3 ms·

Ack! My other half is responsible for the warrant canary. He keeps forgetting it. We may as well not even have it. It doesn't mean much without a signature, but

Ack! My other half is responsible for the warrant canary. He keeps forgetting it. We may as well not even have it. It doesn't mean much without a signature, but I assure you that we have never been served a warrant.

laureny 13y ago
Nice try, NSA.
- Sir_Cmpwn 13y ago
  Well, even if we had been served a warrant, I dunno what we'd give them. We don't store anything about our users. https://blog.mediacru.sh/2013/07/19/MediaCrush-for-nerds.html https://blog.mediacru.sh/2013/07/19/MediaCrush-for-nerds.htm...
  - deleted 13y ago
    [deleted]
    - Sir_Cmpwn 13y ago
      How do I word it? As of November 11th, 2013, neither MediaCrush nor its admins have ever received any sort of warrant, or any other kind of notice or request, from the government of any country. Additionally, we do not store anything about a user who visits our site. Here's an example from the HTTP log: [21/Nov/2013:06:59:36 +0000] "GET /static/favicon.ico HTTP/1.1" 200 16958 "-" 0.000 When you upload a file, your IP address is run though bcrypt (12 rounds) and saved with the file information in redis. Reversing bcrypt is infeasible with modern technology (and probably for many years to come). We store nothing else about you.
      - gunn 13y ago
        Is there a reason a complete IP address rainbow-table wouldn't defeat this?
        Sir_Cmpwn 13y ago
        bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt
        birken 13y ago
        I don't know exactly what situation you are trying to avoid, but with the standard bcrypt, if somebody has the IP hash and a candidate's specific IP, they can positively match the two (something you specifically mention on your privacy page). One possible tweak is to continue using bcrypt and a salt, but instead shorten the hash output to something like 24 bits. This way it still cannot be so easily reversed or rainbow-tabled, and collisions still shouldn't be an active problem. However, it wont be possible to positively match a given IP to a hash, since multiple IPs will likely hash to a given output. Granted, if you have a candidate IP and it matches the output hash, there is a very high probability that it was the source IP, but it wouldn't be 100%.
        gunn 13y ago
        Good answer... It looks like it would take on the order of 7 CPU years to create a table of every used address, much less time to target an area or individual. I don't think this is an issue at all though, I was just curious.
        Sir_Cmpwn 13y ago
        Actually, the salting is an important detail. Those 7 CPU years would only create a table for one hash. That's how long it takes to brute force a single hash, not the entire space.
        wgd 13y ago
        At 1/3 of a second to compute a single hash, brute forcing the entire space of possible addresses takes around 45 CPU-years. But computing the hash of every single IP address is ridiculously parallel, so it's trivial to spin up 2k machines on EC2 and brute force the entire thing in a week. Total cost, somewhere under $8k if you don't want to bother owning real machines, less for any organization that happens to need to do similar things on a regular or semi-regular basis. It's not a trivial investment since that effort only gets you a single IP address, but it's easily within the reach of a vast number of organizations if they have real motivation (read: not a fishing expedition) to reverse it.
  - vinceguidry 13y ago
    I'm pretty sure he was joking.
duiker101 13y ago
can't you make it automatic, taking the news with rss and stop it if you get a warrant?
- Sir_Cmpwn 13y ago
  Nope. If an adversary seizes our servers, we couldn't stop it from falsely reporting that all is well.
  - duiker101 13y ago
    If an adversary seizes your servers wouldn't you have bigger worries like getting them back or complaying with the warrant?
  - atlbeer 13y ago
    If you sign the request w/ a key that isn't present on your servers than it should be impossible for that to occur. Unless they seize the computer with the key as well
- Wilya 13y ago
  That defeats the purpose. I think the whole point of a warrant canary is that you have to do something, every week/month, to confirm that you never had to obey a warrant. And (presumably, I don't think it has been tried in courts yet) a gag order can prevent you to speak about a warrant, but it can't force you to do anything, including actively saying that you didn't receive anything. If it's automated.. the gag order prevents you to stop it, so it might as well not be there.

laureny 13y ago

Nice try, NSA.

Sir_Cmpwn 13y ago
Well, even if we had been served a warrant, I dunno what we'd give them. We don't store anything about our users. https://blog.mediacru.sh/2013/07/19/MediaCrush-for-nerds.html https://blog.mediacru.sh/2013/07/19/MediaCrush-for-nerds.htm...
- deleted 13y ago
  [deleted]
  - Sir_Cmpwn 13y ago
    How do I word it? As of November 11th, 2013, neither MediaCrush nor its admins have ever received any sort of warrant, or any other kind of notice or request, from the government of any country. Additionally, we do not store anything about a user who visits our site. Here's an example from the HTTP log: [21/Nov/2013:06:59:36 +0000] "GET /static/favicon.ico HTTP/1.1" 200 16958 "-" 0.000 When you upload a file, your IP address is run though bcrypt (12 rounds) and saved with the file information in redis. Reversing bcrypt is infeasible with modern technology (and probably for many years to come). We store nothing else about you.
    - gunn 13y ago
      Is there a reason a complete IP address rainbow-table wouldn't defeat this?
      - Sir_Cmpwn 13y ago
        bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt
        birken 13y ago
        I don't know exactly what situation you are trying to avoid, but with the standard bcrypt, if somebody has the IP hash and a candidate's specific IP, they can positively match the two (something you specifically mention on your privacy page). One possible tweak is to continue using bcrypt and a salt, but instead shorten the hash output to something like 24 bits. This way it still cannot be so easily reversed or rainbow-tabled, and collisions still shouldn't be an active problem. However, it wont be possible to positively match a given IP to a hash, since multiple IPs will likely hash to a given output. Granted, if you have a candidate IP and it matches the output hash, there is a very high probability that it was the source IP, but it wouldn't be 100%.
        gunn 13y ago
        Good answer... It looks like it would take on the order of 7 CPU years to create a table of every used address, much less time to target an area or individual. I don't think this is an issue at all though, I was just curious.
        Sir_Cmpwn 13y ago
        Actually, the salting is an important detail. Those 7 CPU years would only create a table for one hash. That's how long it takes to brute force a single hash, not the entire space.
        wgd 13y ago
        At 1/3 of a second to compute a single hash, brute forcing the entire space of possible addresses takes around 45 CPU-years. But computing the hash of every single IP address is ridiculously parallel, so it's trivial to spin up 2k machines on EC2 and brute force the entire thing in a week. Total cost, somewhere under $8k if you don't want to bother owning real machines, less for any organization that happens to need to do similar things on a regular or semi-regular basis. It's not a trivial investment since that effort only gets you a single IP address, but it's easily within the reach of a vast number of organizations if they have real motivation (read: not a fishing expedition) to reverse it.
- vinceguidry 13y ago
  I'm pretty sure he was joking.

duiker101 13y ago

can't you make it automatic, taking the news with rss and stop it if you get a warrant?

Sir_Cmpwn 13y ago
Nope. If an adversary seizes our servers, we couldn't stop it from falsely reporting that all is well.
- duiker101 13y ago
  If an adversary seizes your servers wouldn't you have bigger worries like getting them back or complaying with the warrant?
- atlbeer 13y ago
  If you sign the request w/ a key that isn't present on your servers than it should be impossible for that to occur. Unless they seize the computer with the key as well
Wilya 13y ago
That defeats the purpose. I think the whole point of a warrant canary is that you have to do something, every week/month, to confirm that you never had to obey a warrant. And (presumably, I don't think it has been tried in courts yet) a gag order can prevent you to speak about a warrant, but it can't force you to do anything, including actively saying that you didn't receive anything. If it's automated.. the gag order prevents you to stop it, so it might as well not be there.