Dubfire

The overreach is in expanding the original mission of DNT, which was to request that sites not harvest a user’s data for targeted advertising:

http://paranoia.dubfire.net/2011/01/history-of-do-not-track-header.html

Expanding that to mean “do not reveal the user’s IP address” is a significant expansion of the original meaning, having little to do with the protection against being individually tracked that the DNT header was designed for.

Asking Homebrew to disable analytics has nothing to do with targeted advertising opt-outs, but supports the ideological goal of the authors in promoting their new idea that revealing the existence of the user is “tracking”. That expansion exceeds the scope of the definition of “tracking” as used to reference targeted advertising and marketing, something that is not applicable to the Homebrew project’s existing flag in any way.

Attempting to promote their beliefs by aliasing those two concepts together - tracking protection against targeted advertising, versus disabling telemetry and auto update - is therefore overreach to me, especially when presented without this context to projects such as Homebrew and others in pull requests, and I think it will ultimately lead to their effort’s failure.

To me, this is all a direct consequence of their attempt to ride the coattails of the failed DNT effort by reusing its key phrase “do not track”. They should have used a different name. In a few seconds, I can think of a pretty great one that still…

[0] He heard about this in 2005 (when the government was run by a different administration) but couldn't find anything. Eventually he filed a FOIA request. Silence, until spring of last year, when he was told there was some some information but it was redacted. So he filed an appeal, and it was granted. I suspect the lack of DoJ comment is because they're still trying to find out whether it was a fully formed program or just junior official's bid for career visibility - I suspect the latter, given the extremely basic level of information on these slides and lack of other documentation.

It's unclear whether the question left with the DoJ was about this 'hotwatch' project or about administrative subpoenas in general. An AS is a request for infor information issued by a government agency under statutory authority (ie Congress passed a law specifically saying an agency may issue one in an investigation and it must be complied with). About 300 government agencies are empowered to issue them altogether, although usually within a narrowly defined scope. The obvious constitutional problems with administrative subpoenas have been known for some time [1]. Misuse of such procedures has resulted in disciplinary proceedings at the FBI, among other agencies [2].

The basic thing to remember is that legally speaking warrants are not required for this kind of information gathering because it does not constitute a search [3] - as a legal term, this may not always mean what you think it…

> If they're going to supply access via the website, or allow you to share with others then they need to be able to decrypt the file.

They need to be able to decrypt the file right then to give you access via the website. They don't need to be able to decrypt the file the rest of the time. If the encryption key depends on your password, this is easy to implement. In modern browsers, this could actually be done in the browser, so that the keys for decrypting the file never reach their servers.

To allow you to share individual files with others, they could encrypt each file with a randomly-generated session key, which is encrypted with your user key. When you give access to the file to a recipient, you would be encrypting a copy of that session key with the recipient's public key.

In actual fact, it appears that anyone who knows the secure hash of the file's content is able to discover that Dropbox is storing it: http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-user-privacy-for.html — and there's at least well-founded speculation, if not proof, that this means that knowing the secure hash is sufficient to read the file: http://news.ycombinator.com/item?id=2440074

For their previous statements to be true — that their employees have no access to your files — they would have to be doing something like this.

> i don't think this is the correct interpretation. in a court of laws, acquiring evidence is something procedural and governed by rules and regulations. having a third party (lavabit) acquire the evidence and then turn it over to the government is probably something that wouldn't pass muster in court due to chain of custody and other rules.

Search for "$" on this page: http://paranoia.dubfire.net/2009/12/8-million-reasons-for-real-surveillance.html It is very common for third party service providers to search records themselves on behalf of law enforcement, and law enforcement has historically trusted that and even compensated them.

It's the only way that really makes sense IMO. Can the FBI really bust down, say, Verizon's doors, seize all their hard drives, and correctly generate evidence based on systems that aren't theirs, and may in fact be unique among the phone systems of the entire world? Maybe an email system is simpler, but still.

Also, I think it's inappropriate to seize 400,000 users' data just to (ostensibly) get to one person. But I'm not a lawyer, maybe it is arguably legal.

P.S. Also see https://www.eff.org/files/filenode/social_network/Yahoo_SN_LEG-DOJ.pdf for all the things Yahoo does on behalf of LE.

http://www.law.cornell.edu/uscode/text/47/1002

"(3) Encryption
A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication."

More info: http://paranoia.dubfire.net/2011/02/deconstructing-calea-hearing.html

Also, declan, I was in the room during meetings with the FBI when I worked for a large telecommunications carrier. I integrated the CALEA mediation platform with the IP network and I'm well aware of what is required and not required to be present in the network regarding CALEA.

IANAL, but you would be wise to consider that the FBI considers the former "information service providers" to be "telecommunications providers" to the extent that they can convince a judge that they are acting as one. I wouldn't think I was safe because I was using any kind of messaging where I couldn't control the keys, the software that uses them, and the distribution and verification of said keys.

Quinn Norton wrote an article for Wired describing cryptocat and headlined "This Cute Chat Site Could Save Your Life and Help Overthrow Your Government" http://www.wired.com/threatlevel/2012/07/crypto-cat-encryption-for-all/all/.

Chris Soghoian criticized that article and articles like it here that overly hype their subjects. He compared it to the unwarranted hype for Haystack. http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html.

Ryan Singel, editor of Wired's Threat Level, called Soghoian's article a sexist attack on Norton here: http://www.wired.com/threatlevel/2012/08/security-researchers/all/

Soghoian replied here: http://paranoia.dubfire.net/2012/08/responding-to-wireds-ad-hominem-hatchet.html

This is the news.ycombinator thread that discussed Soghoian and Wired's responses: https://news.ycombinator.com/item?id=4354959

This is Quinn Norton's, the original reporter's, response.

I disagree with Norton (and Singel) and believe if Soghoian' original response had been sexist, Norton would have been able to quote from it. As it is, she can only make a tone argument.