of hit comes during year of the leaks. Revenue dropped a billion or two with profits turning to losses but rebounding into $75 million in 2015. Verizon and ATT are doing great. Other companies that are managed profitably that cooperate tightly with Washington are Microsoft, IBM, Google, and Oracle. Their net incomes are in the billions.

So, I think the market data indicates you're wrong even in the worst scenario for working with the surveillance state. Also, the more lock-in the business has, the better it does despite any evil choice it makes. Rule of thumb.

Post reply on HN