Just curious, why does signal have the ACLU respond for them?
I thought the ACLU was more of a protection against smaller entities who didn't have funding/legal firepower?
Grand jury subpoena for Signal user data, Central District of California
21–30 of 618 posts
Re: Grand jury subpoena for Signal user data, Central District of California
#22What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification.
Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...
Re: Grand jury subpoena for Signal user data, Central District of California
#23Beautiful. That's how you do it.
I actually believe that law enforcement has the legal right to subpoena information, with a judge's consent, while investigating criminal activity. This is exactly the solution to that problem. These platforms should want to know as little about you as possible.
Re: Grand jury subpoena for Signal user data, Central District of California
#24Just curious, why does signal have the ACLU respond for them? I thought the ACLU was more of a protection against smaller entities who didn't have funding/legal firepower?
Signal is a 501c3 nonprofit- they don't have all that much funding or legal firepower beyond their regular operations. The ACLU also loves them, and getting a letter from the ACLU probably makes matters go away faster then getting a letter from some random lawyer.
Re: Grand jury subpoena for Signal user data, Central District of California
#25What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...
I'm guessing here, but wouldn't they just push the e2ee message through APNS? Then decrypt client side. Or does Apple require plaintext messages for push notifications (that seems bad if they do)?
Re: Grand jury subpoena for Signal user data, Central District of California
#26What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...
I would (naively) assume that the notification service sends opaque (encrypted) blobs that are processed (decrypted) by the app before display to the user.
Re: Grand jury subpoena for Signal user data, Central District of California
#27Earlier quoted context omitted.
This is why messaging apps need to be decentralized and built on top of protocols that cannot be censored or meaningfully monitored.
With enough effort, anyone can go to jail. America held a taxi driver for 17 years at Guantanamo Bay with no evidence. Tech won’t save you from the state. As always, if your threat model includes a state actor, you are going to have a bad time. For all intents and purposes, their resources are unlimited. Freedom is won in the courts and the legislature, not in the code (although tech is as useful tool for keeping gov…
They can put one or two people in jail, but they can't put everyone in jail. If everyone has easy access to end-to-end encrypted messaging and relies on it (for non-nefarious purposes), the government will have a tough time changing that.
Re: Grand jury subpoena for Signal user data, Central District of California
#28What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...
I'm not too familiar with this, but my understanding is that the push notification just wakes up the Signal app, then the Signal app gets the encrypted message (either from Signal's servers or the push notification payload, I'm not sure) and decrypts it client-side and provides the notification text.
Re: Grand jury subpoena for Signal user data, Central District of California
#29>Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn’t exist on Signal’s servers. The E2EE in Signal only protects the actual content of messages. In the case where Signal takes an assertive action, and the users are not paying any attention to their "safety numbers" (probably the most common case) they co…
A judge can sign an order commanding a witness or party to preserve documentation and evidence, under penalty of contempt of court. However, there is still a great deal of uncertainty as to what actions the subject of the subpoena must take in order to preserve that evidence. It's pretty clear that you have to disable automated destruction mechanisms, you can't disable any recording functions you may already have, and you can't go and shred relevant papers in your possession; but whether a court can order you to write code or take other burdensome steps in order to record certain electronic records that you didn't record before to assist an ongoing investigation is still a very open question.
Re: Grand jury subpoena for Signal user data, Central District of California
#30What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...
I'm guessing here, but wouldn't they just push the e2ee message through APNS? Then decrypt client side. Or does Apple require plaintext messages for push notifications (that seems bad if they do)?
When you craft a push notification server-side, it contains the payload in plaintext. Now, that is probably encrypted in Apple-land, but my point is that the gov't probably has sunk its teeth into Apple already. So, yea signal's encryption may be open source and proven, but I doubt Apple's doesn't have a backdoor.