Comment on Simplifying warrant canaries - Purplix canary

CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

• explore_broaden@midwest.social ⁨1⁩ ⁨year⁩ ago

  The idea is that there is no such action as “triggering the canary” that the government can stop them from taking. Instead they refrain from updating it, thus alerting people that something has occurred. However, since the point of a canary is that not updating it raises concerns, I’m not sure how this service makes any sense (alerts on new canaries?).

  The idea is that there is a big difference between the government saying “don’t tell anyone about this” and saying “you must make a false statement (the canary) every X amount of time indefinitely.” In the past courts in the US have taken a fairly dim view of the government trying to compel speech. There are some example cases at en.m.wikipedia.org/wiki/Compelled_speech#United_S….

  source

  • CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

    None of those compelled speech examples include national security though, which has its own level of rules and courts. (I am not American or a lawyer, so i may be wrong).

    And if a company can be compelled to hand over customer data, why wouldnt they be hand over access to the systems that update the canaries?

    The other issue is thar once a canary is triggered, it cant be reset, which means that XXX agency can trigger the canary with something meaningless, and then its forever untrustworthy.

    You may well be correct, and they are sufficient, but i am not convinced that canaries work, especially against the higher level adversaries.

    source

    • explore_broaden@midwest.social ⁨1⁩ ⁨year⁩ ago

      Yes, most of those points are the concerns with warrant canaries. So far as we know the concept is totally untested in court so it’s hard to say what the result would be until it happens.

      Updating the canary should require a human input (like a password to unlock the GPG key), which is not sometime the government would generally get access to (they make a request for data about XYZ user, and the company turns it over; they wouldn’t get actual access to the production system). The government could seek a ruling to force the company to update the canary, but as such a thing hasn’t been granted before (at least as far as we know), it’s not a guarantee. So, there is a chance that the warrant canary will serve to alert users to something happening, which is better than nothing. But because of its untested nature, it might be broken by a court.

      I’m not sure I understand your point about “once it’s triggered it can’t be reset.” If a company fails to update their canary on schedule it means something happened that they can’t disclose. Once they are released from the NDA they can release a new canary explaining what happened.

      source

      • CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

        Wikipedia does claim that patriot act subpeonas can penalise any disclosure of the subpeona. But i am not a lawyer, and afaik this is untested (or at least undisclosed :/ )

        en.m.wikipedia.org/wiki/Warrant_canary

        Some subpoenas, such as those covered under 18 U.S.C. §2709© (enacted as part of the USA Patriot Act), provide criminal penalties for disclosing the existence of the subpoena to any third party, including the service provider’s users.

        In September 2014, U.S. security researcher Moxie Marlinspike wrote that “every lawyer I’ve spoken to has indicated that having a ‘canary’ you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you’ve received something.”

        I think my point is that a gag order with a long time out essentially kills the canary, even if it doesnt affect the vast majority of the services users.

        Thanks for your response though, I appreciate the additional information.

        source
  • uriel238@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago

    I wonder where mandated sonograms and abortions are bad disclaimers to patients seeking abortions falls.

    That speecch is mandated, yet SCOTUS barred California from mandating crisis pregancy centers reporting to patients you cannot get an abortion here but instead call these numbers to schedule one

    Lot’s of controversies outside the thread, but certainly examples of mandated speech and rulings to prevent mandated speech.

    source
  • Ward@lemmy.nz ⁨1⁩ ⁨year⁩ ago

    Also to note, that Purplix does warn users to assume the site has been compromised if the latest statement has expired.

    source

    • explore_broaden@midwest.social ⁨1⁩ ⁨year⁩ ago

      That actually could be useful, by having a completely external company send a notification without action by the company receiving the warrant, it may be possible to circumvent the prohibition on alerting users.

      source
• rinkan@burggit.moe ⁨1⁩ ⁨year⁩ ago

  The canary is triggered through inaction, not action. The government would have to compel the target of the subpoena to keep updating the canary on schedule.

  source