6 ms·

I have never understood what value I personally would derive from a warrant canary. For the sake of discussion let's assume that reddit's warrant canary was int

by dfc 11y ago

I have never understood what value I personally would derive from a warrant canary. For the sake of discussion let's assume that reddit's warrant canary was intentionally removed and but for an NSL it would have continued to appear on reddit. How do my actions differ in this universe compared to one where the canary was present in the report?

awqrre 11y ago
Maybe they are now able to get posts from private subreddits and private messages, without warrants...
- dfc 11y ago
  Maybe they are? The question is, what am I doing differently in this universe compared to the universe where the canary is still present? It seems like your answer is "In this universe (canary removed) I no longer treat reddit as a secure and private communication platform." My personal threat model assumes that reddit is not a secure and private communication platform so the status of the canary does not change my behavior, utility schedules, outlook, etc.
  - awqrre 11y ago
    I personally would not be doing anything differently but that is besides the point... they should not be able to get that data without a warrant. So I guess the value of it would be that you are now aware of something else that the government is doing that they should not be doing...
    - dfc 11y ago
      I apologize if I am missing something in your answer but "NSLs are bad, mmkay?" does not seem to be very responsive. We knew about NSLs before warrant canaries. If that is the only utility they provide it seems like they are not very useful to me.
      - awqrre 11y ago
        I wish that they would be more specific in their canary and perhaps have multiple ones... for examples: 1. we were not asked to provide private post 2. we were not asked to provide metadata like IP addresses 3. we were not asked to backdoor our website 4. we were not asked to shadowban users 5. maybe even one canary per user, to know exactly who is affected
    - mirimir 11y ago
      I entirely agree. It's foolish to believe that "private subreddits" and "private messages" are private, in any meaningful sense.
  - rorosaurus 11y ago
    I don't think information needs to be immediately actionable to be useful.
- deleted 11y ago
  [deleted]
shostack 11y ago
Here's an example. Let's say you frequent lots of subreddits that might be considered outside societal norms. Right now that data is ONLY available internally at Reddit. If the NSA hoovered up this data, suddenly they might learn a lot about you that they didn't know before (although there's probably a fair argument that people probably leave enough other clues scattered across other data sources they likely have access to that make this redundant). Maybe you aren't looking at things that would set off their alerts for today's hot media topics. But what about the future? What if we end up with a President with a radical discriminatory agenda (a scarily likely possibility at this point unfortunately)? What if suddenly things that may have been frowned upon before by the general public are suddenly made illegal by Executive order or some other horrible twisting of our laws? This provides the government with a great way to narrow down the list and identify targets that have become "inconvenient" for them. Think it can't happen or that this is an off-the-wall conspiracy theory? Germany and Russia would like to have a chat with you. Sure, the mainstream users probably won't have any noticeable impact on their lives. For now at least. But this can still have a chilling effect on free speech today, without the nightmare scenario I outlined above occurring. Case in point from a couple days ago: https://news.ycombinator.com/item?id=11374839 https://news.ycombinator.com/item?id=11374839
- imaginenore 11y ago
  > Right now that data is ONLY available internally at Reddit Or anybody monitoring their traffic. coughNSAcough
  - morsch 11y ago
    Anybody monitoring their traffic who is also capable of breaking TLS.
    - komaromy 11y ago
      So, the NSA.
    - imaginenore 11y ago
      Or somebody who has access to their servers, which are AWS. I would be shocked if NSA didn't get a secret court order to get AWS access.
morsch 11y ago
In a world without canaries, all providers could have received NSLs forcing them to cooperate with wide ranging surreptitious surveillance, and we'd be none the wiser. Instead, we live in a world where we know that many of them either are not being forced to secretly cooperate; or in one where canaries don't work, and they're being forced to lie about it. And of course, there are ways of implementing internal surveillance without the cooperation of providers: by trespassing on their infrastructure, by analysing and recording traffic at their border, etc.
Lagged2Death 11y ago
Canaries are primarily a form of protest, drawing attention to the surveillance, the conscription, and the gag order all at once.
pdkl95 11y ago
> what value 1) While it isn't a perfect mapping, this is similar to a "I have nothing to hide" argument. The value of anything security or intelligence will vary with the situation. The same counter-arguments apply; you probably don't want to get to the point where you cannot learn about a NSL. 2) In general, information that allows you to make informed, up-to-date decisions is valuable. The sudden disappearance of a warrant canary gives you data about the current state of the world. The canary gives you information about the actions of the growing surveillance state. This information might be used to make preparations or as a political tool. You can decide for yourself if you would take different actions with this information, but even if it doesn't change anything for you, at least you had the opportunity to make that choice. 3) Warrant canaries also serve as an indicator of the politics of the canary publisher. Someone who publishes a canary is sending a message that they care about keeping everyone informed.
- jonathankoren 11y ago
  > 1) While it isn't a perfect mapping, this is similar to a "I have nothing to hide" argument. I think you missed the point. The real question is, "So a canary died on a service I use, now what?" Well I have that question too. The damage is done. Should I toss my phone in the nearest trash can, burn off my fingerprints, cut and bleach my hair in the at the nearest connivence store bathroom, and shed a single tear as I will never return home to my family again as I am now hitchhiking to Mexico or what? Because, honestly, I don't know what to do besides that. If you're the target of an NSL, then you need to worry. > 3) Warrant canaries also serve as an indicator of the politics of the canary publisher. Someone who publishes a canary is sending a message that they care about keeping everyone informed. Yeah, but the set of those that don't publish canaries doesn't indicate the opposite. Organization X might not publish a canary, because the canary is already dead.
  - pdkl95 11y ago
    > I think you missed the point. I'm pretty sure I didn't. > "So a canary died on a service I use, now what?" Yes, that's what I was addressing. > Should I [stereotypically run like a fugitive] Probably not, but I don't much about your specific situation. > I don't know what to do THAT was my point; you don't know know, because you cannot predict the future. The social or political situation might change in a way that makes NSL searches much more threatening. You might be in a situation where knowing that your activities have been discovered by an a NSL does suggest some type of action. It's easy to consider the set of possible futures that you can enumerate. That set is rarely complete. > If you're the target of an NSL, then you need to worry. And that's the "nothing to hide" argument. > Yeah, but the set of those that don't publish canaries doesn't indicate the opposite. Obviously. The canary is still useful information.
794CD01 11y ago
In this universe, a thread like this is created to give privacy zealots another opportunity to rant about their pet issues.
- jacalata 11y ago
  It's equal opportunity, it's a platform for anti-privacy zealots and apathetic people as well!
  - 794CD01 11y ago
    Apathetic people don't comment in the first place.
losvedir 11y ago
It's a good point - I'm not sure who really thinks of reddit as a secure and private platform. Warrant canaries certainly make more sense for gmail or dropbox or something. That said, while your behavior regarding reddit might not change, it could inform your political behavior. Since organizations can't say they've received NSLs, it's really hard to survey and see how common it is. I'm glad reddit's case here is gaining interest, and hopefully other companies will take part in this program and also get attention when it happens. It would be good to know just how prevalent this practice is.

by dfc 11y ago

awqrre 11y ago

Maybe they are now able to get posts from private subreddits and private messages, without warrants...

dfc 11y ago
Maybe they are? The question is, what am I doing differently in this universe compared to the universe where the canary is still present? It seems like your answer is "In this universe (canary removed) I no longer treat reddit as a secure and private communication platform." My personal threat model assumes that reddit is not a secure and private communication platform so the status of the canary does not change my behavior, utility schedules, outlook, etc.
- awqrre 11y ago
  I personally would not be doing anything differently but that is besides the point... they should not be able to get that data without a warrant. So I guess the value of it would be that you are now aware of something else that the government is doing that they should not be doing...
  - dfc 11y ago
    I apologize if I am missing something in your answer but "NSLs are bad, mmkay?" does not seem to be very responsive. We knew about NSLs before warrant canaries. If that is the only utility they provide it seems like they are not very useful to me.
    - awqrre 11y ago
      I wish that they would be more specific in their canary and perhaps have multiple ones... for examples: 1. we were not asked to provide private post 2. we were not asked to provide metadata like IP addresses 3. we were not asked to backdoor our website 4. we were not asked to shadowban users 5. maybe even one canary per user, to know exactly who is affected
  - mirimir 11y ago
    I entirely agree. It's foolish to believe that "private subreddits" and "private messages" are private, in any meaningful sense.
- rorosaurus 11y ago
  I don't think information needs to be immediately actionable to be useful.
deleted 11y ago
[deleted]

shostack 11y ago

Here's an example. Let's say you frequent lots of subreddits that might be considered outside societal norms. Right now that data is ONLY available internally at Reddit. If the NSA hoovered up this data, suddenly they might learn a lot about you that they didn't know before (although there's probably a fair argument that people probably leave enough other clues scattered across other data sources they likely have access to that make this redundant). Maybe you aren't looking at things that would set off their alerts for today's hot media topics. But what about the future? What if we end up with a President with a radical discriminatory agenda (a scarily likely possibility at this point unfortunately)? What if suddenly things that may have been frowned upon before by the general public are suddenly made illegal by Executive order or some other horrible twisting of our laws? This provides the government with a great way to narrow down the list and identify targets that have become "inconvenient" for them. Think it can't happen or that this is an off-the-wall conspiracy theory? Germany and Russia would like to have a chat with you. Sure, the mainstream users probably won't have any noticeable impact on their lives. For now at least. But this can still have a chilling effect on free speech today, without the nightmare scenario I outlined above occurring. Case in point from a couple days ago: https://news.ycombinator.com/item?id=11374839 https://news.ycombinator.com/item?id=11374839

imaginenore 11y ago
> Right now that data is ONLY available internally at Reddit Or anybody monitoring their traffic. coughNSAcough
- morsch 11y ago
  Anybody monitoring their traffic who is also capable of breaking TLS.
  - komaromy 11y ago
    So, the NSA.
  - imaginenore 11y ago
    Or somebody who has access to their servers, which are AWS. I would be shocked if NSA didn't get a secret court order to get AWS access.

morsch 11y ago

In a world without canaries, all providers could have received NSLs forcing them to cooperate with wide ranging surreptitious surveillance, and we'd be none the wiser. Instead, we live in a world where we know that many of them either are not being forced to secretly cooperate; or in one where canaries don't work, and they're being forced to lie about it. And of course, there are ways of implementing internal surveillance without the cooperation of providers: by trespassing on their infrastructure, by analysing and recording traffic at their border, etc.

Lagged2Death 11y ago

Canaries are primarily a form of protest, drawing attention to the surveillance, the conscription, and the gag order all at once.

pdkl95 11y ago

> what value 1) While it isn't a perfect mapping, this is similar to a "I have nothing to hide" argument. The value of anything security or intelligence will vary with the situation. The same counter-arguments apply; you probably don't want to get to the point where you cannot learn about a NSL. 2) In general, information that allows you to make informed, up-to-date decisions is valuable. The sudden disappearance of a warrant canary gives you data about the current state of the world. The canary gives you information about the actions of the growing surveillance state. This information might be used to make preparations or as a political tool. You can decide for yourself if you would take different actions with this information, but even if it doesn't change anything for you, at least you had the opportunity to make that choice. 3) Warrant canaries also serve as an indicator of the politics of the canary publisher. Someone who publishes a canary is sending a message that they care about keeping everyone informed.

jonathankoren 11y ago
> 1) While it isn't a perfect mapping, this is similar to a "I have nothing to hide" argument. I think you missed the point. The real question is, "So a canary died on a service I use, now what?" Well I have that question too. The damage is done. Should I toss my phone in the nearest trash can, burn off my fingerprints, cut and bleach my hair in the at the nearest connivence store bathroom, and shed a single tear as I will never return home to my family again as I am now hitchhiking to Mexico or what? Because, honestly, I don't know what to do besides that. If you're the target of an NSL, then you need to worry. > 3) Warrant canaries also serve as an indicator of the politics of the canary publisher. Someone who publishes a canary is sending a message that they care about keeping everyone informed. Yeah, but the set of those that don't publish canaries doesn't indicate the opposite. Organization X might not publish a canary, because the canary is already dead.
- pdkl95 11y ago
  > I think you missed the point. I'm pretty sure I didn't. > "So a canary died on a service I use, now what?" Yes, that's what I was addressing. > Should I [stereotypically run like a fugitive] Probably not, but I don't much about your specific situation. > I don't know what to do THAT was my point; you don't know know, because you cannot predict the future. The social or political situation might change in a way that makes NSL searches much more threatening. You might be in a situation where knowing that your activities have been discovered by an a NSL does suggest some type of action. It's easy to consider the set of possible futures that you can enumerate. That set is rarely complete. > If you're the target of an NSL, then you need to worry. And that's the "nothing to hide" argument. > Yeah, but the set of those that don't publish canaries doesn't indicate the opposite. Obviously. The canary is still useful information.

794CD01 11y ago

In this universe, a thread like this is created to give privacy zealots another opportunity to rant about their pet issues.

jacalata 11y ago
It's equal opportunity, it's a platform for anti-privacy zealots and apathetic people as well!
- 794CD01 11y ago
  Apathetic people don't comment in the first place.

losvedir 11y ago

It's a good point - I'm not sure who really thinks of reddit as a secure and private platform. Warrant canaries certainly make more sense for gmail or dropbox or something. That said, while your behavior regarding reddit might not change, it could inform your political behavior. Since organizations can't say they've received NSLs, it's really hard to survey and see how common it is. I'm glad reddit's case here is gaining interest, and hopefully other companies will take part in this program and also get attention when it happens. It would be good to know just how prevalent this practice is.