Simplifying warrant canaries - Purplix canary

Comments

• jet@hackertalks.com ⁨1⁩ ⁨year⁩ ago

  Shouldn’t there be a notification when a statement isn’t published? Or when the text changes? (Or is that what is meant by a new statement?)

  Is the intention to build this into a browser extension?

  source

  • Ward@lemmy.nz ⁨1⁩ ⁨year⁩ ago

    Agreed, should have an alart for missed canaries. Each canary has “statements” you publish new statements to update ur canary. This provides a signed record of passed canaries.

    Browser extension or even mobile app could be another aspect of further securing validation. Currently we do store a offline backup for each public key in idb storage & a signed copy if you have a account for further validation if the URL hash has been tampered with.

    Thank you for your kind words ❤️❤️

    source
• CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

  Someone please correct me if I am wrong, but I was under the impression that warrent canaries were a broken concept. Anyone with the power to submit a warrant to a company also has the ability to prevent the company from triggering their canary.

  source

  • explore_broaden@midwest.social ⁨1⁩ ⁨year⁩ ago

    The idea is that there is no such action as “triggering the canary” that the government can stop them from taking. Instead they refrain from updating it, thus alerting people that something has occurred. However, since the point of a canary is that not updating it raises concerns, I’m not sure how this service makes any sense (alerts on new canaries?).

    The idea is that there is a big difference between the government saying “don’t tell anyone about this” and saying “you must make a false statement (the canary) every X amount of time indefinitely.” In the past courts in the US have taken a fairly dim view of the government trying to compel speech. There are some example cases at en.m.wikipedia.org/wiki/Compelled_speech#United_S….

    source

    • CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

      None of those compelled speech examples include national security though, which has its own level of rules and courts. (I am not American or a lawyer, so i may be wrong).

      And if a company can be compelled to hand over customer data, why wouldnt they be hand over access to the systems that update the canaries?

      The other issue is thar once a canary is triggered, it cant be reset, which means that XXX agency can trigger the canary with something meaningless, and then its forever untrustworthy.

      You may well be correct, and they are sufficient, but i am not convinced that canaries work, especially against the higher level adversaries.

      source

      • -> View More Comments
    • uriel238@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago

      I wonder where mandated sonograms and abortions are bad disclaimers to patients seeking abortions falls.

      That speecch is mandated, yet SCOTUS barred California from mandating crisis pregancy centers reporting to patients you cannot get an abortion here but instead call these numbers to schedule one

      Lot’s of controversies outside the thread, but certainly examples of mandated speech and rulings to prevent mandated speech.

      source
    • Ward@lemmy.nz ⁨1⁩ ⁨year⁩ ago

      Also to note, that Purplix does warn users to assume the site has been compromised if the latest statement has expired.

      source

      • -> View More Comments
  • rinkan@burggit.moe ⁨1⁩ ⁨year⁩ ago

    The canary is triggered through inaction, not action. The government would have to compel the target of the subpoena to keep updating the canary on schedule.

    source
• eatham@aussie.zone ⁨1⁩ ⁨year⁩ ago

  Purplix.io looks cool, I don’t make surveys but If I do I’d probably use it

  source
• stifle867@programming.dev ⁨1⁩ ⁨year⁩ ago

  This is a great idea! I wish more websites did warrant canaries, and those that do often fail to maintain them or plan for the case when a gag order prevents them from updating an existing canary. The only thing I would suggest is making it more clear that being in an alpha stage means that the product should not be relied upon in critical situations.

  source

  • CameronDev@programming.dev ⁨1⁩ ⁨year⁩ ago

    A failed warrant canary is effectively a triggered warrant canary. If its triggered, you have to assume the company has been issued a warrant, and is therefore vulnerable.

    source

    • stifle867@programming.dev ⁨1⁩ ⁨year⁩ ago

      What do you mean by a failed warrant canary? In most cases there is no clear failure because there’s no clear plan in place to maintain them.

      For example, if a website has a statement “we have received 0 warrants”. When was that published? Yesterday? A year ago? More? Even if it has a date, say 6 months ago. What does that mean? That they only update it every year? Or maybe there were meant to update it they just forgot, maybe they aren’t allowed to update it due to a gag order.

      Due to the way each website does things differently with no clear guidelines, there isn’t actually a defined failure case.

      source

      • -> View More Comments
  • totallynotfbi@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Maybe it was updated after your comment, but the demo site has that notice prominently at the top for me

    source