Someone please correct me if I am wrong, but I was under the impression that warrent canaries were a broken concept. Anyone with the power to submit a warrant to a company also has the ability to prevent the company from triggering their canary.
The idea is that there is no such action as “triggering the canary” that the government can stop them from taking. Instead they refrain from updating it, thus alerting people that something has occurred. However, since the point of a canary is that not updating it raises concerns, I’m not sure how this service makes any sense (alerts on new canaries?).
The idea is that there is a big difference between the government saying “don’t tell anyone about this” and saying “you must make a false statement (the canary) every X amount of time indefinitely.” In the past courts in the US have taken a fairly dim view of the government trying to compel speech. There are some example cases at en.m.wikipedia.org/wiki/Compelled_speech#United_S….
That actually could be useful, by having a completely external company send a notification without action by the company receiving the warrant, it may be possible to circumvent the prohibition on alerting users.
None of those compelled speech examples include national security though, which has its own level of rules and courts. (I am not American or a lawyer, so i may be wrong).
And if a company can be compelled to hand over customer data, why wouldnt they be hand over access to the systems that update the canaries?
The other issue is thar once a canary is triggered, it cant be reset, which means that XXX agency can trigger the canary with something meaningless, and then its forever untrustworthy.
You may well be correct, and they are sufficient, but i am not convinced that canaries work, especially against the higher level adversaries.
Yes, most of those points are the concerns with warrant canaries. So far as we know the concept is totally untested in court so it’s hard to say what the result would be until it happens.
Updating the canary should require a human input (like a password to unlock the GPG key), which is not sometime the government would generally get access to (they make a request for data about XYZ user, and the company turns it over; they wouldn’t get actual access to the production system). The government could seek a ruling to force the company to update the canary, but as such a thing hasn’t been granted before (at least as far as we know), it’s not a guarantee. So, there is a chance that the warrant canary will serve to alert users to something happening, which is better than nothing. But because of its untested nature, it might be broken by a court.
I’m not sure I understand your point about “once it’s triggered it can’t be reset.” If a company fails to update their canary on schedule it means something happened that they can’t disclose. Once they are released from the NDA they can release a new canary explaining what happened.
Wikipedia does claim that patriot act subpeonas can penalise any disclosure of the subpeona. But i am not a lawyer, and afaik this is untested (or at least undisclosed :/ )
In September 2014, U.S. security researcher Moxie Marlinspike wrote that “every lawyer I’ve spoken to has indicated that having a ‘canary’ you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you’ve received something.”
I think my point is that a gag order with a long time out essentially kills the canary, even if it doesnt affect the vast majority of the services users.
Thanks for your response though, I appreciate the additional information.
I wonder where mandated sonograms and abortions are bad disclaimers to patients seeking abortions falls.
That speecch is mandated, yet SCOTUS barred California from mandating crisis pregancy centers reporting to patients you cannot get an abortion here but instead call these numbers to schedule one
Lots of controversies outside the topic of the thread, but certainly examples of mandated speech and rulings to prevent mandated speech.
I think that’s the purpose of the “next update” part. As long as the ability to refresh that timestamp is gated behind a passphrase (for 5A protection) then it functions as a deadman switch for the canary.
Passphrases only work in locales with 5a or similar protection, and either have to be managed by a single person or have the potential to be leaked.
Great for small businesses, but unworkable at the enterprise level.
But having a canary mechanism for smaller businesses is crucial, because they can’t afford to put a wall of lawyers between them and potential government overreach.
The canary is triggered through inaction, not action. The government would have to compel the target of the subpoena to keep updating the canary on schedule.
DNS-based blocking more complete for your whole network, independent of the device settings for tech-avers users/kids. DNS-based blocking is less flexible for all users in the network - especially when you need to make exceptions for certain sites. They are also limited to your home network, unless you have a VPN server. Therefore, for mobile devices app-based blocking is the main way to go. Consequently, both make sense and your use case is relevant.
Read the article! The change isn’t live yet…and you can likely disable it once it drops.
“While an exact date is still unknown,” Bard says, “all signs point towards Bard’s arrival in Google Messages sometime in 2024. It could be a matter of weeks or months, but it’s definitely coming.” Meanwhile, what we’ve seen thus far remains buried deep inside a beta release and subject to change before release.
As a mobile app developer I promise that you want to have push notifications that are capable of doing meaningful work on your phone. Apps are often entirely dead but a push notification from a central server will still get you X/Y/Z functionality.
Companies abuse this to then track you, and harvest endless amounts of information but the alternative is your phone no longer notified you of anything and the majority of background functionality for your apps dies entirely.
What I wish would happen is that mobile OSes have another set of location/network permissions for push notifications.
Regulation “may” fail to keep up with the technology?
lol regulation is always done after the fact—if it all. In the EU, yeah, there’s a chance it gets done eventually. The US lol. Regulation is about 44 years behind.
I don’t think that this catches on. However, the second this is included with lenses that act as transparent screens for AR stuff, it’ll be flying off the shelves. No, not the very first model, not the second probably, but the one made by a large corporation that actually does it well.
Though tbh just the lenses / screens would do it, camera is just extra. So I actually think first they will get the lenses done and camera stuff ia added later when the rest is already commonly used.
How are you supposed to do AR without the camera? The computer has to know the environment it is supposed to augment. Even though if you mean recording doesn’t have to be part of the camera I would agree.
I have the GL.inet Beryl router, absolutely the best addition to my travel tech. I’ve considered upgrading to a newer model for faster vpn for torrents, but this can still easily run off a 2.4v usb battery pack and handles everything reasonably.
Two things holding me back is my worry about some banking and payment apps not working and Google Maps because I’m a hypocrite and the timeline feature of Google Maps has helped me many times in the past.
That’s it. Google Maps with good precise location is the thing I most miss from my Pixel. But that’s a trade-offs… if you want to get the best GPS, you need to give some data back. I don’t like that… but well I miss it.
I don’t know how much content there is to share, so you might be overflowing with things to talk about every week. But I fear that doing so much effort weekly could be unsustainable. I would suggest, or hope you consider, a less freqent blog/podcast, like every other week. I think this would be more modest, and easier to maintain. You wouldn’t need to change to title of the blog, either.
Anyway, this is an exciting project and I’m thankful for your work.
privacyguides
Top
This magazine is from a federated server and may be incomplete. Browse more on the original instance.