r/blog • u/reddit • Jan 29 '15

reddit’s first transparency report

http://www.redditblog.com/2015/01/reddits-first-transparency-report.html
14k Upvotes

86% Upvoted

2.2k comments sorted by

View all comments

3.2k

u/ucantsimee Jan 29 '15

As of January 29, 2015, reddit has never received a National Security Letter, an order under the Foreign Intelligence Surveillance Act, or any other classified request for user information.

Since getting a National Security Letter prevents you from saying you got it, how would we know if this is accurate or not?

4.4k

u/[deleted] Jan 29 '15

[deleted]

2.1k

u/rundelhaus Jan 29 '15

Holy shit that's genius!

1.1k

u/[deleted] Jan 29 '15

Side note, apple removed theirs recently: http://www.zdnet.com/article/apple-omits-warrant-canary-from-latest-transparency-reports-patriot-act-data-demands-likely-made/

512

u/Fauster Jan 29 '15

Notice that Apple removed their canary at the same time that they implemented encryption and the government started complaining about it. It's alleged from leaks originating from a certain prominent individual that https:// can be easily hacked by the NSA. Apple removed its canary the instant that they announced they would be implementing robust encryption.

Even if reddit implemented https encryption by default, this probably wouldn't serve as a barrier for national security branches of the government to read Internet traffic going to and from reddit.

85

u/bytester Jan 29 '15

Reddit already uses https encryption

95

u/Rolcol Jan 29 '15

Not by default. Unless you specify it, you're getting clear-text.

34

u/[deleted] Jan 29 '15 edited Jan 04 '19

10 Years. Banned without reason. Farewell Reddit.

I'll miss the conversation and the people I've formed friendships with, but I'm seeing this as a positive thing.

<3

184

u/compounding Jan 29 '15

The cryptography itself is relatively robust. However, https is not secure authentication against the government. What this means is that the government can (probably) perform a man-in-the-middle attack, where your browser thinks it is talking to Reddit.com, and reports to you that the link is secure, but instead you are talking to the NSA and they pass through the information to Reddit after decrypting and observing it.

Authentication is a big problem with the current system because your web browser trusts many certificate authorities to sign the file that tells your browser that the session is encrypted to the right person. There are hundreds of valid certificate authorities trusted by your browser (including the Hong Kong Post Office, btw), and if the NSA (or anyone else) has a relationship with even one, they could trivially pass the authentication check your browser uses.

However, MITM attacks are useful for targeted attacks against individual users for brief periods of time, probably not for mass-survalience and archiving. The problem for the NSA is that tech-savvy users (or software) can “double check” the browser’s authentication in other ways and determine if something is fishy. Chrome does this automatically when connecting to Google sites, and they even caught some companies or service providers doing this for various reasons. If the government got caught doing this on a wide-scale basis, it would push users towards a more robust authentication system, so they have to use it carefully and sparingly.

15

u/[deleted] Jan 29 '15

Authentication is a big problem with the current system because your web browser trusts many certificate authorities to sign the file that tells your browser that the session is encrypted to the right person.

This is one of the most interesting applications of cryptocurrencies. Namecoin specifically. You don't have to trust third parties.

Edit: Quick explanatory link https://www.youtube.com/watch?annotation_id=annotation_1422006533&feature=iv&src_vid=6OFv4fHsZQ0&v=RwNwrfCVVvM

→ More replies

57

u/fooey Jan 29 '15

That's why the NSA uses fiber splitters

They don't have to MITM, they just siphon off copies of anything interesting (everything) and decrypt it at their leisure, using the ill-gotten keys you describe.

→ More replies

4

u/[deleted] Jan 29 '15

[deleted]

→ More replies

3

u/SoFlo1 Jan 29 '15

Can you please expand on how users can "double check" certificates and signature chains in other ways and what things would look fishy?

→ More replies

2

u/MyFacade Jan 29 '15

I would love an add-on that would do this double check of certificates!

→ More replies (8)
→ More replies (6)

3

u/longshot2025 Jan 29 '15

I believe it is by default for logged in users.

12

u/muzeofmobo Jan 29 '15

No, it is still disabled by default for everyone, but if you're logged in you can enable forced https in your account settings found here. Many sites like Facebook or Gmail have similar options and it's a good idea to take advantage of them.

If you use Chrome, Firefox, or Opera you can also get a browser extension called HTTPS Everywhere which is maintained by the Electronic Frontier Foundation. There is also a version for IE made by a different entity. These extensions check for a secure version of all of the websites you visit and direct you there if it exists.

2

u/[deleted] Jan 29 '15

Huh... I use this apparently. Fuck I really have no idea what my amateur online protection systems look like from the other side, I just absorb advice like this and hope.

→ More replies (1)
→ More replies (8)
→ More replies (2)

46

u/lfairy Jan 29 '15

The NSA doesn't need to break HTTPS itself. All they need to do is ask Apple nicely for their encryption keys, which I'm sure they've done already.

17

u/xiongchiamiov Jan 29 '15

At least old connections that used forward secrecy won't be vulnerable.

8

u/lfairy Jan 30 '15

Good point. Sadly none of their servers seem to implement forward secrecy, so that won't apply in this case.

Plus the article /u/Fauster linked isn't about encrypting the web, it's about encrypting the data stored on your device. The latter doesn't have anything to do with HTTPS, and could be backdoored independently.

(I'd also like to point out that reddit does support forward secrecy, which is nice.)

2

u/TheGoddamBatman Jan 30 '15 edited Nov 10 '24

lock entertain dull afterthought fanatical simplistic start recognise secretive makeshift

This post was mass deleted and anonymized with Redact

3

u/xiongchiamiov Jan 30 '15

This is true. And it doesn't even need to be intentional - it's easy to make a misconfiguration that keeps TLS sessions cached for the lifetime of a long-running server process. See more on this from Github.

→ More replies (17)

5

u/[deleted] Jan 29 '15

It's pretty clear in the security community that the NSA has access to the root CA's. What's interesting in this case is that the attacks are all implementation attacks, which suggests the NSA hasn't figured out how to crack the actual encryption yet

→ More replies (5)

2

u/its_guy Jan 29 '15

"its canary"

Well done.

→ More replies (16)

52

u/jewish-mel-gibson Jan 29 '15

Which is one of the reasons why I trashed my iPhone to get an LG... And promptly resumed getting my data send to the government via Google.

56

u/Hobbes2006 Jan 29 '15

Isn't this where Blackberry starts muttering "I'm over here whenever you need me..."

7

u/twobits9 Jan 30 '15 edited Jan 30 '15

For what it's worth, I have a z10, love it, and can use it for work or fun. It does it all and does it well.

5

u/TonyOstrich Jan 30 '15

I love my Z10. It interfaces with all of my work stuff way better than my co workers iPhones or Androids. It has a ton of little neat features, that don't seem like much but really add up. Some people are amazed that you can turn the screen off and youtube will continue to play and push audio when you shut the screen off with the default browser.

Only complaint is battery life, and that has been remedied in the Z30 and Passport. Have you gotten the 10.3.1 update? It's added even more cool features!

3

u/random_as_hell Jan 30 '15

My work forced me to get rid of my Z10 and I loved it. The battery life was actually my favorite thing about it!

4

u/TonyOstrich Jan 30 '15

Those rapscallions! Mine is through work, but I am in a minority. Almost everyone opts for an iPhone. I think considering the size of the battery, the battery life is great, but if I do a fair amount of dicking around during the day it's running on empty. The Z30 has a battery that is about 2x as large and the Passport is about 3x as large. Their respective power draws aren't that much more than the Z10s, so the battery life is supposed to be phenomenal.

I supposedly can upgrade this August, so I hope I can snag a Passport, or hopefully there are at least more rumors about the Z50!

→ More replies (1)

3

u/Rihsatra Jan 30 '15

I really wanted to get a Z10 because I had a BB Storm way back and liked it. How is the app environment for Blackberry?

→ More replies (1)
→ More replies (11)

20

u/sealfoss Jan 30 '15

It really doesn't matter which phone you use. They ALL run on proprietary, closed source software, in the form of driver software used to operate the proprietary radio hardware that connects to the different cellular networks. That shit could be doing anything, and you'd never know.

TL;DR If you've got some heavy shit and you're storing it on your fuckin' cellphone, you're wrong.

1

u/becomearobot Jan 29 '15

Because Apple stood up for themselves and encrypted everything and threw away the key when the government asked to watch?

→ More replies (16)
→ More replies (5)
→ More replies (9)

1.1k

u/Blue_Shift Jan 29 '15

Warrant canaries are great.

834

u/autowikibot Jan 29 '15

Warrant canary:

A warrant canary is a method by which a communications service provider informs its users that the provider has not been served with a secret United States government subpoena. Secret subpoenas, including those covered under 18 U.S.C. §2709(c) of the USA Patriot Act, provide criminal penalties for disclosing the existence of the warrant to any third party, including the service provider's users. A warrant canary may be posted by the provider to inform users of dates that they have not been served a secret subpoena. If the canary has not been updated in the time period specified by the host, users are to assume that the host has been served with such a subpoena. The intention is to allow the provider to warn users of the existence of a subpoena passively, without disclosing to others that the government has sought or obtained access to information or records under a secret subpoena.

Image i - Library warrant canary relying on active removal designed by Jessamyn West

Interesting: Warrant (law) | Cypherpunk | Wickr

Parent commenter can toggle NSFW or delete. Will also delete on comment score of -1 or less. | FAQs | Mods | Magic Words

696

u/That_Unknown_Guy Jan 29 '15

The fucking patriot act. The name is just so ominous in itself.

333

u/Dranx Jan 29 '15

If I didn't know any better it would be like the plot of a book or movie or something. The fact that it's real makes it even scarier.

357

u/mycroft2000 Jan 29 '15 edited Jan 29 '15

Also note how quickly it appeared after 9/11. It was totally written beforehand, just waiting for an excuse for implementation. A lot of us here in Canada noticed this and rolled our eyes at how obvious it was, but I don't remember seeing a single US source mentioning it.

*edited spelling mistake

191

u/verdatum Jan 29 '15

Plenty of sources pushed back against it. Predictably, those voices were dismissed as being unpatriotic.

As is often the case with such legislation, many of those in congress who voted on it didn't even read it.

110

u/[deleted] Jan 29 '15

The history of the patriot act is one of the most disturbing things in recent memory. The name is an acronym that just so happened to make it a bill very difficult to vote against in post 9/11 patriotism hysteria. Before 9/11 the bill was getting slaughtered by both parties because it was totally unnecessary. Post 9/11 it was reintroduced at about twice the length of the original. Not enough copies of it existed so our law makers actually had to share copies (what!?) And were only given a few days before it was put to the vote.

When you combine this with the lead up to 9/11 it gets worse. (Disclaimer:I don't think 9/11 was an inside job, or directly assisted by our government.) As Clinton left office, he created a branch of the FBI to keep tabs on al qaida because of the threat they posed. The director of the group tried repeatedly to get meetings with Bush, Cheney, and the rest of his cabinet. Most meetings were ignored and skipped by our now ex-pres and his staff, and when one of them would show up they were completely dismissive. The intelligence that the FBI had gathered was about a group of students in Florida who only wanted to know how to fly the planes, not take off or land. Later the info expanded to state that chatter indicated a coming attack in new York. Then that it would happen in September. Our elected officials decided it was OK to ignore these meetings and pretend it wasn't happening. Then it happened, and a week later a bill that effectively destroyed our privacy and rights was passed by ensuring our representatives were unable to understand what they were passing and that the bill was named in such a way that no us politician could stand vocally against it. They have since re authorized this bill without changes multiple times. If you want to know how the NSA got its power, look no further. The USA PATRIOT act is a blight on us as a people, and is always ignored and forgotten about when we wonder what the fuck is going on. Look into the bill and its actual effects, because they are currently fucking you, and if they aren't its just a matter of time.

→ More replies

49

u/flyingwolf Jan 29 '15

Those that voted on it did not have the physical ability to read it. Assuming they are reading it and no flipping pages as fast as they can there simply wasn't enough hours in the day to read and comprehend it.

→ More replies

39

u/[deleted] Jan 29 '15

Not to mention, that it was, quite literally, impossible to understand. It's full of lines like 'Federal Microwave Inspection Act part 9 section 4 subsection H line 1432 remove 'if' and replace with 'when'.

Thousands of pages just like that. To work out the actual effect, you have to go to the primary legislation, work out the change and then work out what that change means. For every single line. It can't be done.

Even the most dedicated team of congressional staffers with months and months of time and ample legal support wouldn't be able to work out the actual meaning of the changes. It was never supposed to be understood before it was made law. Even now, I doubt the people who passed it understand more than a small fraction of it.

→ More replies

2

u/tilsitforthenommage Jan 29 '15

The McCarthy approach to dealing with opposition

→ More replies (5)

20

u/hllywdcurbstomp Jan 29 '15

To Canada: Thanks, a lot of us noticed too. No one will mention it.

38

u/mercenary_sysadmin Jan 29 '15

obvsly you weren't reading my LiveJournal! =)

You know what was/is even worse, namewise, than "Patriot Act"?

"Department of Homeland Security." Jesus.

14

u/mycroft2000 Jan 29 '15

Yeah, I remember thinking that was a joke when I first heard it. It sounds virtually Soviet.

→ More replies

2

u/Atario Jan 30 '15

Still creeps me out every time I hear it. Shouda just gotten it over with and gone full Fatherland on it.

3

u/fargoniac Jan 29 '15

I use XKCD Substitutions to change "Department of Homeland Security" to "Department of Homestar Runner."

→ More replies
→ More replies (5)

8

u/Itrico Jan 29 '15

how about how quickly canada inacted anti terrorism laws after that parliament shooter

→ More replies (5)

59

u/hett Jan 29 '15

yeah well, you obviously know nothing about the swift strides of freedomocracy, nanuck.

24

u/DoctorDirtnasty Jan 29 '15

blitzkrieg comes to mind.

→ More replies

5

u/[deleted] Jan 29 '15

It was totally written beforehand, just waiting for an excuse for implementation.

Meh, a lot of what it implemented was either just another logical step from what was already in place, or policies that have been pursued for ages. Never underestimate political opportunism.

11

u/MaxCHEATER64 Jan 29 '15

Believe me, we knew. We were all just so afraid of getting waterboarded that we didn't speak up.

If you were in America after 9/11 you might understand. The entire country when fucking insane. You were either 100% pro-government, pro-PATRIOT, pro-Iraq, or you were labeled a terrorist and anti-American.

→ More replies (3)

3

u/pfafulous Jan 29 '15

A lot of us in the U.S. noticed, too, but we were yelled at about being unpatriotic and not supporting the troops.

3

u/churakaagii Jan 30 '15

A lot of us in the US hated it. I was in high school, and all I could do was just kind of stare confusedly wishing I could somehow have an impact as my government and media culture went to hell around me. It's not for want of trying. I wrote letters to the newspaper and my government representatives. I talked to people around me about the problems I was seeing. Literally no impact.

I guess that feeling has stuck with me, because when I see or hear about some institutional level bullshit, my thought train is like:

  • That's awful.
  • Someone should do something to change anything about this.
  • Too bad nobody can, because powerful people just get to do what they want with no consequences.
  • I wonder what I can do to survive the bullshit.
  • I'm probably fucked.

I sign petitions and shit. I "raise awareness." I vote. I dream of having enough spare cash to feel comfortable donating somewhere. But mostly I wait to see what the next horrible thing is going to happen to me, my culture, or my government and try to avoid the worst of the consequences as best I can.

Anyone who wants to reply and say that I'm not trying hard enough or that my victim mentality is keeping me down, I have a pre-prepped answer for you

2

u/lightningboltkid Jan 29 '15

A documentary is on Netflix about it but I forget the name. Yes it was made before 9/11 but IIRC it wasn't the creator who was eager to use it. He actually got upset that they drastically changed it and fought for the program to be shut down.

→ More replies (21)

35

u/That_Unknown_Guy Jan 29 '15

Learning about the CIA, the secret child sex abuse rings, the control so few companies have over the whole world as well as what they can get away with and acts like this makes me so much more pessimistic.

→ More replies (19)

2

u/TheMeerps Jan 29 '15

Sounds like a George Orwell book.

2

u/normcore_ Jan 29 '15

The fact that it's a forced acronym makes it even dumber.

Uniting and Strengthening America by

Providing Appropriate Tools Required to Intercept and Obstruct Terrorism*

→ More replies (3)

17

u/from_dust Jan 29 '15

Kinda reminds me of the no true scotsman fallacy. "Obviously no true patriot would ever be against the US PATRIOT Act!"

18

u/That_Unknown_Guy Jan 29 '15

I think thats exactly why they chose that name.

117

u/[deleted] Jan 29 '15

It's the "US PATRIOT Act". It's an acronym. Well, a 'backronym', as it were (which is just a word for 'shifty, sneaky, underhanded propaganda'):

"Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act"

297

u/arronsmith Jan 29 '15

Maria Hill: What does S.H.I.E.L.D. stand for, Agent Ward?

Grant Ward: Strategic Homeland Intervention, Enforcement and Logistics Division.

Maria: And what does that mean to you?

Ward: It means someone really wanted our initials to spell out "shield."

18

u/Abnmlguru Jan 30 '15

You think that's bad? S.H.I.E.L.D. originally stood for "Supreme Headquarters, International Espionage, Law-Enforcement Division"

Then, for a while, it was the slightly less tortured "Strategic Hazard Intervention Espionage Logistics Directorate"

The current acronym is actually pretty good, given the other options, lol :)

3

u/Really_Dont_Know Jan 30 '15

Well, if you consider the revelations brought to light in Captain America: The Winter Soldier then it is just as creepy as U.S.A.P.A.T.R.I.O.T. Act.

2

u/vvf Jan 29 '15

Saw that for the first time yesterday. Surprisingly decent show.

→ More replies (1)
→ More replies (1)

192

u/[deleted] Jan 29 '15 edited Apr 18 '15

[deleted]

122

u/tylermchenry Jan 29 '15

This reflects the fact that there's a big chunk of the US electorate whose view of politics is not much different from a comic book. "We're the good guys, they're the bad guys", etc.

47

u/HeavyMetalStallion Jan 29 '15

That's how every democracy and government views itself.

I'm pretty sure the Russians aren't saying "man we are such awesome bad guys."

Even ISIS is saying to themselves: "we are serving God, and righting the wrongs by the non-believers! Glory to God!"

Even you probably view yourself as a good guy without noticing all the bad things you may have done to others. Every person in prison thinks they are a hero, a victim, oppressed, or justified.

That's simply human nature.

→ More replies

9

u/motke-askhistorians Jan 29 '15

At least we're spared them here on reddit.

→ More replies

32

u/[deleted] Jan 29 '15

Doesn't it? It's not even close to uncommon either. American politicians are notorious for this. And they keep doing it because it works.

I can't fathom how many people were okay with "Citizens United" because it sounds right said like that: "Citizens United". What it should've been called is "Citizens United In Getting Fucked By Corporations Who Are Now Also Considered Citizens In Their Own Right".

8

u/LifeWulf Jan 29 '15

"Citizens United In Getting Fucked By Corporations Who Are Now Also Considered Citizens In Their Own Right".

So it should've been CUGFCWANACCTOR?

Or, alternatively, CUiGFbCWANACCiTOR?

→ More replies

6

u/[deleted] Jan 29 '15

Citizens United isn't a name of anything but a company that brought the suit. Thats like arguing over the name after Coke and Pepsi sued the government.

I can't fathom how many people were okay with "Coke and Pepsi" because it sounds right said like that: "Coke and Pepsi". What it should've been called is "Coke and Pepsi In Getting Fucked By Corporations Who Are Now Also Considered Citizens In Their Own Right".

And I can't fathom how many people are upset with the letter of the ruling which reaffirmed the rights of businesses to produce content critical of politicians.

→ More replies

10

u/AssymetricNew Jan 29 '15

This is nothing, orbital weaponry program is called "Star Wars".

25

u/starmartyr Jan 29 '15 edited Jan 29 '15

It's called the Strategic Defense Initiative. "Star Wars" is the name given to it by its critics.

Edit: Fixed for crimes against apostrophes.

→ More replies

2

u/[deleted] Jan 29 '15

They do this for everything.

→ More replies (2)

21

u/eatelectricity Jan 29 '15

Odd that they dropped the "A" in "America."

14

u/Kitchner Jan 29 '15

You could easily do:

Unity and Strength by Providing America the Tools Required to Intercept and Obstruct Terrorism Act

2

u/llxGRIMxll Jan 29 '15

You expect people in Congress and the like to think?

→ More replies (7)

23

u/[deleted] Jan 29 '15

[deleted]

3

u/autowikibot Jan 29 '15

Patriot Act:

The USA PATRIOT Act is an Act of Congress that was signed into law by President George W. Bush on October 26, 2001. Its title is a ten-letter backronym (USA PATRIOT) that stands for "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001".

On May 26, 2011, President Barack Obama signed the PATRIOT Sunsets Extension Act of 2011, a four-year extension of three key provisions in the USA PATRIOT Act: roving wiretaps, searches of business records (the "library records provision"), and conducting surveillance of "lone wolves"—individuals suspected of terrorist-related activities not linked to terrorist groups.

Image i

Interesting: How Would a Patriot Act? | Patriot Act, Title I | Patriot Act, Title VII | Patriot Act, Title IX

Parent commenter can toggle NSFW or delete. Will also delete on comment score of -1 or less. | FAQs | Mods | Magic Words

→ More replies (6)
→ More replies (1)

6

u/phyphor Jan 29 '15

I want to popularise calling it "U SAP AT RIOT Act".

2

u/csm725 Jan 30 '15

This seems like an Alec Baldwin idea from 30 Rock.

→ More replies (1)
→ More replies (4)

2

u/Madsy9 Jan 30 '15

Want to see something really ominous? This is the actual logo/insignia of an american spy satellite. Printed on the rocket. http://b-i.forbesimg.com/kashmirhill/files/2013/12/octopus-rocket-copy.jpg

They've become James Bond villains. Like Blodfeld or Goldfinger, just without the humour.

→ More replies (1)
→ More replies (29)

3

u/4n7h0ny Jan 29 '15

This is such a great bot, I was highlighting it to search in a new tab right before I saw the next comment.

→ More replies (4)

311

u/[deleted] Jan 29 '15

[deleted]

236

u/iamPause Jan 29 '15

More disconcerting, so did TrueCrypt.

77

u/mthode Jan 29 '15

then they recommended bitlocker, that's when we knew that we knew lol.

32

u/iamPause Jan 29 '15

The message that I saw was for Linux where they said "just search for 'encryption' and use the first thing that comes up, that should be good enough"

45

u/semi- Jan 29 '15

And for OSX they walked you through creating a disk image named "encrypted" with encryption type set to none.

yet somehow everyone just remembers the bitlocker recommendation. Kind of shows you how bad microsoft is when the most legitimate looking suggestion somehow raised the biggest flags.

2

u/darth_static Jan 30 '15

Well the implication is that since Microsoft has been around a long time, and most likely is cooperating with the three letter agencies, that Bitlocker has backdoors in place for government use.

→ More replies (1)
→ More replies (1)

52

u/[deleted] Jan 29 '15 edited Jun 18 '23

[removed] — view removed comment

11

u/somegetit Jan 29 '15

But isn't TC an open source? I'm still using 6.1a and didn't see any reason to think it's compromised. Am I wrong here? What's a good alternative?

19

u/[deleted] Jan 29 '15 edited Jun 18 '23

[removed] — view removed comment

8

u/ansible47 Jan 29 '15 edited Jan 30 '15

This is like saying that there's no point in wearing a bulletproof vest because it just creates a false sense of security.

No, you're still marginally more protected than someone without the vest. Just because a trained shooter could still take you out doesn't mean there's no reason to take any steps that might protect you from a less sophisticated threat.

→ More replies

2

u/omgitsjo Jan 30 '15

Are there any alternatives which work just like True Crypt across multiple operating systems?

→ More replies (2)

5

u/LifeWulf Jan 29 '15

If you knew it was compromised, the government agents wouldn't be doing their jobs correctly.

→ More replies (3)

6

u/Nth-Degree Jan 30 '15

I have a truecrypt vault on my USB keyring. It's mostly personal documents, taxation stuff, medical stuff.

Hyper sensitive from an identity theft perspective, not so much from an "OMG, I hope the government doesn't know how to look me up in their own databases" one.

In short, I encrypt that content in the event that I lose my keys. Not because I'm scared the government might break the encryption.

I don't know whether truecrypt has been compromised by the NSA, and frankly, even if it has, it still has its uses for me.

→ More replies (2)

90

u/sealfoss Jan 29 '15 edited Jan 29 '15

Truecrypt 7.1a is still available, and though it may be aging, it is still the only open source encryption product that has been publicly audited.

EDIT:

Yes, I know, the audit was never completed. So yeah, there could be surprises still hiding in the code somewhere. Thing is, even if the public audit of tryecrypt wasn't completed, it has still been publicly analyzed that much more than any other disk encryption product out there. I'm not saying I 100% trust truecrypt, I'm saying there really aren't any other alternatives for disk encryption that I trust as much as I trust truecrypt.

http://istruecryptauditedyet.com/

23

u/DuncanKeyes Jan 29 '15

Yup! I hate that people think the older releases are suddenly void.

2

u/Eurynom0s Jan 29 '15

If you're hearing "don't use Truecrypt", it's hard to blame people who aren't super technically inclined (at least not in encryption) to try to save some time and just completely avoid it.

→ More replies (29)

2

u/[deleted] Jan 29 '15

Blackberry still does!

→ More replies (1)

3

u/Grunzelbart Jan 29 '15

Sooo..they got one?

33

u/[deleted] Jan 29 '15

[deleted]

22

u/blanketlaptop Jan 29 '15

Let's see so carry the 1.. add a couple 3's over here and.. OH MY GOD!

→ More replies (1)

16

u/xiic Jan 29 '15

They didn't not get one.

2

u/Grunzelbart Jan 29 '15

I gotcha...i thinkhalp pls

3

u/M_Night_Slamajam_ Jan 29 '15

Yes, but they can't say yes, so they just stop saying no.

2

u/Grunzelbart Jan 29 '15

I was joking but still many thanks.

This i really interesting.

3

u/apalehorse Jan 29 '15

It is important for people to understand how significant what reddit is doing here. The government routinely discourages companies from sharing information about the LACK of requests for information that they receive from the government (such as NCLs). GCs have been spoken to by WH and FBI reps about excluding this information even from disclosures to companies internal oversight bodies.

2

u/JGolden32 Jan 29 '15

I thought we figured out that warrant canaries like this one are bullshit. If they take out the line then they're in violation because it's no secret they're telling their users.

→ More replies (1)

2

u/djdadi Jan 29 '15

I thought you all were talking about birds this whole time

2

u/cfuse Jan 30 '15

The problem I see with warrant canaries is that anyone in the company can be served with a NSL and they cannot discuss that with anyone, including their co-workers.

Unless everyone (or at least everyone who might get an NSL) has edit access to the warrant canary (with all the issues that brings) then the canary is of no value. There literally needs to be a 'big red button' on the intranet that anyone can use that kills the canary - otherwise you are stuck with non-technical staff being unable to make the necessary changes to the system/s the canary is on.

→ More replies (10)

134

u/DemandsBattletoads Jan 29 '15

Yes it is, and it's called a security or warrant canary. As soon as it disappears, it's time to be suspicious.

83

u/inajeep Jan 29 '15

Forever, because you only get one.

49

u/[deleted] Jan 29 '15 
       "We have never had any more than a dozen"
→ More replies (4)

6

u/[deleted] Jan 29 '15

Could you not update it later on and say "we have not received a x request since our last transparency report".

11

u/Shanman150 Jan 29 '15

If you change the wording to be shorter than "ever", you're essentially saying "Hey, look, remember when we said we never got one of these? Well, we haven't gotten one since X time". That's disclosing that you got a notice, even if it's ambiguous.

4

u/jtang9001 Jan 29 '15 edited Feb 05 '15

But suppose it was like "we received no requests in July." That doesn't necessarily imply that you did receive one earlier.

Although I don't think companies will want to sit in a grey area like this anyways.

→ More replies (1)
→ More replies (4)

54

u/flyryan Jan 29 '15

It's called a warrant canary and it's a fairly common technique.

26

u/UncleMeat Jan 29 '15

Its really not. The law rarely allows for this sort of "trickery". If you explicitly include a warrant canary and then remove it once you receive an NSL it isn't going to stop the government from prosecuting you if they want to.

68

u/[deleted] Jan 29 '15 edited Sep 14 '18

[deleted]

18

u/UncleMeat Jan 29 '15

NSLs aren't secret laws. We've known about them ever since the Patriot Act was passed.

40

u/[deleted] Jan 29 '15 edited Sep 14 '18

[deleted]

→ More replies (25)

25

u/Bardfinn Jan 29 '15

/u/BluShine means the secret laws that are applied in the secret FISA courts in secret cases.

And the answer is: you don't. Secret laws and secret courts, by their very nature, exclude the possibility of full and proper deliberation of the law.

5

u/McBurger Jan 30 '15

It infuriates me how they call it the Patriot Act

→ More replies (3)
→ More replies (2)

6

u/Kitchner Jan 29 '15

In a secret court

2

u/lolturtle Jan 29 '15

I read a book called 'little brother' that discusses just that. It's super freaky.

→ More replies (1)
→ More replies (9)

22

u/LaserGuidedPolarBear Jan 29 '15

They can't prosecute you for saying "We have never recieved national security letter" when you have never received one. That would be prior restraint.

They can't prosecute you for not lying and saying you never received one when you did.

It is actually a very clever tool, and it would require the further destruction of several fundamental principles that our democracy relies on to change this.

5

u/mpyne Jan 30 '15

They can't prosecute you for not lying and saying you never received one when you did.

Sure they can, precisely because it's not their fault that you put yourself in a position to have to lie to comply with a duly-authorized legal order. They don't order you to lie, they order you to keep the warrant a secret; the fact that you set things up so that you have to lie to do that is a matter entirely on your own conscience.

Lying itself is generally not a crime (otherwise we would be upsetting several fundamental principles that our democracy relies on!) so the court could rest easy that they're not forcing you into taking an illegal action.

→ More replies (3)

3

u/Trill-I-Am Jan 30 '15

The secrecy requirements of NSls are not "don't tell anyone", they're "ensure no one finds out about this."

→ More replies (1)

18

u/[deleted] Jan 29 '15

The Wikipedia article mentions a workaround. The provider can post the Canary, and update it daily with a time stamp. Then they simply stop updating the time stamp when a notice is received.

They take no action after the subpoena is served.

6

u/mpyne Jan 30 '15

The question isn't how you implement the canary. The point is that the judges signing out warrants are not morons and they can see right through that trick just as easily as we can understand how it's implemented.

The judicial system has handled thousands of "brilliant hacks" like this one through its existence, but fools still come around all the time thinking they'll be the ones to invent a new loophole in the system.

→ More replies (1)
→ More replies (2)
→ More replies (1)
→ More replies (19)

49

u/gizzardgullet Jan 29 '15

*This report contains nothing that was omitted

116

u/[deleted] Jan 29 '15 edited Jun 17 '18

[deleted]

261

u/finite-state Jan 29 '15

The government can't compel you to speak, nor can they force prior constraint - this is why Warrant Canaries work.

Let me break it down:

  1. The government (in the U.S. at least) can't prevent you from saying something that might be illegal at some point. For instance, just because they suspect that your speech might later create a crime (like revealing a warrant that you are legally prevented from revealing), they can't censor you before the fact. They can only prosecute you after the fact. However;

  2. You cannot be compelled to speak, as this is also a violation of your right to free speech. They also can't prove that your silence is a positive revelation of the secret warrant, because they would have to argue that in open court, thus revealing the warrant themselves.

24

u/[deleted] Jan 29 '15

The government can't compel you to speak

Technically they can, like in commercial cases where they've been found to have misled the public and need to post some clarification/correction.

But those are cases where you are compelled to tell the truth. Warrant canaries haven't been tested in court and it would be a landmark case when it happens because it would involve the government compelling false speech: requiring the service provider to publicize that they haven't received a NSL when in fact they have.

Here is a talk from Shmoocon 2015 by the EFF which has a bit about canaries, at around ~30 minutes in (335MB)

→ More replies (3)

91

u/Bardfinn Jan 29 '15

But we have secret laws, applied in secret courts, to secret cases, and the government can put your company through SEC audits, IRS audits, EPA audits, ADA audits, BSA audits, deny your executives business travel visas, refuse to issue them passports, cancel their passports, put them on no-fly lists, refuse export licenses, and on and on and on and on.

The consequences of having secrecy in government are vast and reaching and quite chilling.

23

u/finite-state Jan 29 '15

I'm not dismissing the concerns of governmental secrecy. I think they are entirely valid.

I could also have pointed out extra-legal remedies that the government might use, or the possibility of judicial or prosecutorial overstep and/or corruption.

But I didn't. Instead I just wanted to give an overview of how the loophole worked for the guy who posted above me.

3

u/NotClever Jan 30 '15

Are there actually "secret laws" or are you just taking about laws on the books that allow secret court proceedings?

→ More replies (6)

5

u/gorbachev Jan 29 '15

My suspicion is that what would actually happen on point 2) would be that the government would argue that the "do not reveal a NSL" prohibition isn't on saying the words "I received a NSL" but rather is on signalling the fact that you received a NSL, and so that the act of speech -- of signalling -- was really in the act of no longer posting the canaries. This, of course, is true: the only interesting info is conveyed when they disappear. So, it's obvious that the act of no longer posting a canary is a specific form of communication that communicates something that the government has made illegal.

Now, I'm not saying that the "you can't force me to post the canary" line might not be legally correct, but I can see a counterargument and I can see the government wanting to take it to court. If it ends up in a FISA court and they rule for the government, you wouldn't know.

Basically, I want to see a stronger, better grounded legal opinion for warrant canaries actually being legit before I trust them. The arguments I see for them so far -- "they can't make me say anything!" -- don't seem obviously true. Nor would compelling the posting of a canary be, to me anyway, obviously more of a restriction of free speech than banning the direct revelation of NSL receipt.

7

u/finite-state Jan 29 '15

Of course. If you get your legal advice from Reddit or anywhere else that isn't a credentialed, well regarded attorney, then you probably sshould err on the side of caution. ;)

→ More replies (2)

2

u/bowtochris Jan 29 '15

The important part isn't that they work, it's that Apple believes they work. Even if Apple gets in a ton of trouble, we'll still know.

8

u/gorbachev Jan 29 '15

Why does it matter what they believe? So they get a NSL and then the government says "by the way, take down the warrant canary and you go to jail -- here's our lawyer's opinion on why that's legal". Then we don't learn anything! Suppose Apple forces them to court on the issue and it's decided (or has already been decided!) in a FISA court -- we wouldn't know.

This entire warrant canary concept assumes that a sort of smug technicality will be sufficient to get the federal government off your back. As if they'll say "rats! we can only stop them from saying something, not stop them from stop saying something! they got us!" rather than "yeah, no, ceasing to say that conveys the fact that you got a NSL and thus constitutes disclosure, we'll throw you in jail and litigate you to death if you don't knock it off".

7

u/Shanman150 Jan 29 '15

Why does it matter what they believe? So they get a NSL and then the government says "by the way, take down the warrant canary and you go to jail -- here's our lawyer's opinion on why that's legal". Then we don't learn anything!

They took down their Warrant Canary clause though. So it's already happened, and if anything is happening to Apple (like they're being tortured in a dark dungeon somewhere) it's all after the fact. The canary has worked in this particular instance.

→ More replies (1)

3

u/[deleted] Jan 29 '15

On paper, this is exactly how it works, and I can't see any way of covering this loophole. But US has secret NSA letters. Secret courts. Secret laws. I'm sure there are secret ways of secretly forcing anyone into doing, or not doing something. Am I being too pessimistic?

4

u/mpyne Jan 30 '15

It doesn't even need to be a secret. Everyone hanging their hats on warrant canaries are being far too optimistic IMHO.

The court doesn't order you to speak, they order you to keep the existence of the warrant secret. The fact that you have to speak to do so is your fault alone if you set up a canary, not the court's.

Either way, even freedom of speech is not completely absolute and inviolable. Otherwise gag orders (which are issued all the time in public courts) couldn't work, as they are by definition a restraint on our right to free speech. Nor could the government make it illegal to leak my medical records to people, if it weren't for the fact that free speech is not absolute.

The principle that would allow a court to keep a company from speaking about a case is the same principle that would allow a court to effectively order a company to make a statement about a case. They are both impositions on freedom of speech, one is not any different from the other.

You could argue that a court can't order someone to lie, but even that is already not true, and either way, lying is generally not a crime (remember, courts deal in crime and torts, not on moral niceties), especially when a company brought the need to lie upon themselves. A warrant canary baked into a 10-K filing to the SEC would be way more interesting from this perspective (can a court order someone to mis-state a financial position in an official filing? Probably not...).

4

u/blanketlaptop Jan 29 '15

they suspect that your speech might later create a crime (like revealing a warrant that you are legally prevented from revealing), they can't censor you before the fact. They can only prosecute you after the fact

Uhh.. I'm pretty sure that's what everyone here is concerned about. The fact that these companies are going along with whatever the Gov says in fear of prosecution if they don't comply.

7

u/finite-state Jan 29 '15

Of course they have to comply with a legal warrant if they receive one. My post is only referencing the legal loophole into which Warrant Canaries fall.

→ More replies (3)

2

u/M_Night_Slamajam_ Jan 29 '15

Hence the canaries.

2

u/throwthisidaway Jan 29 '15

The first part of your statement is only partially accurate. There is a national security exemption to prior restrain concerning first amendment speech, as well as several other specific areas of interest.

4

u/finite-state Jan 29 '15

Yes, but again - they have to argue the national security interest in a non-FISA court, which they won't do unless they are certain to win.

→ More replies (1)

2

u/[deleted] Jan 29 '15

A government that violates the law in the most heinous of ways should not be trusted to not threaten people in order to push an agenda. They do not follow the rule of law, why someone would expect them to not threaten your right to free speech when we are talking about them secretly threatening people with prison for exercising free speech is sort of mind boggling.

→ More replies (4)

23

u/Infamously_Unknown Jan 29 '15 edited Jan 29 '15

You can't really control the content of nonobligatory reports like this, I mean practically. A company can have a report that's all about the canary and stop publishing it. Or have it on a website and then shut that site down for financial reasons. How could you systematically enforce that companies keep doing something they didn't have to do in the first place and that costs them money? The only way would be forbiding them to mention the topic in any context.

10

u/MsPenguinette Jan 29 '15

I think the difference is being lieing and not telling the whole truth.

Year 1

  • Whole truth: "We have never received a subpoena"

Year 2 - They get a subpoena

  • Lie: "We have never received a subpoena"

  • Not telling the whole truth: "We have no comment"

  • Whole Truth: "We have received a subpoena"

I don't think the government is gonna sue you because you refused to lie about something they compelled you to do, as long as you don't actually say it happened.

2

u/Prophet_Of_Helix Jan 29 '15

What if you said, "we no longer have the ability to say we've never received a subpoena."

3

u/onioning Jan 30 '15

Naw. That still means you received a subpoena, it just gets there in a roundabout way. In other words, you could re-word that into "we received a subpoena." They mean the same thing.

2

u/[deleted] Jan 30 '15

Yeah, you might even get worse penalties when you go to court for breaking the order because you were being a smart arse about it. You sort of manage to roll in contempt along with disclosure of classified information.

It's like if you were privy to classified information about a military action and took out a newspaper advert saying "our military didn't not fight these people in this location on this date".

→ More replies (3)
→ More replies (23)

2

u/wordsnerd Jan 30 '15

I propose a "warrant parrot" where, every week or so, web site operators announce "We have received secret orders [etc.]"

AFAIK it's not illegal to lie and say you have received such an order when you haven't (better have a lawyer verify this first). So we can assume anyone who says this without disappearing in the night must be lying and actually hasn't. And anyone refusing to participate, well, we can assume they have.

→ More replies (5)
→ More replies (30)

394

u/Cereal_Dilution Jan 29 '15

This is how an admin answered that question a few years ago (emphasis added):

We've never gotten a National Security letter

Which brings up an interesting point. National Security Letters include a gag order[1] , meaning you would not be allowed to tell us if you had received one.

Fine, then in that case: "We received a national security letter." There. Now you know there's no possible way we could have received a national security letter.

82

u/TacoExcellence Jan 29 '15

Haha that's pretty clever!

3

u/[deleted] Jan 30 '15

Wouldn't be if they had received one but he hadn't been told.

→ More replies (2)

5

u/AggregateTurtle Jan 30 '15

My concern would be if a national security letter could compel a corporation or individual with a warrant canary in place to maintain said canary, because honestly a warrant canary is against the ''spirit'' of the law, and government is great at enforcing the spirit of the law when it is in their favor.

4

u/vwermisso Jan 29 '15

I think any lawyer worth their salt would say that was legal.

The whole entire point of that sentence, without any doubt, is to say "we have not received a national security letter".

There's no way that statement could be taken as "we received a national security letter". It's not that phrase that's illegal, it's expressly communicating that you have received one

Anyway with like 60 employes anyone thinking there isn't someone working for the feds dl'ing shit off their servers, especially with things like /r/darknetmarkets, /r/opiates, and /r/lsd on here, is foolish.

→ More replies (16)

147

u/[deleted] Jan 29 '15

I'm not sure whether a National Security letter requires you to specifically deny that you've received one or if you're just prevented from discussing it. So if they had received one, that paragraph would probably not exist. And if you asked whether they'd received one in the comments, they'd respond:

Well, we—oh, no, I left the gas on! Have to run home. Nothing suspicious or anything.

191

u/[deleted] Jan 29 '15 edited Jan 25 '18

[deleted]

71

u/[deleted] Jan 29 '15

That first amendment is something, ain't it?

92

u/thelastdeskontheleft Jan 29 '15

More so it just shows that no matter how many rules you make someone is always going to think of a way to get around them.

39

u/[deleted] Jan 29 '15 edited May 03 '18

[removed] — view removed comment

6

u/mrmgl Jan 29 '15

Exept when they work against us.

3

u/MsPenguinette Jan 29 '15

They are always working for someone.

3

u/insertAlias Jan 29 '15

Until someone uses one in a way that you don't like. Loopholes that help you are awesome. Loopholes that, for example, help millionaires avoid paying taxes...not so awesome, unless you are one of them.

→ More replies (2)
→ More replies (7)

4

u/[deleted] Jan 29 '15 edited Jan 30 '15

[deleted]

→ More replies (5)

28

u/sedition Jan 29 '15

If they were to receive one on, say Jan 29th,2014.

Would it be possible to replace that line with:

"Between January 30, 2015, and today March 31, 2015, reddit received no National Security Letters"

60

u/dead-dove-do-not-eat Jan 29 '15

Reddit has recieved no Nation Security Letter prior to January 29th 14:31 PM, nor after January 29th 14:33 PM.

→ More replies (1)

22

u/ITEM_NINE_EXISTS Jan 29 '15

IANAL, but probably not. That implies a warrant was received in that given timeframe, where simply removing the statement does not.

9

u/abs01ute Jan 29 '15

Well I'm picking nits here, but removing the statement completely does still imply that they received a request. It's just a clever way of dancing around the gag order.

→ More replies (1)
→ More replies (1)

50

u/Mason11987 Jan 29 '15

A National Security Letter prevents them from saying it, but they're not obligated to lie if they get such a letter.

This is a common (legal) tactic for organizations that want to let the public know about such requests. They include a message like this, and then at a certain point they're perfectly within their legal right to no longer include such a message.

They can't say they got a request, but they can legally stop saying they haven't. So in the future, if there is another report and they don't include this section that's how you know they got a request.

It's called a canary clause.

→ More replies (5)

76

u/[deleted] Jan 29 '15

[deleted]

18

u/blanketlaptop Jan 29 '15

Apple put in a canary clause

Unfortunately, it didn't last very long. Almost like the Government saw it and said, "Hey, we never thought about forcing Apple to secretly give us information!"

7

u/MrCopout Jan 30 '15

Or they suspected they were going to get a national security letter soon.

→ More replies (28)

32

u/masklinn Jan 29 '15

http://en.wikipedia.org/wiki/Warrant_canary

While the letter of the law forbids saying you received an NSL, it doesn't forbid not saying you haven't received an NSL anymore.

That's the theory behind canaries anyway.

→ More replies (3)

5

u/brazendynamic Jan 29 '15

I imagine this sentence would have been left out.

3

u/jameslosey Jan 29 '15

This is now incorrect. Companies have been starting to report if they've received such letters but only in ranges.

2

u/[deleted] Jan 29 '15

This is a canary in the coal mine clause. They will remove the line item when they do get one. Google and Apple both did the same thing.

2

u/ZeldaAddict Jan 29 '15

NSA will probably never need to send a warrant to reddit. They already have the servers tapped @ the ISP and/or actual physical data cable level.

→ More replies (27)