10 ms·
Rsync.net Warrant Canary (2006)
- kefs 13y agoMore info: https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary
- ripperdoc 13y agoInstead of the somewhat fuzzy method of dating via news, couldn't they combine this approach with that recommended by Errata Security to use bitcoin as a public ledger? http://erratasec.blogspot.com/2013/05/bitcoin-is-public-ledger.html http://erratasec.blogspot.com/2013/05/bitcoin-is-public-ledg...
- interestinecom 13y agoNot everyone loves or wants any involvement with bitcoin
- jlgaddis 13y agoThe same could be said for PGP/GPG but that doesn't mean it couldn't be made useful for purposes like this.
- interestinecom 13y agoThere are many thins that could be useful as a way of proving date or making a mark on a public ledger. Shall we list all of them? You used bitcoin as an example because of your fanboyism. In no way is it obvious to use a currency or it's surrounding infrastructure for this (non intended) purpose.
- jlgaddis 13y ago> You used bitcoin as an example because of your fanboyism. Actually, I didn't. Next time you attack someone, make sure it's the right person. Dick.
- rsync 13y agoDating with news can be somewhat fuzzy, which is why we always take our news from the financial press, and attempt to datestamp with "material" information ... that is to say, news with a very high monetary value that the market is racing to receive. You could (conceivably) make up plausible future stories, but not things like quarterly results, lawsuit outcomes, etc.
- jewel 13y agoAnother good source of fixed-in-the-past yet unpredictable data is the closing price of a collection of stocks from the previous day. This would make verification easier to automate.
- pchander 13y agoEasy to automate might not be the best goal for a system like this :)
- billpg 13y agoI can't remember which show, but I remember watching a TV mystery with a picture of someone reading a newspaper as proof of someone being present on a certain day. Trouble was, the editor of the paper was in on the scam and ensured the headline would appear that day.
- recursive 13y agoIt seems easier to verify news than a bitcoin transaction. I'd have no idea how to go about doing that.
- xradionut 13y agoI don't see the usefulness. You can sign a lie cryptographically just as well as a fact.
- Flenser 13y agoThe government isn't allowed to force you to lie; they can force you to be silent. By updating this regularly it then becomes apparent when you have been forced into silence.
- dllthomas 13y ago"The government isn't allowed to force you to lie" Is that actually the case?
- xradionut 13y agoThere are variety of careers and situations where falsehoods are encouraged and necessary.
- dllthomas 13y agoFor sure. But there's (potentially) a difference between being employed by the government in a role that requires lying and being forced as an ordinary citizen to lie. That said, I don't actually know about anything that prevents the latter.
- danielweber 13y agoIf I set up a contract with you saying that I will not submit to any government subpoenas, and then the government subpoenas me, can I refuse, because "the government cannot force you to break contracts?" (The answer is No.) If you want to practice civil disobedience, do it, and be straightforward about it. If Rsync.net were really to try to exercise this silly clause, it would be a giant distraction from what I presume is their actual complaint.
- 13y ago
- pchander 13y agoWhy is there a 2006 date in the title?
- mperham 13y agoFeds: "Continue to update the canary or you disclosed the secret warrant and we throw you in prison."
- rsync 13y agoYes, but note that this is updated not just on our website, but on the storage arrays themselves - some of which are in Zurich and Hong Kong. So the above scenario is a possibility, but then imagine the followup: Feds to Zurich Canton: Tell swiss national X to update the warrant canary or ... We have it spread out geographically for a reason.
- takluyver 13y agoIf one government were to come knocking, could they order you to lie to other arms of your own business, so that they continue to update the canary because they don't know that a warrant was served? Perhaps that's impractical, but I'm thinking about what would be needed to 'beat' the warrant canary system.
- koenigdavidmj 13y agoThe storage arrays' access could be limited such that administrative accounts can only be used locally at a datacenter. Then, acting on the warrant would require telling an employee in Zurich to conduct any necessary action.
- AnIrishDuck 13y agoYou'll be forced to tell your overseas colleagues that you have received no such warrants, and they should update the canary to reflect that. Unless your architecture is set up so they would somehow immediately become aware of these warrants, there's no way they're even going to know they exist. Legal "hacks" like this rarely work.
- dpcx 13y agoDo you have any examples of them not working?
- wojt_eu 13y ago"Attention! Today we have received no secret warrants cough cough wink wink"
- footoverhand 13y agoIt's a neat idea, but you'd still need to trust rsync.net. If you start with the assumption that you cannot ever trust them, then you can use them(if needed) as a 3rd party storage site for encrypted files.
- zachrose 13y agoAs discussed in a previous HN thread, the courts might still see this as a notice that a warrant has been served, despite it being "said through not saying." Has rsync.net had the opportunity to see these arguments play out?
- AnIrishDuck 13y agoI really doubt this would play out well in court. As said before, judges take a dim view of legal "tricks" like this. They won't be sympathetic to you putting yourself in a quandary where you're essentially requiring yourself to issue false statements. The order they issue will force you to update the canary, as refusing to would disclose the existence of the warrant.
- rsync 13y agoYes, but at the very least it elevates the process out of a simple rubber stamp court order. One way or another, we'd get our "day in court", even if you never hear about it, and that's worth something. We are more optimistic about how such things would play out, but even in that worst case scenario, there's some value in slowing things down and forcing that review.
- AnIrishDuck 13y agoI don't think we know enough about how the FISC works to jump to that conclusion. I'd say let us know how it works out, but...
- edwintorok 13y agoCould you revoke the public key used to sign these messages (i.e. publish revocation cert to keyservers) when you get a warrant served? That way they won't be able to force you to sign anything with that key anymore, all you can do is create a new key, but the timestamp on that key will make it obvious that something happened on that day.
- dllthomas 13y ago
- ndytjvb 13y agoYou could become a lifelogger and have a realtime webcam that shows you reading incoming mail.