🆕 Software Removal | Warrant canary section #1567

New Issue

2019-12-04T21:08:30Z

Mikaela commented

2019-12-04 21:08:30 +00:00

(Migrated from github.com)

Description

Please refer to https://github.com/privacytoolsIO/privacytools.io/issues/74 for the previous discussion.

## Description Please refer to https://github.com/privacytoolsIO/privacytools.io/issues/74 for the previous discussion.

Mikaela commented

2019-12-04 21:35:46 +00:00

(Migrated from github.com)

Nameless comments from the team.

I dont want a warrant canary as making even a single fuck up ONCE will mean you will lose trust for ever

also I am not certain of this, because RiseUp did https://riseup.net/en/about-us/press/canary-statement and people are still trusting them and asking us why we don't list them

People who didnt hear about them trust them
Most who did hear about it dont

And once you start a warrant canary, you have to have 100% certainty that there is always someone willing to keep it updated
Look at spideroak for example
They stopped publishing warrant canaries because they claimed it was to much hassle
But as a affecr, everyone saw it as there warrant canary being triggered and that they we compromised by the feds
Considering how small our services are, i really believe the potentional shit hurricane ( not storm. But hurricane) is not worth it
if the FBI could compel you to publish a statement about why you are no longer hosting a warrant canary, they could also compel you to publish a warrant canary
both would be compelled speech
But yh, its not worth the risk
and if you were actually compromised you'd do neither, hence either they weren't compromised or warrant canaries are ineffective either way

Warrant canaries arent really battle tested though

Simultaneously we say:

A warrant canary is a posted document stating that an organization has not received any secret subpoenas during a specific period of time. If this document fails to be updated during the specified time then the user is to assume that the service has received such a subpoena and should stop using the service.

https://www.privacytools.io/providers/#wc - emphasis mine

Thus the only solution I see is removing the section. The examples are also listing VPN providers that as far as I am aware of we aren't listing.

Nameless comments from the team. > I dont want a warrant canary as making even a single fuck up ONCE will mean you will lose trust for ever >> also I am not certain of this, because RiseUp did https://riseup.net/en/about-us/press/canary-statement and people are still trusting them and asking us why we don't list them >>> People who didnt hear about them trust them >>> Most who did hear about it dont > And once you start a warrant canary, you have to have 100% certainty that there is always someone willing to keep it updated > Look at spideroak for example > They stopped publishing warrant canaries because they claimed it was to much hassle > But as a affecr, everyone saw it as there warrant canary being triggered and that they we compromised by the feds > Considering how small our services are, i really believe the potentional shit hurricane ( not storm. But hurricane) is not worth it > if the FBI could compel you to publish a statement about why you are no longer hosting a warrant canary, they could also compel you to publish a warrant canary > both would be compelled speech > But yh, its not worth the risk > and if you were actually compromised you'd do neither, hence either they weren't compromised or warrant canaries are ineffective either way >> Warrant canaries arent really battle tested though * * * * * Simultaneously we say: > A warrant canary is a posted document stating that an organization has not received any secret subpoenas during a specific period of time. If this document fails to be updated during the specified time then the user is to assume that the service has received such a subpoena and should ***stop using the service.*** * https://www.privacytools.io/providers/#wc - emphasis mine ***Thus the only solution I see is removing the section.*** The examples are also listing VPN providers that as far as I am aware of we aren't listing.

Mikaela commented

2019-12-05 09:22:39 +00:00

(Migrated from github.com)

In 2016 the EFF announced it would no longer accept submissions of new canaries, nor monitor existing canaries. They explained that the project had run its course, that ample attention had been brought to canaries, and detailed warrant canary strengths and weaknesses they observed.[26] As of Q3 2019 canarywatch.org no longer exists.[27]

https://en.wikipedia.org/wiki/Warrant_canary#Canary_Watch

Was added to the team chat, however @blacklight447-ptio said something about wishing to expand the section instead soo I will leave that for them.

> In 2016 the EFF announced it would no longer accept submissions of new canaries, nor monitor existing canaries. They explained that the project had run its course, that ample attention had been brought to canaries, and detailed warrant canary strengths and weaknesses they observed.[26] As of Q3 2019 canarywatch.org no longer exists.[27] * https://en.wikipedia.org/wiki/Warrant_canary#Canary_Watch Was added to the team chat, however @blacklight447-ptio said something about wishing to expand the section instead soo I will leave that for them.

Mikaela commented

2019-12-25 08:49:41 +00:00

(Migrated from github.com)

Cloudflare appears to view this as their warrant canary, which has no update time, isn't PGP signed or anything.

https://www.cloudflare.com/transparency/

Cloudflare appears to view this as their warrant canary, which has no update time, isn't PGP signed or anything. ![kuva](https://user-images.githubusercontent.com/831184/71439939-34f44e80-2704-11ea-9927-1bfd5bee0066.png) * https://www.cloudflare.com/transparency/

blacklight447 commented

2020-02-03 13:49:25 +00:00

(Migrated from github.com)

I think this issue can now be closed.

Mikaela commented

2020-02-04 13:31:29 +00:00

(Migrated from github.com)

@blacklight447-ptio so what is the final conclusion on the warrant canaries?

blacklight447 commented

2020-02-04 16:17:09 +00:00

(Migrated from github.com)

That we won't be getting a warrant canary.