3 ms·
I don't know anything about SpiderOak, except occasionally having browsed their front page, but they do seem to have some clue about security and secure softwar
by Confiks 8y ago
I don't know anything about SpiderOak, except occasionally having browsed their front page, but they do seem to have some clue about security and secure software. If that is true, they must have known from the outset that once you decide to install a canary, you cannot discontinue it except to signal that it has died.
That canary has now died. It did so along with a statement [1][2] that signing a canary every 6 months with an airgapped computer is too impractical, which isn't very plausible as this is a perfectly schedulable event which will take at most an hour for every person involved, twice a year. I suppose they sign their (APT, RPM) releases in the same way (please ask them; seems answerable). Additionally, they were three days late with their statement about moving away from the canary, which is otherwise irresponsibly late for an event that can completely erode trust in them as a security company.
The irony is that their conclusion in [1] that the "canary’s effectiveness as a tool has been questioned, the usage of it at other companies is not consistent, and verifying it and keeping track of it is complicated for users" is spot on; the confusion that can be created about whether the canary is dead or merely deprecated, that after it has died once it cannot be reinstated, and that the only recourse for users is to move away from the service, makes it a pretty useless signal to act upon.
[1] https://spideroak.com/articles/transparency-report/ https://spideroak.com/articles/transparency-report/
[2] https://twitter.com/SpiderOak/status/1025488889564327936 https://twitter.com/SpiderOak/status/1025488889564327936
- philipov 8y agoThere is no confusion. There is a simple bargain with a canary: no matter what confusion is thrown up by bad actors, once it's activated, you assume the target is compromised. If they're not really compromised? You don't need to ask that; trust is based on evidence, not some abstract Truth. When the trigger activates, you deprecate trust. It's really that simple.
- secfirstmd 8y agoI wonder why more organisations don't do a globally distributed Canary with people in differing jurisdictions signing it. Not that it is likely to reduce overall liability but surely if it has to signed by someone in US, Switzerland, Hong Kong, South Africa, Lebanon etc then its going to spread the single point of failure?
- howard941 8y agoWould global distribution of signed canaries be a decent use case for a blockchain sort of technology?
- JumpCrisscross 8y ago> Would global distribution of signed canaries be a decent use case for a blockchain sort of technology? No. There is no need to add an economic element. You could post a bunch of PGP-signed messages, but even that’s excessive.
- JumpCrisscross 8y ago> once it's activated, you assume the target is compromised I don’t think it’s helpful to think in such absolutist terms. Coal mine canaries died of natural causes. A canary is meant to prompt investigation (and heightened vigilence), not conclude it.
- dnbgfher 8y agoI'm not sure the comparison to the actual canary in a coal mine is particularly relevant here. Clearly that inspired the name, but beyond that... Assuming it is a good comparison - if you are the one in the coal mine and the carnary keels over, are you going to start trying to figure out the exact cause of death or just hurry up and get the hell out of the mine?
- secfirstmd 8y agoHmmm the language used to justify dropping the Canary sounds very similar to other services which ditched it in the past. Cant remember exactly but IIRC Reddit and Riseup said something like this.
- ricardobeat 8y agoCoincidentally, the signing key for their RPM has been changed a few days ago and they recommend you reinstall from a direct download instead. https://support.spideroak.com/hc/en-us/articles/360009029531-RPM-Signing-Key-version-7-2-0 https://support.spideroak.com/hc/en-us/articles/360009029531...