4 ms·

Can someone who has an accurate source post when Wikileaks cryptographic canary expired? I'm unable to find a source and it's important to know they shouldn't b

Can someone who has an accurate source post when Wikileaks cryptographic canary expired? I'm unable to find a source and it's important to know they shouldn't be trusted. Here's when their key expired in 2007: https://wikileaks.org/wiki/WikiLeaks_talk:PGP_Keys https://wikileaks.org/wiki/WikiLeaks_talk:PGP_Keys From another below: vikingerik A canary goes something like "This website has not received or acted on any government orders to disclose or modify or remove material." When they ever do, then they remove that notice. The government enforcement usually includes a gag order prohibiting the target from saying that they're under orders, so the intent is that you can infer government gag pressure by the canary having been removed. Wikileaks used to have such a notice and no longer does, so we assume government enforcement is why.

Sephr 2y ago
I remember at the time that it expired, all of the moderators on their official subreddit also got replaced. The insurance file also got changed out at some point as the hash changed.
- vintermann 2y ago
  The wikileaks subreddit was never official, and it was a train wreck. Two very dodgy Trump supporters "volunteered to help with the increased traffic" around the time of the Podesta releases and basically took over.
  - random6754478 2y ago
    Didn’t those Podesta leaks turn out to be legitimate?
    - vintermann 2y ago
      Absolutely, but that doesn't mean the "volunteering" moderators weren't super-sleazy.
deleted 2y ago
[deleted]
benreesman 2y ago
I remember when canaries were useful as a deterrent: even with an apathetic public on balance the tech community was pretty vigilant. These days Snowden is screaming into the void even as concerns HN readers, never mind that he was completely right at great personal cost the first time. I still trust Moxie, and Carmack/Palmer/etc. seem to be taking a stand, there are others, but it’s getting thin.
- themoonisachees 2y ago
  The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one. The users could then decide to jump ship but realistically they won't.
  - Mayzie 2y ago
    > The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one. Why can't social media platforms implement warrant canaries per user profile?
  - benreesman 2y ago
    I don’t disagree, but I’ll observe that governments used to be much less friendly with tech incumbents, at least in public. Ten years ago it was a scandal that big tech interacted with the surveillance state at all: Zuckerberg drove an initiative around cross-DC encryption at ruinous expense because of the mere accusation that the NSA might have a tap. Today they’re giving us the finger with NSA board members. It’s flagrant, arrogant, and anti-hacker anything: you will do nothing, because you can do nothing.
    - supriyo-biswas 2y ago
      Politicians have been largely able to convince that it's tech that it's evil, with their actions always being colored through a political lens, whether it's "helping pedophiles" or "spreading misinformation" or what have you. The vassalization of these companies was imminent, and now, it is complete.
alkonaut 2y ago
> This website has not received or acted on any government orders to disclose or modify or remove material. Never understood why gag orders don't just say "You can't say you received this order. Oh and by the way if we find you removed a canary, we'll just write that up as you having said you received this order". Because the point of a canary is for it to be known beforehand. So the government surely knows about any canary too. There must be some backwards definition of "speech" here which doesn't include all conveying of information (such as by removing previously published information), which makes it work, at least in the US (?)
- pcl 2y ago
  The typical canary contains a signed timestamp. Generally, the US does differentiate between forbidding an action (“do not remove your canary”) and compelling an action (“update your canary with a new timestamp” or “disclose the pass phrase for the signing key”). I’m no expert, and I’m sure there are nuances, but the broad strokes behind the design of these canaries are that it’s harder for the government to compel an action than to forbid one.
- adammarples 2y ago
  The whole point of a canary is that it's passive, and for exactly that reason. All you do is stop updating the date.

Sephr 2y ago

I remember at the time that it expired, all of the moderators on their official subreddit also got replaced. The insurance file also got changed out at some point as the hash changed.

vintermann 2y ago
The wikileaks subreddit was never official, and it was a train wreck. Two very dodgy Trump supporters "volunteered to help with the increased traffic" around the time of the Podesta releases and basically took over.
- random6754478 2y ago
  Didn’t those Podesta leaks turn out to be legitimate?
  - vintermann 2y ago
    Absolutely, but that doesn't mean the "volunteering" moderators weren't super-sleazy.

deleted 2y ago

[deleted]

benreesman 2y ago

I remember when canaries were useful as a deterrent: even with an apathetic public on balance the tech community was pretty vigilant. These days Snowden is screaming into the void even as concerns HN readers, never mind that he was completely right at great personal cost the first time. I still trust Moxie, and Carmack/Palmer/etc. seem to be taking a stand, there are others, but it’s getting thin.

themoonisachees 2y ago
The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one. The users could then decide to jump ship but realistically they won't.
- Mayzie 2y ago
  > The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one. Why can't social media platforms implement warrant canaries per user profile?
- benreesman 2y ago
  I don’t disagree, but I’ll observe that governments used to be much less friendly with tech incumbents, at least in public. Ten years ago it was a scandal that big tech interacted with the surveillance state at all: Zuckerberg drove an initiative around cross-DC encryption at ruinous expense because of the mere accusation that the NSA might have a tap. Today they’re giving us the finger with NSA board members. It’s flagrant, arrogant, and anti-hacker anything: you will do nothing, because you can do nothing.
  - supriyo-biswas 2y ago
    Politicians have been largely able to convince that it's tech that it's evil, with their actions always being colored through a political lens, whether it's "helping pedophiles" or "spreading misinformation" or what have you. The vassalization of these companies was imminent, and now, it is complete.

alkonaut 2y ago

> This website has not received or acted on any government orders to disclose or modify or remove material. Never understood why gag orders don't just say "You can't say you received this order. Oh and by the way if we find you removed a canary, we'll just write that up as you having said you received this order". Because the point of a canary is for it to be known beforehand. So the government surely knows about any canary too. There must be some backwards definition of "speech" here which doesn't include all conveying of information (such as by removing previously published information), which makes it work, at least in the US (?)

pcl 2y ago
The typical canary contains a signed timestamp. Generally, the US does differentiate between forbidding an action (“do not remove your canary”) and compelling an action (“update your canary with a new timestamp” or “disclose the pass phrase for the signing key”). I’m no expert, and I’m sure there are nuances, but the broad strokes behind the design of these canaries are that it’s harder for the government to compel an action than to forbid one.
adammarples 2y ago
The whole point of a canary is that it's passive, and for exactly that reason. All you do is stop updating the date.