18 ms·

SpiderOak removes its warrant canary

235 points by dannyw 8y ago

Lazare 8y ago
I've had some mixed feelings about SpiderOak in the past, but at least they did this right. Props to them for making a canary and then following through on it.
- Caipenghui 8y ago
  v
- maxerickson 8y ago
  Or it doesn't mean anything. Who knows, that's the beauty of it.
  - Cthulhu_ 8y ago
    Well no, it means that either they've been compromised and thus shouldn't be trusted anymore, or they forgot (?) to update their canary which means they shouldn't be trusted anymore. Don't "who knows?" on this subject, it makes you look like a government shill trying to lull privacy conscious people into indifference.
    - maxerickson 8y ago
      What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Unless you want to cite a bunch of jurisprudence that warrant canaries actually work, I'm gonna stick on "who knows", even though I'm not a government shill (I'm more "pragmatic about who really has the power in that particular relationship").
      - NullPrefix 8y ago
        >even though I'm not a government shill Let's just stick with "who knows" on that one too.
      - viraptor 8y ago
        > What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Then a nice solution would be to say "our lawyer explained to us that removing the canary for a reason is likely to be criminal, so we're letting you know we're going to remove it in 2 months to make you more sure we're not doing it in response to a current issue".
        cyphar 8y ago
        And people would have precisely the same primary reaction (as they should) but then would also get angry at SpiderOak for "poisoning the well" with doubts about the legality of warrant canaries. To be clear, as far as I know there is no legal precedent that says warrant canaries are a legal way of subverting gag orders (then again, the fact there is no such legal case even though Reddit activated their warrant canary could point in the favour that the US government doesn't want to try their luck in court).
      - philipov 8y ago
        It doesn't matter what kind of excuses they give. Once a canary is dead, everyone should behave as if the target has been compromised. That is what the canary is for, and once you sign it, you can't just go back. If you don't continue updating a deadman's switch, it doesn't matter if you died or not: it activates.
      - rocqua 8y ago
        Technically, this is why the canary had an expiration. This means they did not need to remove the canary, just let it expire and refuse to publish a new canary.
    - brownbat 8y ago
      > makes you look like a government shill We're on a site where we strive to assume good faith, avoid name calling, reply to the argument not the person, take the strongest possible form of what someone is saying (iron man not straw man), etc. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - peterkelly 8y ago
    If it's gone, it means that have received a warrant. That's the whole point of the warrant canary.
  - forkerenok 8y ago
    I think nobody really needs to know exactly what's happening to make the right decision. People that are serious about opsec/etc. will read this (fuzzy/distorted) signal and jump ship. They will not be dwelling on the nature of this signal.
    - maxerickson 8y ago
      I have a hard time believing that People that are serious about opsec/etc. even care about the warrant canary to begin with. People with real concerns aren't going to rely on an untested legal gizmo.
  - Lazare 8y ago
    SpiderOak basically said "if we do this, you should stop using us" (well, if you care about warrant canaries). And then they did it. It doesn't mean that they received a warrant, but it does mean SpiderOak is telling you not to use them, and I think that when a service tell you that, for whatever reason, it means quite a lot. :) (Even if, as you suggest further down, they received legal advice that warrant canaries were a bad idea and they needed to take it down, the way they handled the entire process makes it clear that they aren't taking this seriously. Posting a warrant canary, updating it regularly, and then taking it down while not telling the real (legit) reason is reckless at best, and in my view is basically the worst way they could handle it.) Whatever a realistic estimation of SpiderOak's security was before this news, I think it has to be strictly lower now, right? (Mind you...on further reflection I'm not convinced the transparency report is any more - or less - meaningful than the canary. The theory behind both is that the government cannot compel false speech. If that's true, then both are equally protective; if it's false, both are equally pointless. SpiderOak did say "if we stop updating this stop using us", and then they stopped updating it, but...then they published a transparency report saying "0 NSLs". So...maybe they're just really awful at communication.)
Caipenghui 8y ago
b
jokoon 8y ago
If you look at the comment they debate that a candy can mean the service is not as secure as it was, like truecrypt did use its canary.
- barking 8y ago
  I think you're wrong about Truecrypt, it's still safe but just won't ever be updated. https://www.grc.com/misc/truecrypt/truecrypt.htm https://www.grc.com/misc/truecrypt/truecrypt.htm
  - dogma1138 8y ago
    With the level of uncertainty and the suspicious circumstances behind the author you can’t really consider it’s safe to use considering the threat model.
  - cyphar 8y ago
    I get their point, but just as it might be "foolish" to assume that software which was audited is no longer secure just because the developers have stopped working on it, it is also "foolish" to use cryptographic software that is not being worked on actively by experts. And since TrueCrypt is proprietary, people should not be using it anyway (not because you cannot read or modify the source code but because the license itself is "full of traps" according to the fedora-legal team[1])-- Linux's dm-crypt can decrypt TrueCrypt volumes (though it's read-only from memory) if you need legacy support. [1]: https://lists.freedesktop.org/archives/distributions/2008-October/000276.html https://lists.freedesktop.org/archives/distributions/2008-Oc...
  - DanBC 8y ago
    Truecrypt may be secure, but linking to GRC is going to persuade me that it isn't.
    - barking 8y ago
      Who can you trust? I use trucrypt to encrypt my windows machine but I've been thinking about moving away from it because it seems to cause issues with some windows updates. So if not Truecrypt, what, bitlocker?
fjsousa 8y ago
I've been using spideroak and encryptr for a while and I'm assuming the data stored by them up until now is secure given that it was a zero knowledge service. Any opinions on this?
- ablation 8y ago
  Give that it looks like the canary just did its job, it would be prudent to assume SpiderOak is now compromised in some way. Therefore, it's probably safer to assume that all data stored on it up to this point is also somehow compromised too.
- throwaway9d0291 8y ago
  Unless you manually manage your keys, it's only zero knowledge if you never log into their website or use their Android app, either of which gets your key onto their servers.
- rocqua 8y ago
  That would depend on whether you trust that they are zero-knowledge. It is certainly possible to build a client that works like that, but their client wasn't open source, so there is no way to confirm this. However, if you trust them on the canary, why distrust them on the claim their service was zero-knowledge. It might make sense if they are 'amoral enough' to lie about being zero-knowledge, but 'moral enough' to admit to being served a warrant. I think space for that level of morality exists, but is small. The other issue would be if they weren't zero-knowledge through an unintended bug. I can't really give a definitive judgement.
onetimemanytime 8y ago
Any ideas on how many people in the company would know about it? If it's quite a few, one would take the chance on writing anon to a tech writer /activist. But that too is easier said than done...FBI would not be happy and they have a lot of cards in their hand.
sinstein 8y ago
Can someone explain what a Warrant Canary is and why it needs to be removed? From my understanding, a Warrant Canary is a provision to disclose subpoena(s) that a company is not allowed to disclose and now SpiderOak is shutting down that provision?
- wccrawford 8y ago
  Canaries were used in coal mines to detect deadly gas. If your canary dies, it means you might have a problem. A warrant canary dies when a warrant is served. If a company has a statement that says "We have not been served a warrant as of X date" and they update it monthly, then they suddenly stop updating it or remove that statement, the canary has died. They might have been served with a warrant. It's also possible that the canary died of natural causes, of course. It could be that a lawyer told them it was a bad idea, or maybe a shift in management removed it. But there's no way to know.
  - kilotaras 8y ago
    To expand on this. This is done as it is usually presumed the government can legally force your silence, but can't force you to say something (e.g we hadn't received secret warrant, last updated: Aug, 08)
    - cyphar 8y ago
      And to even further expand on it, the reason why they usually have a date is because it would be possible to argue that a company could be forced to keep an existing document on their website (since they aren't being forced to say something against their will, so much as being forced to not stop saying something they've already said). So the expiry is quite important in the function of a warrant canary. Although it should be noted that as far as I'm aware, warrant canaries haven't actually gone through the court system to determine if they are actually a legal way of circumventing gag orders. Not to mention that the legality of warrant canaries has mostly only been discussed by internet lawyers in relation to US laws -- in other jurisdictions they may not work at all (I've spoken to some Australian lawyers and they think that even the basis of the theoretical arguments don't apply in Australia). On the other hand, I don't know of any company that has actually used warrant canaries (and has "activated them" like Reddit did) which ended up being tried for violation of the NSL's gag order.
KenanSulayman 8y ago
Was it by mistake? The warrant canary is back: https://spideroak.com/canary https://spideroak.com/canary Edit: it seems they had removed it on purpose and added it back to elaborate on the decision and that it wasn't removed to signal something --- seemingly: "So after thinking about this ... we have decided to move away from ... canaries and instead publish a ... report located at ..."
- philipov 8y ago
  Doesn't matter. The moment the canary died, they became a compromised agent whose further statements are to be interpreted as being manipulated by secret court order. If your canary dies, you can buy a new one, but you still have deadly gas in your mine. You can't trust the words or actions of someone who just declared they have been compromised.
  - fauigerzigerk 8y ago
    >Doesn't matter. The moment the canary died, they became a compromised agent whose further statements are to be interpreted as being manipulated by secret court order. I don't think you can draw that conclusion. As I understand it, the NSL can only compell them to shut up about it, but it cannot compell them to dish out arbitrary lies and false justifications for taking the canary down.
    - philipov 8y ago
      We can and should draw that conclusion. Anything less compromises the canary system. I'm not going to bet my security on someone who frivolously shouts fire in a crowded theater, even if they later say they were only kidding.
      - fauigerzigerk 8y ago
        You can of course do whatever you want as a consequence of what they are saying or doing. What I'm saying is that it doesn't logically follow from the legal situation that their "further statements are to be interpreted as being manipulated by secret court order". The FBI cannot arbitrarily manipulate SpiderOak's further statements.
newscracker 8y ago
SpiderOak tweeted three days ago [1] that it's replacing the warrant canary with a transparency report that'd be updated every six months. This is what the tweet said/says: [1] "We just released our most recent transparency report, available at https://spideroak.com/transparency/ https://spideroak.com/transparency/ . This will replace our #warrantcanary. The final version of the canary is available at https://spideroak.com/canary https://spideroak.com/canary . The transparency report will be updated every six months." The transparency report, updated a few days ago this month, shows zeros for every kind of request, which means there haven't been any kind of court orders for information from February to August 2018. [2] Are there still reasons to be concerned? I don't understand how they can list NSLs in the transparency report, since those are the ones with the gag orders necessitating legally confounding workarounds like a warrant canary. [1]: https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936 [2]: https://spideroak.com/transparency/ https://spideroak.com/transparency/
- dannyw 8y ago
  Before you receive a NSL, you do not have any gag orders. It is the gag order that prevents publication; not the law. So you can legally say you’ve received no NSLs; until you get a NSL.
  - otp124 8y ago
    My understanding is they are served simultaneously, so you do not have that luxury.
    - eganist 8y ago
      If that were the case, the concept of a warrant canary would have died long ago in court. A gag order doesn't compel you to lie; it compels you not to talk about the topic in question. Removing a statement testifying to no NSL is in compliance with a gag order.
      - otp124 8y ago
Confiks 8y ago
I don't know anything about SpiderOak, except occasionally having browsed their front page, but they do seem to have some clue about security and secure software. If that is true, they must have known from the outset that once you decide to install a canary, you cannot discontinue it except to signal that it has died. That canary has now died. It did so along with a statement [1][2] that signing a canary every 6 months with an airgapped computer is too impractical, which isn't very plausible as this is a perfectly schedulable event which will take at most an hour for every person involved, twice a year. I suppose they sign their (APT, RPM) releases in the same way (please ask them; seems answerable). Additionally, they were three days late with their statement about moving away from the canary, which is otherwise irresponsibly late for an event that can completely erode trust in them as a security company. The irony is that their conclusion in [1] that the "canary’s effectiveness as a tool has been questioned, the usage of it at other companies is not consistent, and verifying it and keeping track of it is complicated for users" is spot on; the confusion that can be created about whether the canary is dead or merely deprecated, that after it has died once it cannot be reinstated, and that the only recourse for users is to move away from the service, makes it a pretty useless signal to act upon. [1] https://spideroak.com/articles/transparency-report/ https://spideroak.com/articles/transparency-report/ [2] https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936
- philipov 8y ago
  There is no confusion. There is a simple bargain with a canary: no matter what confusion is thrown up by bad actors, once it's activated, you assume the target is compromised. If they're not really compromised? You don't need to ask that; trust is based on evidence, not some abstract Truth. When the trigger activates, you deprecate trust. It's really that simple.
  - secfirstmd 8y ago
    I wonder why more organisations don't do a globally distributed Canary with people in differing jurisdictions signing it. Not that it is likely to reduce overall liability but surely if it has to signed by someone in US, Switzerland, Hong Kong, South Africa, Lebanon etc then its going to spread the single point of failure?
Vinnl 8y ago
Here's a question that crossed my mind: what if you ignore a gag order? You receive a secret court order to hand over data, and you tell them you're not giving it to them unless you're allowed to tell the world about it. Will they give you a fine? And what if you don't pay the fine? Will they arrest you? And if they do, how can they prevent people from finding out about it?
- rocqua 8y ago
  Given that national security letters originate from the patriot act, I presume the consequences are grave. Certainly, jail time seems probable. In general, if a court says do X, and you refuse, that is contempt of court. The court can then decide to fine you, and put you in jail until you are willing to comply. Given gag-orders, and waving the word 'national security'. I expect the court proceeding dealing with your arrest / punishment would be sealed. Heck, if certain things are marked as US government secrets and you publish them, that is treason which can be punished by death.
  - Vinnl 8y ago
    > I expect the court proceeding dealing with your arrest / punishment would be sealed. Sure, but at a certain point, surely they will have to come and pick you up? What if there are journalists present who ask that you are being put away for? "We can't tell" surely isn't an answer they won't accept? That's eerily close to arbitrary detention.
- e12e 8y ago
  https://en.m.wikipedia.org/wiki/Rendition_aircraft https://en.m.wikipedia.org/wiki/Rendition_aircraft
discordance 8y ago
Regardless of the stated reason for the canary to be removed, there is a responsibility in deploying a warrant canary that must be upheld. In this case, the canary is dead and the responsibility is now on users to judge what they should make of that. I, for one, would not use their service going forward.
- chmars 8y ago
  Isn't it anyway safe to assume that Internet providers worldwide have to give access to security services etc. (or are even happy to cooperate without any legal pressure)?
SeanMacConMara 8y ago
If your threat model includes any sovereign state's intelligence agency then a warrant canary is worse than useless. Given their other widely abused powers it is likely trivial to force a normal company to continue business as normal and make any statement. I submit that warrant canaries are at best legally and politically naive virtue signalling and at worst deliberate obfuscation of the actual threat model.
DyslexicAtheist 8y ago
don't be mad. This is exactly what a canary is for.
lwhalen 8y ago
also note earlier in their feed, a few hours before they announced the death of the canary, they had a 'full system outage due to a poorly communicated maintenance by their ISP'. To me, this screams "Narus box at our edge" or similar shady behavior.
Tharkun 8y ago
IIRC their yum repository is having some GPG signing issues as well. This isn't increasing my confidence.
BrandoElFollito 8y ago
Why do these companies not make use of international, cross border solutions? I am bound by the law of France but my associate in the US could not care less and vice versa. If we cross check, say, code daily and I see a discrepancy then I raise an alert on my .fr page, controlled by myself. He would not be involved.

235 points by dannyw 8y ago

I've had some mixed feelings about SpiderOak in the past, but at least they did this right. Props to them for making a canary and then following through on it.

Caipenghui 8y ago
v
maxerickson 8y ago
Or it doesn't mean anything. Who knows, that's the beauty of it.
- Cthulhu_ 8y ago
  Well no, it means that either they've been compromised and thus shouldn't be trusted anymore, or they forgot (?) to update their canary which means they shouldn't be trusted anymore. Don't "who knows?" on this subject, it makes you look like a government shill trying to lull privacy conscious people into indifference.
  - maxerickson 8y ago
    What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Unless you want to cite a bunch of jurisprudence that warrant canaries actually work, I'm gonna stick on "who knows", even though I'm not a government shill (I'm more "pragmatic about who really has the power in that particular relationship").
    - NullPrefix 8y ago
      >even though I'm not a government shill Let's just stick with "who knows" on that one too.
    - viraptor 8y ago
      > What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Then a nice solution would be to say "our lawyer explained to us that removing the canary for a reason is likely to be criminal, so we're letting you know we're going to remove it in 2 months to make you more sure we're not doing it in response to a current issue".
      - cyphar 8y ago
        And people would have precisely the same primary reaction (as they should) but then would also get angry at SpiderOak for "poisoning the well" with doubts about the legality of warrant canaries. To be clear, as far as I know there is no legal precedent that says warrant canaries are a legal way of subverting gag orders (then again, the fact there is no such legal case even though Reddit activated their warrant canary could point in the favour that the US government doesn't want to try their luck in court).
    - philipov 8y ago
      It doesn't matter what kind of excuses they give. Once a canary is dead, everyone should behave as if the target has been compromised. That is what the canary is for, and once you sign it, you can't just go back. If you don't continue updating a deadman's switch, it doesn't matter if you died or not: it activates.
    - rocqua 8y ago
      Technically, this is why the canary had an expiration. This means they did not need to remove the canary, just let it expire and refuse to publish a new canary.
  - brownbat 8y ago
    > makes you look like a government shill We're on a site where we strive to assume good faith, avoid name calling, reply to the argument not the person, take the strongest possible form of what someone is saying (iron man not straw man), etc. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- peterkelly 8y ago
  If it's gone, it means that have received a warrant. That's the whole point of the warrant canary.
- forkerenok 8y ago
  I think nobody really needs to know exactly what's happening to make the right decision. People that are serious about opsec/etc. will read this (fuzzy/distorted) signal and jump ship. They will not be dwelling on the nature of this signal.
  - maxerickson 8y ago
    I have a hard time believing that People that are serious about opsec/etc. even care about the warrant canary to begin with. People with real concerns aren't going to rely on an untested legal gizmo.
- Lazare 8y ago
  SpiderOak basically said "if we do this, you should stop using us" (well, if you care about warrant canaries). And then they did it. It doesn't mean that they received a warrant, but it does mean SpiderOak is telling you not to use them, and I think that when a service tell you that, for whatever reason, it means quite a lot. :) (Even if, as you suggest further down, they received legal advice that warrant canaries were a bad idea and they needed to take it down, the way they handled the entire process makes it clear that they aren't taking this seriously. Posting a warrant canary, updating it regularly, and then taking it down while not telling the real (legit) reason is reckless at best, and in my view is basically the worst way they could handle it.) Whatever a realistic estimation of SpiderOak's security was before this news, I think it has to be strictly lower now, right? (Mind you...on further reflection I'm not convinced the transparency report is any more - or less - meaningful than the canary. The theory behind both is that the government cannot compel false speech. If that's true, then both are equally protective; if it's false, both are equally pointless. SpiderOak did say "if we stop updating this stop using us", and then they stopped updating it, but...then they published a transparency report saying "0 NSLs". So...maybe they're just really awful at communication.)

Caipenghui 8y ago

jokoon 8y ago

If you look at the comment they debate that a candy can mean the service is not as secure as it was, like truecrypt did use its canary.

barking 8y ago
I think you're wrong about Truecrypt, it's still safe but just won't ever be updated. https://www.grc.com/misc/truecrypt/truecrypt.htm https://www.grc.com/misc/truecrypt/truecrypt.htm
- dogma1138 8y ago
  With the level of uncertainty and the suspicious circumstances behind the author you can’t really consider it’s safe to use considering the threat model.
- cyphar 8y ago
  I get their point, but just as it might be "foolish" to assume that software which was audited is no longer secure just because the developers have stopped working on it, it is also "foolish" to use cryptographic software that is not being worked on actively by experts. And since TrueCrypt is proprietary, people should not be using it anyway (not because you cannot read or modify the source code but because the license itself is "full of traps" according to the fedora-legal team[1])-- Linux's dm-crypt can decrypt TrueCrypt volumes (though it's read-only from memory) if you need legacy support. [1]: https://lists.freedesktop.org/archives/distributions/2008-October/000276.html https://lists.freedesktop.org/archives/distributions/2008-Oc...
- DanBC 8y ago
  Truecrypt may be secure, but linking to GRC is going to persuade me that it isn't.
  - barking 8y ago
    Who can you trust? I use trucrypt to encrypt my windows machine but I've been thinking about moving away from it because it seems to cause issues with some windows updates. So if not Truecrypt, what, bitlocker?

fjsousa 8y ago

I've been using spideroak and encryptr for a while and I'm assuming the data stored by them up until now is secure given that it was a zero knowledge service. Any opinions on this?

ablation 8y ago
Give that it looks like the canary just did its job, it would be prudent to assume SpiderOak is now compromised in some way. Therefore, it's probably safer to assume that all data stored on it up to this point is also somehow compromised too.
throwaway9d0291 8y ago
Unless you manually manage your keys, it's only zero knowledge if you never log into their website or use their Android app, either of which gets your key onto their servers.
rocqua 8y ago
That would depend on whether you trust that they are zero-knowledge. It is certainly possible to build a client that works like that, but their client wasn't open source, so there is no way to confirm this. However, if you trust them on the canary, why distrust them on the claim their service was zero-knowledge. It might make sense if they are 'amoral enough' to lie about being zero-knowledge, but 'moral enough' to admit to being served a warrant. I think space for that level of morality exists, but is small. The other issue would be if they weren't zero-knowledge through an unintended bug. I can't really give a definitive judgement.

onetimemanytime 8y ago

Any ideas on how many people in the company would know about it? If it's quite a few, one would take the chance on writing anon to a tech writer /activist. But that too is easier said than done...FBI would not be happy and they have a lot of cards in their hand.

sinstein 8y ago

Can someone explain what a Warrant Canary is and why it needs to be removed? From my understanding, a Warrant Canary is a provision to disclose subpoena(s) that a company is not allowed to disclose and now SpiderOak is shutting down that provision?

wccrawford 8y ago
Canaries were used in coal mines to detect deadly gas. If your canary dies, it means you might have a problem. A warrant canary dies when a warrant is served. If a company has a statement that says "We have not been served a warrant as of X date" and they update it monthly, then they suddenly stop updating it or remove that statement, the canary has died. They might have been served with a warrant. It's also possible that the canary died of natural causes, of course. It could be that a lawyer told them it was a bad idea, or maybe a shift in management removed it. But there's no way to know.
- kilotaras 8y ago
  To expand on this. This is done as it is usually presumed the government can legally force your silence, but can't force you to say something (e.g we hadn't received secret warrant, last updated: Aug, 08)
  - cyphar 8y ago
    And to even further expand on it, the reason why they usually have a date is because it would be possible to argue that a company could be forced to keep an existing document on their website (since they aren't being forced to say something against their will, so much as being forced to not stop saying something they've already said). So the expiry is quite important in the function of a warrant canary. Although it should be noted that as far as I'm aware, warrant canaries haven't actually gone through the court system to determine if they are actually a legal way of circumventing gag orders. Not to mention that the legality of warrant canaries has mostly only been discussed by internet lawyers in relation to US laws -- in other jurisdictions they may not work at all (I've spoken to some Australian lawyers and they think that even the basis of the theoretical arguments don't apply in Australia). On the other hand, I don't know of any company that has actually used warrant canaries (and has "activated them" like Reddit did) which ended up being tried for violation of the NSL's gag order.

KenanSulayman 8y ago

Was it by mistake? The warrant canary is back: https://spideroak.com/canary https://spideroak.com/canary Edit: it seems they had removed it on purpose and added it back to elaborate on the decision and that it wasn't removed to signal something --- seemingly: "So after thinking about this ... we have decided to move away from ... canaries and instead publish a ... report located at ..."

philipov 8y ago
Doesn't matter. The moment the canary died, they became a compromised agent whose further statements are to be interpreted as being manipulated by secret court order. If your canary dies, you can buy a new one, but you still have deadly gas in your mine. You can't trust the words or actions of someone who just declared they have been compromised.
- fauigerzigerk 8y ago
  >Doesn't matter. The moment the canary died, they became a compromised agent whose further statements are to be interpreted as being manipulated by secret court order. I don't think you can draw that conclusion. As I understand it, the NSL can only compell them to shut up about it, but it cannot compell them to dish out arbitrary lies and false justifications for taking the canary down.
  - philipov 8y ago
    We can and should draw that conclusion. Anything less compromises the canary system. I'm not going to bet my security on someone who frivolously shouts fire in a crowded theater, even if they later say they were only kidding.
    - fauigerzigerk 8y ago
      You can of course do whatever you want as a consequence of what they are saying or doing. What I'm saying is that it doesn't logically follow from the legal situation that their "further statements are to be interpreted as being manipulated by secret court order". The FBI cannot arbitrarily manipulate SpiderOak's further statements.

newscracker 8y ago

SpiderOak tweeted three days ago [1] that it's replacing the warrant canary with a transparency report that'd be updated every six months. This is what the tweet said/says: [1] "We just released our most recent transparency report, available at https://spideroak.com/transparency/ https://spideroak.com/transparency/ . This will replace our #warrantcanary. The final version of the canary is available at https://spideroak.com/canary https://spideroak.com/canary . The transparency report will be updated every six months." The transparency report, updated a few days ago this month, shows zeros for every kind of request, which means there haven't been any kind of court orders for information from February to August 2018. [2] Are there still reasons to be concerned? I don't understand how they can list NSLs in the transparency report, since those are the ones with the gag orders necessitating legally confounding workarounds like a warrant canary. [1]: https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936 [2]: https://spideroak.com/transparency/ https://spideroak.com/transparency/

dannyw 8y ago
Before you receive a NSL, you do not have any gag orders. It is the gag order that prevents publication; not the law. So you can legally say you’ve received no NSLs; until you get a NSL.
- otp124 8y ago
  My understanding is they are served simultaneously, so you do not have that luxury.
  - eganist 8y ago
    If that were the case, the concept of a warrant canary would have died long ago in court. A gag order doesn't compel you to lie; it compels you not to talk about the topic in question. Removing a statement testifying to no NSL is in compliance with a gag order.
    - otp124 8y ago

Confiks 8y ago

I don't know anything about SpiderOak, except occasionally having browsed their front page, but they do seem to have some clue about security and secure software. If that is true, they must have known from the outset that once you decide to install a canary, you cannot discontinue it except to signal that it has died. That canary has now died. It did so along with a statement [1][2] that signing a canary every 6 months with an airgapped computer is too impractical, which isn't very plausible as this is a perfectly schedulable event which will take at most an hour for every person involved, twice a year. I suppose they sign their (APT, RPM) releases in the same way (please ask them; seems answerable). Additionally, they were three days late with their statement about moving away from the canary, which is otherwise irresponsibly late for an event that can completely erode trust in them as a security company. The irony is that their conclusion in [1] that the "canary’s effectiveness as a tool has been questioned, the usage of it at other companies is not consistent, and verifying it and keeping track of it is complicated for users" is spot on; the confusion that can be created about whether the canary is dead or merely deprecated, that after it has died once it cannot be reinstated, and that the only recourse for users is to move away from the service, makes it a pretty useless signal to act upon. [1] https://spideroak.com/articles/transparency-report/ https://spideroak.com/articles/transparency-report/ [2] https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936

philipov 8y ago
There is no confusion. There is a simple bargain with a canary: no matter what confusion is thrown up by bad actors, once it's activated, you assume the target is compromised. If they're not really compromised? You don't need to ask that; trust is based on evidence, not some abstract Truth. When the trigger activates, you deprecate trust. It's really that simple.
- secfirstmd 8y ago
  I wonder why more organisations don't do a globally distributed Canary with people in differing jurisdictions signing it. Not that it is likely to reduce overall liability but surely if it has to signed by someone in US, Switzerland, Hong Kong, South Africa, Lebanon etc then its going to spread the single point of failure?

Vinnl 8y ago

Here's a question that crossed my mind: what if you ignore a gag order? You receive a secret court order to hand over data, and you tell them you're not giving it to them unless you're allowed to tell the world about it. Will they give you a fine? And what if you don't pay the fine? Will they arrest you? And if they do, how can they prevent people from finding out about it?

rocqua 8y ago
Given that national security letters originate from the patriot act, I presume the consequences are grave. Certainly, jail time seems probable. In general, if a court says do X, and you refuse, that is contempt of court. The court can then decide to fine you, and put you in jail until you are willing to comply. Given gag-orders, and waving the word 'national security'. I expect the court proceeding dealing with your arrest / punishment would be sealed. Heck, if certain things are marked as US government secrets and you publish them, that is treason which can be punished by death.
- Vinnl 8y ago
  > I expect the court proceeding dealing with your arrest / punishment would be sealed. Sure, but at a certain point, surely they will have to come and pick you up? What if there are journalists present who ask that you are being put away for? "We can't tell" surely isn't an answer they won't accept? That's eerily close to arbitrary detention.
e12e 8y ago
https://en.m.wikipedia.org/wiki/Rendition_aircraft https://en.m.wikipedia.org/wiki/Rendition_aircraft

discordance 8y ago

Regardless of the stated reason for the canary to be removed, there is a responsibility in deploying a warrant canary that must be upheld. In this case, the canary is dead and the responsibility is now on users to judge what they should make of that. I, for one, would not use their service going forward.

chmars 8y ago
Isn't it anyway safe to assume that Internet providers worldwide have to give access to security services etc. (or are even happy to cooperate without any legal pressure)?

SeanMacConMara 8y ago

If your threat model includes any sovereign state's intelligence agency then a warrant canary is worse than useless. Given their other widely abused powers it is likely trivial to force a normal company to continue business as normal and make any statement. I submit that warrant canaries are at best legally and politically naive virtue signalling and at worst deliberate obfuscation of the actual threat model.

DyslexicAtheist 8y ago

don't be mad. This is exactly what a canary is for.

lwhalen 8y ago

also note earlier in their feed, a few hours before they announced the death of the canary, they had a 'full system outage due to a poorly communicated maintenance by their ISP'. To me, this screams "Narus box at our edge" or similar shady behavior.

Tharkun 8y ago

IIRC their yum repository is having some GPG signing issues as well. This isn't increasing my confidence.

BrandoElFollito 8y ago

Why do these companies not make use of international, cross border solutions? I am bound by the law of France but my associate in the US could not care less and vice versa. If we cross check, say, code daily and I see a discrepancy then I raise an alert on my .fr page, controlled by myself. He would not be involved.