11 ms·
Tell HN: Riseup.net fails to update canary; fingerprints deleted without notice
After almost a week of direct questioning, canary is still not updated:
https://riseup.net/pl/about-us/canary
Certificate fingerprints deleted for certain domains on Oct. 22nd without notice:
https://github.com/riseupnet/riseup_help/commit/8a8c98e0aaa635130a899c1980569f34633d159d
Page where fingerprints no longer appear:
https://riseup.net/pl/security/network-security/certificates
- maxt 10y agoI am highly skeptical of any claim that an email provider is more private than other providers. E-mail is fundamentally not secure and not private, unless you enhance it with PGP, which requires you to, of course, have something you want private. Most people don't encrypt because they're not scared enough. It usually takes some time before their wordlview is repeatedly shattered enough that encryption is the only choice they have.
- jimktrains2 10y ago> E-mail is fundamentally not secure and not private, unless you enhance it with PGP, which requires you to, of course, have something you want private. That's not true. A friend and I use GPG just to use GPG. You don't have to want to keep something private, just like you don't need to be doing illegal things to want curtains on your house.
- maxt 10y agoThanks for clarifying. I have to remember this quote: "If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged" What I mean is that I can decide to not encrypt and have my emails under public scrutiny, but as I said, most people are not scared enough because it doesn't happen on their watch. It doesn't matter what the content is, or how non-libelous - if it's encrypted with PGP, it's private.
- hackuser 10y agoThe parent statement is very misleading. Here are some significant differentiators between email providers: * Encryption in transmission emails sent and received, using SSL/TLS * Encryption in transmission of webmail sessions, using HTTPS * Authentication security: Do they use 2 factor or other tech? * Logging and retention of logs * Reading your mail to build marketing profiles and social graphs * Access by employees to your data * Retaining and sharing your personal data with other businesses * Security of your account information; can they easily be persuaded to surrender it * Security of the email provider's systems * Responsiveness to 3rd party requests for your information, whether private parties in lawsuits or legal authorities with/without warrants * Cooperation with government surveillance dragnets Security always is a matter of degree. Email will never be perfectly secure but there are some big differences between providers.
- maxt 10y ago> Authentication security: Do they use 2 factor or other tech? Sorry for sniping this specific one, but 2FA is (more often than not), security theater. It gives the illusion of security like how TSA baggage check is a big dance of scanning, pat-downs, and key ceremonies. For context, consider Yahoo Mail, where emails are read by intelligence agencies before the user even gets them. Does my 2FA help here? Probably not. I can understand that 2FA does have its uses, but frequently I'm seeing it being used like those 'Secured by Comodo SSL' with a picture of a shield to make a would-be shopper feel like the transaction is more secure. It can be theater.
- hackuser 10y ago2FA is generally effective but not enough to guarantee security by itself.
- Xorlev 10y agoIt doesn't help a system-level adversary, but it does help prevent trivial takeovers by malicious actors attempting to get access to your email as a vector to compromise other services. To summarize, 2FA does not prevent email reading if the provider doesn't, however it does help prevent run of the mill takeovers, especially if you've reused a password somewhere. Security is all about defense in depth, it's worth keeping in mind that 2FA is an important step there, but by no means the only one. If you aren't encrypting+signing a message, you've already decided that security requirements of that particular message is minimal.
- djsumdog 10y agoI was running my own e-mail server for a while before I finally got around to generating/publishing a PGP key. It's a pretty simple process, but also an incredibly complicated process for the uninitiated.
- smonff 10y agoI would add that Riseup don't claim to be the best on security or privacy. > Riseup provides online communication tools for people and groups working on liberatory social change. We are a project to create democratic alternatives and practice self-determination by controlling our own secure means of communications. This is what they claim on their homepage[1]. Tools built by people who believe in a certain philosophy for people working on "liberatory social change". They try to operate and control their tools. They don't claim that they are "the-most-secure-email-provider". They claim to work on what they call "Network Security"[2] (traffic encrypting and providing services outside of the tracking bubble), and define other fields of security ("Human Security", "Device Security", "Message Security"), that the user can improve himself by education. They provide means of education for this. This is an alternative. Gmail is maybe more "secure", or maybe not, but don't claim these kind of social changes. Gmail is "free" and commercial. Riseup is not free and volunteer-run. [1] https://riseup.net/ https://riseup.net/ [2] https://riseup.net/en/security/#security-overview https://riseup.net/en/security/#security-overview edits: typos
- bitxbitxbitcoin 10y agoIs it due to be updated by today? Or is it not late until the last quarter of 2016 passes without an update?
- confounded 10y agoIs an FOIA request useful?
- deleted 10y ago[deleted]
- jrochkind1 10y agoto whom hoping to get what? Probably not. You obviously can't get secret security letters or sealed warrants via an FOIA.
- deleted 10y ago[deleted]
- geofft 10y agoFOIA has a specific exemption for national security, so it's probably not useful regarding national security letters. https://www.foia.gov/faq.html#exemptions https://www.foia.gov/faq.html#exemptions
- mirimir 10y agoAnd from riseup.net @riseupnet listen to the hummingbird, whose wings you cannot see, listen to the hummingbird, don't listen to me. #LeonardCohen https://twitter.com/riseupnet/status/797142735283257345 https://twitter.com/riseupnet/status/797142735283257345
- Anderkent 10y agoOkay, that's telling, but the canary on its own seems to be valid still - it's from August 16, 2016, and they say it should be 'updated approximately once per quarter'
- mirimir 10y agoI certainly have no clue. I'm still getting email :) And they've had indirect FBI attention before: https://riseup.net/en/about-us/press/fbi-seizes-anonymous-remailer https://riseup.net/en/about-us/press/fbi-seizes-anonymous-re...
- orthoganol 10y agoSpeaking for myself, this was brought to my attention in the context of a developing story about WikiLeaks being under duress or Julian Assange missing, who has not sent direct communication let alone signed communication for around a month now. EDIT - if curious, https://www.reddit.com/r/WhereIsAssange/ https://www.reddit.com/r/WhereIsAssange/
- ebcode 10y agoI'm trying to spread the word. Please post a proof-of-life of yourself today somewhere on the internet. http://imgur.com/9Gn8tRr http://imgur.com/9Gn8tRr
- orthoganol 10y agoSorry, I don't understand this. It's incredibly bizarre to be posting selfies with messages on HN.
- ebcode 10y agoGranted. You're right that this is bizarre. I'm posting a proof-of-life of myself because Julian Assange is unable to, and I'm trying to get the word out. It's not just a selfie -- It's proof that I'm alive. Basically I'm pretty much freaking out at the moment because it appears that Julian has been disappeared, and I'm doing whatever I can to try and spread awareness about this issue. Previously, there were people on HN who were sympathetic to WikiLeaks and their cause, and this appears to be changing.
- jug5 10y agoRunning out of freedom...
- module0000 10y agoImagine if your office live-broadcasted nearly everything. From the corridors, reception area, to the opening of physical mail. The PR and generally more "public" email addresses could be transparent as well. This means when the NSL arrives, it will be seen by the world.
- VMG 10y agoor the feed goes black
- roywiggins 10y agoOr the CEO met in his doorstep by Men In Black, or whoever it is that delivers these things.
- brassic 10y agoI bet you a jam sandwich that an NSL is not actually a letter sent in the regular post.
- colinbartlett 10y agoThey certainly are real letters, though you're right in that they might be hand delivered by an official process server. Either that, or just mailed with a return receipt and signature required. Yahoo was able to publish the letters they received: https://s.yimg.com/ge/tyc/Redacted_Non-disclosure_Termination.pdf https://s.yimg.com/ge/tyc/Redacted_Non-disclosure_Terminatio...
- brassic 10y agoOf course, it is ultimately a piece of paper... But in every company I've worked for mail is signed for by whoever and, if it's addressed to an executive, delivered to a secretary who reads it and decides what to do it. Given the requirement for secrecy, there is zero chance that an NSL will be treated in this way. And it won't be served by a random process server. Most likely it will be served by an NSA employee, in a discreet situation of their choosing.
- geuis 10y ago"a FOIA".
- Anderkent 10y agoDepends if you pronounce it as one word, or as 'Ef Oh Ai Ey', I suppose.
- jeremy7600 10y agoFor the abbreviation,"an FOIA" is correct. For the term "a Freedom of Information act" is correct. Its based on the sounds, not the word being abbreviated.
- jeremy7600 10y agoIe: an F. Ie: a friend.
- tkxxx7 10y agomaybe they're reading "a foy-uh"
- jeremy7600 10y agoGot any references to anyone speaking a foy-uh out loud? Ive only ever know it to be 4 letters, said discretely, and not as a word like SQL.
- cjbprime 10y agoI don't have a citation, but am sure I've heard people say "foya requests" out loud, probably lawyers at hacker conferences.
- enraged_camel 10y agoI work with government people and contractors a lot and I've never heard it not pronounced "foya."
- morganvachon 10y ago
- 0xCMP 10y ago> If you are doing certificate pinning with us, we are updating certs! so keep calm and check the new FPs here https://twitter.com/riseupnet/status/790245677234282496 https://twitter.com/riseupnet/status/790245677234282496
- eutropia 10y agoI'm uninformed. What is the significance of riseup.net?
- devoply 10y agoFrom top of their page: " Riseup provides online communication tools for people and groups working on liberatory social change. We are a project to create democratic alternatives and practice self-determination by controlling our own secure means of communications. "
- benevol 10y agoTotal surveillance means a full frontal attack on democracy. And this situation here seems to be a tiny reminder.
- Raed667 10y agoThey're my email and VPN providers with a great history for privacy.
- defgeneric 10y agoI remember it being used a lot by radical leftist (mostly anarcho-*) groups when I was at university. But even then it was basically assumed that riseup was infiltrated or a honeypot run by the feds.
- Forbo 10y agolabs.riseup.net is home to the git repo for Tails.
- djsumdog 10y agoI hadn't heard of it either until just now. I remember when Reddit removed their warrant canary. I barely even use it now. For most people I bet it didn't matter. I have a feeling with mission of Riseup, this will have a much larger impact on their userbase .. the ones who are aware of this.
- 10y ago
- davimack 10y agoI love how this conversation devolved into pedantry, honestly. Worry about the a/an usage, don't address the root issue, why don't you. Yup: programmers are grammar nazis.
- dates 10y agoBefore the most recent update, it was updated April 10th. So 121 days between updates. At the same rate, it would be updated next around December 21st. But yeah that is a strange tweet, and lack of tweets since is also strange.
- corndoge 10y agoOctober 23: "If you are doing certificate pinning with us, we are updating certs! so keep calm and check the new FPs here https://riseup.net/en/security/network-security/certificates https://riseup.net/en/security/network-security/certificates …" https://twitter.com/riseupnet/status/790245677234282496 https://twitter.com/riseupnet/status/790245677234282496 Updated fingerprints (PGP signed Oct 22): https://riseup.net/security/network-security/certificates/riseup-signed-certificate-fingerprints.txt https://riseup.net/security/network-security/certificates/ri... Edit: See OP below restating that fingerprints for certain subdomains are what is missing. Should have read more closely ;)
- orthoganol 10y agoYes I linked to the current certs in the post text. The issue is with the domains that were deleted in the commit (also linked) which no longer appear in these links. Black, labs, and a few others have their own certificate that no longer can be verified with fingerprints, since Oct 22nd.
- deleted 10y ago[deleted]
- oconnore 10y agoIf you care enough to post canaries, shouldn't you also care enough to just close shop instead of subtly telling your users to stop using your services?
- adrusi 10y agoI'd imagine that since lavabit NSLs make that harder if not illegal.
- tammer 10y agoits not within legal purview to force someone to continue doing something, is it?
- cyphar 10y agoBut they could order them to give them access to administer their servers, with acts of sabotage being punishable. There's no reason you should assume that the people running RiseUp right now are the same people that ran it a week ago.
- CmdrSprinkles 10y agoEven if you shut down immediately (more on that in a moment), you can't wipe your storage and The State can still look through that And if it is an ongoing investigation, shutting down immediately may be very difficult. Unless you can make a compelling case that you were already doing so for whatever reason, it is a very clear textbook case of obstruction of justice/interfering with an ongoing investigation.
- dingaling 10y agoOr at least care enough to update them more than once a quarter... worse than useless, since those Unspeakable Agencies will have had their fill of information by then. And then the canary dies and people panic into moving their hosting to 'stay private'.
- egeozcan 10y agoThey just tweeted that they have no plans of doing so https://twitter.com/riseupnet/status/800815181190217729 https://twitter.com/riseupnet/status/800815181190217729
- jtmarmon 10y agoPerhaps I'm doing this wrong but when I try to verify the gpg signature I get gpg: Signature made Tue Aug 16 01:01:19 2016 EDT using RSA key ID 139A768E gpg: Good signature from "Riseup Networks <collective@riseup.net>" [unknown] gpg: aka "Riseup Treasurer <treasurer@riseup.net>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 4E07 9126 8F7C 67EA BE88 F1B0 3043 E2B7 139A 768E
- geofft 10y agoDo you have a trust path between you and that key? If not, that message is normal, but you have no in-band way of knowing whether it's a valid signature from the right key or a valid signature from a fake key. However, if you have some trustworthy source that that's the right fingerprint, then you know it's a valid signature from the right key. (This is why I hate PGP.)
- tptacek 10y agoIf you're doing any kind of radical political work --- left or right --- and are worried about the attention you're going to attract, don't use things like RISEUP.NET. You shouldn't be running mailing lists at all. You shouldn't be using Jabber and asking all your peers to enable encryption. These are fundamentally unsafe services, and the idea that they can be provided safely just by paying attention to network security is terribly misleading. In the universe of possible media in which to conduct discussions with a group of peers, there may be none less safe than SMTP email mailing lists. Keep secrets off mailing lists. Never use mailing lists for secrets. Assume your mailing lists are public. Nobody is going to deploy a mailing list security solution that will ever be adequate against state-level adversaries. Any site claiming to keep political activists secure that offers mailing lists should be viewed with suspicion, because "don't use mailing lists" is close to the only thing that messaging security people agree about.
- Raed667 10y agoI remember clearly a Tunisian opposition party was using a RISEUP mailing list around 2006 to spread its articles, political statements, etc... (When they were banned before the revolution of 2011). Not all politicians can/know how to operate anything more complex than an email account.
- Cyph0n 10y agoThat's an interesting piece of history. It kind of makes sense that accessibility can sometimes be worth the potential downsides. By the way, are you a fellow Tunisian? I'm kind of surprised because I've never run into a Tunisian on HN :p
- Raed667 10y agoMaybe one day I'll release an archive of pre-2011 emails and IRC logs. Yes I'm Tunisian, I only know of a couple active people around here, but there is a ton of readers.
- 10y ago
- llamataboot 10y agoNew tweet: https://twitter.com/riseupnet/status/800815181190217729 https://twitter.com/riseupnet/status/800815181190217729 Confusing update IMHO. Could be read as reassurance. Could also be read as being threatened with incarceration and being forced to keep the site up. or a reminder to archive stuff immediately because of impending shutdown. Not really sure what to make of it, other than they have obviously heard the concerns and /not/ updated the canary.
- josho 10y agoNot really my area of expertise, but it strikes me as completely clear. The canary hasn't been updated and the tweet implicitly acknowledges that they are aware of the concerns that people have about the overdue update. I can only think of two reasons to do this. 1. get some publicity or 2. for whatever reason they are unable to update the canary and are unable to say why. Personally, I doubt it's reason 1.
- llamataboot 10y agoBut why say they have no plans to shut down and link directly to the part of their FAQ where they say they will shut down if they are under government surveillance? Why not just tweet something like "We have heard your concerns" or something similar
- fzn 10y agoMaybe they lost access to their infrastructure and twitter account. Who posted this (to-date) last message? Better be cautious, activists.
- segmondy 10y agoYou might not be able to shutdown if you have been forced to keep the service running.
- themattbook 10y agoThe purpose of the hyperbole, I'd assume, is to make one ask the same questions you're asking. In the philosophical sense: if we have to ask, we already have our answer.
- stromthurman 10y agoMisleading title. There were no "fingerprints deleted without notice"
- beardog 10y agoI Don't get it. They last updated in august. Wouldn't the next be due in December?
- deleted 10y ago[deleted]
- Residue 10y agoLooks like issue will be resolved soon: https://twitter.com/riseupnet/status/765414528951529472 https://twitter.com/riseupnet/status/765414528951529472 .@flanvel Thanks for noticing. A refreshed canary statement will be up shortly. ---------------------------------- Disregard, I forgot to check date. ---------------------------------- That tweet is from august