14 ms·

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a

by zeveb 10y ago

It'd be better, of course, if we didn't rely on Signal not storing all that metadata and instead used a protocol which made it impossible for anyone to be in a position to choose whether or not to store it. Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. I don't really know what the solution is, but I'm very uneasy about the central point of failure Open Whisper Systems is. Moxie's previous points about the difficulty of upgrading a federated protocol[2] are correct, but I think that despite the difficulty it's important to do. [1] http://freehaven.net/anonbib/cache/sassaman:wpes2005.pdf http://freehaven.net/anonbib/cache/sassaman:wpes2005.pdf [2] https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/

CiPHPerCoder 10y ago
Are you familiar with the Aqua project? I haven't seen it discussed much among privacy researchers, but it's certainly interesting. https://aqua.mpi-sws.org https://aqua.mpi-sws.org
- zeveb 10y ago
  Looks interesting … I'm looking forward to spending some time reading up on it.
tptacek 10y ago
What metadata? All they were able to produce was whether or not a phone number was associated with Signal at all, and the last time that phone number's account pinged the Signal service for any reason. They produced virtually no metadata to the investigation.
- problems 10y ago
  They would also be able to figure out what phone numbers it was communicating with, at what times and how often - they do the routing. We're relying on them not to store that metadata, which is the problem.
  - zaroth 10y ago
    We're relying on them not being successfully compelled to retain that metadata -- which is a significantly different proposition.
    - problems 10y ago
      No, not really - they can decide at any time to start storing that metadata of their own will, use it internally, sell it to advertisers or turn it over via a direct law enforcement portal if they want. Their access alone is in many ways a problem.
      - zaroth 10y ago
        Of course, we are agreeing. But as the other front page story shows us, even companies with the best of intentions and made up of people with strict moral codes devoted to providing their users a secure product can be usurped by government forces with ulterior motives. I believe Whisper doesn't want this data. I can even trust that they would never collect it of their own volition. But it's irrelevant if they can simply be compelled to collect it, or even worse, someone within their organization can be compelled to secretly collect it and may even do a better job at this secret collection than Mayer's lackies at Yahoo!.
  - segmondy 10y ago
    How would they be able to do that? Can you quote where in the article you got that and how that would happen? "Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's groups), or any records of who a user has been communicating with." If they don't store the contacts, or even a hash of the contact, how can you figure out who was talking to who?
    - georgecmu 10y ago
      Yes, but zeveb makes the following points: 1. "the contacts, or even a hash of the contact" are being not stored by choice rather than by necessity. 2. If OWS chose to start storing these metadata in the future, they could. 3. A protocol where the metadata could not be stored intrinsically would be preferable.
- zeveb 10y ago
  Only because they don't store it. They are able to choose to store it at any point; we can only rely on their honesty (and lack of compulsion). It's better to have a protocol in which there isn't any significant metadata to choose to store. I don't distrust them today, but I have no way of knowing what their future behaviour will be. I'd prefer not to have to trust.
  - CiPHPerCoder 10y ago
    Is this something OWS could be subpoena'd for? Or something that the government would just subpoena Google for? (I mean, given a phone number, can't you identify someone's Google Play account anyway? That sounds more useful.)
    - JoshTriplett 10y ago
      > Is this something OWS could be subpoena'd for? Not by subpoena alone, but in theory a court order could order them to modify their software (server or client) to collect data. They could fight that court order, and in particular it seems like they'd have a good case on the grounds that such an order would destroy their entire business, but legally a court could at least attempt to issue such an order.
    - nickpsecurity 10y ago
      I'm more concerned about this NSA/FBI partnership that secretly forces cooperation somehow. It might apply up to and including forcing a backdoor into the binary. Here's the program for US cooperation: http://www.globalresearch.ca/leaked-documents-expose-secret-contracts-between-nsa-and-tech-companies/5408929?print=1 http://www.globalresearch.ca/leaked-documents-expose-secret-... The interesting part is in this table from the TS/ECI leaks from Core Secrets: https://theintercept.com/document/2014/10/10/eci-whipgenie-classification-guide/ https://theintercept.com/document/2014/10/10/eci-whipgenie-c... Notice how the lower levels of secrecy talk about how the companies cooperate or are partners. Then, you hit TS/COMINT and TS/ECI to find additional detail: "the fact that FBI provides assistance with compelled and cooperative partnerships associated with WHIPGENIE" "details of FBI assistance with compelled and cooperative partnerships with WHIPGENIE" So, it's a backdooring program with major U.S. companies that the FBI "compels" assistance with for those that don't willingly cooperate. I have no idea what that entails but it works. It might work better on smaller firm with less resources but also maybe less as I think damaging income stream matters to greedy CEO's at public firms more. So, who knows. Personally, I think they're pulling a variation of Escobars silver or lead policy. You take generous bribes to do what they want or you take generous donations of lead. In this case, legal fines or imprisonment rather than actual lead.
- segmondy 10y ago
  Exactly, did he read the article?
  - teh_klev 10y ago
    https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html "Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."
kenOfYugen 10y ago
What about Vuvuzela? Haven't thoroughly examined it, but it focuses on metadata-privary and -relative- scalability. web: https://vuvuzela.io/ https://vuvuzela.io/ repo: https://github.com/davidlazar/vuvuzela https://github.com/davidlazar/vuvuzela paper: https://davidlazar.org/papers/vuvuzela.pdf https://davidlazar.org/papers/vuvuzela.pdf slides: https://davidlazar.org/slides/vuvuzela-sosp2015.pdf https://davidlazar.org/slides/vuvuzela-sosp2015.pdf
- Ar-Curunir 10y ago
  There's also an updated, more distributed and thus (maybe) more scalable project by some of the same authors: https://eprint.iacr.org/2016/943 https://eprint.iacr.org/2016/943
- feklar 10y ago
  Paper conclusion says the cost of running Vuvuzela is pretty high per month, so you would need a benevolent millionaire to make it happen. As for signal what every prosecutor wants is metadata to show the court that user A was in communication with user B. The actual contents of the messages aren't important especially in a conspiracy case and user B is an informant, their word against yours plus metadata showing you communicating is good enough. Besides forcing Signal to keep this metadata in the future, I wonder if they can just obtain it themselves by watching all traffic on their federated servers and timing it to discover communication networks.
  - nnn 10y ago
    The cost of running Vuvuzela is dominated by bandwidth, and the paper used AWS prices to estimate the cost; purchasing IP transit directly would lead to about an order of magnitude reduction in costs (still non-trivial, of course).
    - ryanlol 10y ago
      Order of magnitude? 1Gbit on amazon costs 22k/month. Even an order of magnitude cheaper sounds pretty damn expensive, two orders of magnitude still isn't "cheap". It's really easy to underestimate how big of a ripoff EC2 bandwidth pricing is.
StavrosK 10y ago
Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.
- TaylorAlexander 10y ago
  I trust a well designed protocol over some murky promise not to collect data on me. They collected data when they weren't supposed to before...
  - dredmorbius 10y ago
    The best protections would come from both. A strong political regime and support for privacy. Strong technical tools for enforcing those political goals.
- zeveb 10y ago
  Political solutions change as politics change: I think it's better to be mathematically secure than politically secure, since the one is forever and the other only sure until the next election.
  - fweespeech 10y ago
    They can just make it illegal to own a mathematically secure piece of software without a license.
    - deleted 10y ago
      [deleted]
    - marketanarchist 10y ago
      That would backfire economically and politically I think, especially long term. Let them ban it if they are so foolish.
      - fweespeech 10y ago
rtkwe 10y ago
> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. Yeah both of these are a pretty large problem for a messaging service designed to replace SMS on phones. Really anything other than a forum or email replacements will have a very hard time getting adopted if they have too much latency.
TeMPOraL 10y ago
Can someone explain how people are imagining protocols that do not to create / store metadata? This seems like something fundamentally impossible on a packet-switched network. After all, the data has a source and a destination, and goes through the infrastructure that's tappable (and in big part already tapped) by a state-level actor. About the only thing that comes to my mind would be a digital equivalent to broadcasting a radio signal - a protocol, under which everyone receives all communication that's done over that protocol, but each person can only decrypt the part that's addressed to them directly. This would reduce the metadata to "who's broadcasting", without revealing the listener. EDIT: Some back-of-the-napkin calculations on such broadcast protocol: I took a look on my today's communication with my SO; rounding somewhat up, it would be ~100 messages of on average 50 characters, going in both directions. That gives, using 2 bytes for character and multiplying by 1.5 to account for protocol-related padding: - 15000 bytes / user / day of a single conversation Say this protocol has 1M user, that gives us: (50 * 100 * 2 * 1.5 * 1000000) / (100010001000) 15 GB of data, spread over the whole day. Seems manageable; especially if one would be to bucket it by e.g. hour by default, or less, if client is active and streaming data continously. Definitely a mobile bandwidth killer, though.
- frandroid 10y ago
  A blockchain, of sorts...
  - valarauca1 10y ago
    Blockchains can do this. But they create relatively absurd systems of who can/can't send messages based on how much they've mined. Block chains are HORRIBLE for encrypted messaging. Since your message is PERMANENTLY part of the chain. So if a encryption is broken, or your password gets leaked. ANYONE can read your messages. In most cases a DHT is far simpler. But naturally some nodes can be evil and log metadata. This is just a risk, but it also exists in block chains. Furthermore DHT's are lower latency then block-chains. Blockchains aren't a magic fix all solution for network consistency/privacy models. Outside of currency transactions it is a horrible distributed system model.
newman314 10y ago
+1 I'm still looking for an option that is basically Richochet+Signal+Burner. That would be an ideal app IMO.
eatbitseveryday 10y ago
> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. One recent project that validates this is from ACM SOSP'15 titled "Vuvuzela: scalable private messaging resistant to traffic analysis"[1] (open-access URL): > Vuvuzela has a linear cost in the number of clients, and experiments show that it can achieve a throughput of 68,000 messages per second for 1 million users with a 37-second end-to-end latency on commodity servers. > Vuvuzela works by routing user messages through a chain of servers, as shown in Figure 1, where each of the servers adds cover traffic to mask the communication patterns of users. Similar to the P2P project Bitmessage[2] where clients receive and forward traffic not related to themselves. There were some comments on HN discussing FreeNet and how it similarly forwards traffic unrelated to an individual client, but which has led to conviction by police, unfortunately. [1] http://dl.acm.org/authorize?N93273 http://dl.acm.org/authorize?N93273 [2] https://www.bitmessage.org/ https://www.bitmessage.org/
- wyager 10y ago
  > Freenet ... which has led to conviction by police, unfortunately. Just for using it? That's crazy! Do you have a source?
  - kodablah 10y ago
    No, not just for using it that I am aware of. Just meaning that pure anonymity on Freenet is not the absolute best and they suggest trusted peers only. Traffic analysis (among other things) is a hard problem to solve without introducing noise and requiring large bandwidth. I think what the parent was saying was that [1] is possible is unfortunate (without making any statements supporting the criminals of course). 1 - http://www.thedickinsonpress.com/news/north-dakota/3885239-predators-police-online-struggle http://www.thedickinsonpress.com/news/north-dakota/3885239-p...
  - eatbitseveryday 10y ago
    >> Freenet ... which has led to conviction by police, unfortunately. > Just for using it? That's crazy! Do you have a source? Hm, I admit fault, hastily writing the above reply. I do not have sources for actual convictions, so what I wrote is not validated. s/has led to/may risk/ Source[1] that I read prior to my comment, which is under the thread[2] "Suspect jailed indefinitely for refusing to decrypt hard drives". The discussion was along the lines of, if you have encrypted data, and the state "knows" it has illegal content, your not decrypting it makes you liable for it. Thus the extrapolation to use of Freenet, which forwards encrypted content from others, and is heavily littered with CP[3], according to HN commenters. [1] https://news.ycombinator.com/item?id=11590880 https://news.ycombinator.com/item?id=11590880 [2] https://news.ycombinator.com/item?id=11590421 https://news.ycombinator.com/item?id=11590421 [3] https://news.ycombinator.com/item?id=8081364 https://news.ycombinator.com/item?id=8081364
Canada 10y ago
I wonder if or when they'll think to ask for the user's associated push messaging ID. Then they could ask Apple or Google to turn over any cloud data they have for that phone.
vvpan 10y ago
Is "Pynchon Gate" named after Thomas Pynchon?

by zeveb 10y ago

CiPHPerCoder 10y ago

Are you familiar with the Aqua project? I haven't seen it discussed much among privacy researchers, but it's certainly interesting. https://aqua.mpi-sws.org https://aqua.mpi-sws.org

zeveb 10y ago
Looks interesting … I'm looking forward to spending some time reading up on it.

tptacek 10y ago

What metadata? All they were able to produce was whether or not a phone number was associated with Signal at all, and the last time that phone number's account pinged the Signal service for any reason. They produced virtually no metadata to the investigation.

problems 10y ago
They would also be able to figure out what phone numbers it was communicating with, at what times and how often - they do the routing. We're relying on them not to store that metadata, which is the problem.
- zaroth 10y ago
  We're relying on them not being successfully compelled to retain that metadata -- which is a significantly different proposition.
  - problems 10y ago
    No, not really - they can decide at any time to start storing that metadata of their own will, use it internally, sell it to advertisers or turn it over via a direct law enforcement portal if they want. Their access alone is in many ways a problem.
    - zaroth 10y ago
      Of course, we are agreeing. But as the other front page story shows us, even companies with the best of intentions and made up of people with strict moral codes devoted to providing their users a secure product can be usurped by government forces with ulterior motives. I believe Whisper doesn't want this data. I can even trust that they would never collect it of their own volition. But it's irrelevant if they can simply be compelled to collect it, or even worse, someone within their organization can be compelled to secretly collect it and may even do a better job at this secret collection than Mayer's lackies at Yahoo!.
- segmondy 10y ago
  How would they be able to do that? Can you quote where in the article you got that and how that would happen? "Notably, things we don't have stored include anything about a user's contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user's groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user's groups), or any records of who a user has been communicating with." If they don't store the contacts, or even a hash of the contact, how can you figure out who was talking to who?
  - georgecmu 10y ago
    Yes, but zeveb makes the following points: 1. "the contacts, or even a hash of the contact" are being not stored by choice rather than by necessity. 2. If OWS chose to start storing these metadata in the future, they could. 3. A protocol where the metadata could not be stored intrinsically would be preferable.
zeveb 10y ago
Only because they don't store it. They are able to choose to store it at any point; we can only rely on their honesty (and lack of compulsion). It's better to have a protocol in which there isn't any significant metadata to choose to store. I don't distrust them today, but I have no way of knowing what their future behaviour will be. I'd prefer not to have to trust.
- CiPHPerCoder 10y ago
  Is this something OWS could be subpoena'd for? Or something that the government would just subpoena Google for? (I mean, given a phone number, can't you identify someone's Google Play account anyway? That sounds more useful.)
  - JoshTriplett 10y ago
    > Is this something OWS could be subpoena'd for? Not by subpoena alone, but in theory a court order could order them to modify their software (server or client) to collect data. They could fight that court order, and in particular it seems like they'd have a good case on the grounds that such an order would destroy their entire business, but legally a court could at least attempt to issue such an order.
  - nickpsecurity 10y ago
    I'm more concerned about this NSA/FBI partnership that secretly forces cooperation somehow. It might apply up to and including forcing a backdoor into the binary. Here's the program for US cooperation: http://www.globalresearch.ca/leaked-documents-expose-secret-contracts-between-nsa-and-tech-companies/5408929?print=1 http://www.globalresearch.ca/leaked-documents-expose-secret-... The interesting part is in this table from the TS/ECI leaks from Core Secrets: https://theintercept.com/document/2014/10/10/eci-whipgenie-classification-guide/ https://theintercept.com/document/2014/10/10/eci-whipgenie-c... Notice how the lower levels of secrecy talk about how the companies cooperate or are partners. Then, you hit TS/COMINT and TS/ECI to find additional detail: "the fact that FBI provides assistance with compelled and cooperative partnerships associated with WHIPGENIE" "details of FBI assistance with compelled and cooperative partnerships with WHIPGENIE" So, it's a backdooring program with major U.S. companies that the FBI "compels" assistance with for those that don't willingly cooperate. I have no idea what that entails but it works. It might work better on smaller firm with less resources but also maybe less as I think damaging income stream matters to greedy CEO's at public firms more. So, who knows. Personally, I think they're pulling a variation of Escobars silver or lead policy. You take generous bribes to do what they want or you take generous donations of lead. In this case, legal fines or imprisonment rather than actual lead.
segmondy 10y ago
Exactly, did he read the article?
- teh_klev 10y ago
  https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html "Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

kenOfYugen 10y ago

What about Vuvuzela? Haven't thoroughly examined it, but it focuses on metadata-privary and -relative- scalability. web: https://vuvuzela.io/ https://vuvuzela.io/ repo: https://github.com/davidlazar/vuvuzela https://github.com/davidlazar/vuvuzela paper: https://davidlazar.org/papers/vuvuzela.pdf https://davidlazar.org/papers/vuvuzela.pdf slides: https://davidlazar.org/slides/vuvuzela-sosp2015.pdf https://davidlazar.org/slides/vuvuzela-sosp2015.pdf

Ar-Curunir 10y ago
There's also an updated, more distributed and thus (maybe) more scalable project by some of the same authors: https://eprint.iacr.org/2016/943 https://eprint.iacr.org/2016/943
feklar 10y ago
Paper conclusion says the cost of running Vuvuzela is pretty high per month, so you would need a benevolent millionaire to make it happen. As for signal what every prosecutor wants is metadata to show the court that user A was in communication with user B. The actual contents of the messages aren't important especially in a conspiracy case and user B is an informant, their word against yours plus metadata showing you communicating is good enough. Besides forcing Signal to keep this metadata in the future, I wonder if they can just obtain it themselves by watching all traffic on their federated servers and timing it to discover communication networks.
- nnn 10y ago
  The cost of running Vuvuzela is dominated by bandwidth, and the paper used AWS prices to estimate the cost; purchasing IP transit directly would lead to about an order of magnitude reduction in costs (still non-trivial, of course).
  - ryanlol 10y ago
    Order of magnitude? 1Gbit on amazon costs 22k/month. Even an order of magnitude cheaper sounds pretty damn expensive, two orders of magnitude still isn't "cheap". It's really easy to underestimate how big of a ripoff EC2 bandwidth pricing is.

StavrosK 10y ago

Yeah, but I'm kind of tired of having to fight my own government every step of the way. I'd prefer a political solution at this point.

TaylorAlexander 10y ago
I trust a well designed protocol over some murky promise not to collect data on me. They collected data when they weren't supposed to before...
- dredmorbius 10y ago
  The best protections would come from both. A strong political regime and support for privacy. Strong technical tools for enforcing those political goals.
zeveb 10y ago
Political solutions change as politics change: I think it's better to be mathematically secure than politically secure, since the one is forever and the other only sure until the next election.
- fweespeech 10y ago
  They can just make it illegal to own a mathematically secure piece of software without a license.
  - deleted 10y ago
    [deleted]
  - marketanarchist 10y ago
    That would backfire economically and politically I think, especially long term. Let them ban it if they are so foolish.
    - fweespeech 10y ago

rtkwe 10y ago

> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. Yeah both of these are a pretty large problem for a messaging service designed to replace SMS on phones. Really anything other than a forum or email replacements will have a very hard time getting adopted if they have too much latency.

TeMPOraL 10y ago

Can someone explain how people are imagining protocols that do not to create / store metadata? This seems like something fundamentally impossible on a packet-switched network. After all, the data has a source and a destination, and goes through the infrastructure that's tappable (and in big part already tapped) by a state-level actor. About the only thing that comes to my mind would be a digital equivalent to broadcasting a radio signal - a protocol, under which everyone receives all communication that's done over that protocol, but each person can only decrypt the part that's addressed to them directly. This would reduce the metadata to "who's broadcasting", without revealing the listener. EDIT: Some back-of-the-napkin calculations on such broadcast protocol: I took a look on my today's communication with my SO; rounding somewhat up, it would be ~100 messages of on average 50 characters, going in both directions. That gives, using 2 bytes for character and multiplying by 1.5 to account for protocol-related padding: - 15000 bytes / user / day of a single conversation Say this protocol has 1M user, that gives us: (50 * 100 * 2 * 1.5 * 1000000) / (100010001000) 15 GB of data, spread over the whole day. Seems manageable; especially if one would be to bucket it by e.g. hour by default, or less, if client is active and streaming data continously. Definitely a mobile bandwidth killer, though.

frandroid 10y ago
A blockchain, of sorts...
- valarauca1 10y ago
  Blockchains can do this. But they create relatively absurd systems of who can/can't send messages based on how much they've mined. Block chains are HORRIBLE for encrypted messaging. Since your message is PERMANENTLY part of the chain. So if a encryption is broken, or your password gets leaked. ANYONE can read your messages. In most cases a DHT is far simpler. But naturally some nodes can be evil and log metadata. This is just a risk, but it also exists in block chains. Furthermore DHT's are lower latency then block-chains. Blockchains aren't a magic fix all solution for network consistency/privacy models. Outside of currency transactions it is a horrible distributed system model.

newman314 10y ago

+1 I'm still looking for an option that is basically Richochet+Signal+Burner. That would be an ideal app IMO.

eatbitseveryday 10y ago

> Unfortunately, the protocols that enable truly traffic–analysis-resistant messaging (I believe the Pynchon Gate[1] is currently the best-of-breed) tend to have increased latency and consume greatly-increased bandwidth. One recent project that validates this is from ACM SOSP'15 titled "Vuvuzela: scalable private messaging resistant to traffic analysis"[1] (open-access URL): > Vuvuzela has a linear cost in the number of clients, and experiments show that it can achieve a throughput of 68,000 messages per second for 1 million users with a 37-second end-to-end latency on commodity servers. > Vuvuzela works by routing user messages through a chain of servers, as shown in Figure 1, where each of the servers adds cover traffic to mask the communication patterns of users. Similar to the P2P project Bitmessage[2] where clients receive and forward traffic not related to themselves. There were some comments on HN discussing FreeNet and how it similarly forwards traffic unrelated to an individual client, but which has led to conviction by police, unfortunately. [1] http://dl.acm.org/authorize?N93273 http://dl.acm.org/authorize?N93273 [2] https://www.bitmessage.org/ https://www.bitmessage.org/

wyager 10y ago
> Freenet ... which has led to conviction by police, unfortunately. Just for using it? That's crazy! Do you have a source?
- kodablah 10y ago
  No, not just for using it that I am aware of. Just meaning that pure anonymity on Freenet is not the absolute best and they suggest trusted peers only. Traffic analysis (among other things) is a hard problem to solve without introducing noise and requiring large bandwidth. I think what the parent was saying was that [1] is possible is unfortunate (without making any statements supporting the criminals of course). 1 - http://www.thedickinsonpress.com/news/north-dakota/3885239-predators-police-online-struggle http://www.thedickinsonpress.com/news/north-dakota/3885239-p...
- eatbitseveryday 10y ago
  >> Freenet ... which has led to conviction by police, unfortunately. > Just for using it? That's crazy! Do you have a source? Hm, I admit fault, hastily writing the above reply. I do not have sources for actual convictions, so what I wrote is not validated. s/has led to/may risk/ Source[1] that I read prior to my comment, which is under the thread[2] "Suspect jailed indefinitely for refusing to decrypt hard drives". The discussion was along the lines of, if you have encrypted data, and the state "knows" it has illegal content, your not decrypting it makes you liable for it. Thus the extrapolation to use of Freenet, which forwards encrypted content from others, and is heavily littered with CP[3], according to HN commenters. [1] https://news.ycombinator.com/item?id=11590880 https://news.ycombinator.com/item?id=11590880 [2] https://news.ycombinator.com/item?id=11590421 https://news.ycombinator.com/item?id=11590421 [3] https://news.ycombinator.com/item?id=8081364 https://news.ycombinator.com/item?id=8081364

Canada 10y ago

I wonder if or when they'll think to ask for the user's associated push messaging ID. Then they could ask Apple or Google to turn over any cloud data they have for that phone.

vvpan 10y ago

Is "Pynchon Gate" named after Thomas Pynchon?