86
Simplifying warrant canaries - Purplix canary (lemmy.nz)
submitted 1 year ago* (last edited 1 year ago) by Ward@lemmy.nz to c/privacyguides@lemmy.one
19 comments fedilink hide all child comments

Github: https://github.com/WardPearce/Purplix.io

View our canary: https://purplix.io/c/purplix.io/3ZjhTlZRWv8iqa6sn9yJ3TRiIkVbwITOOlwLjJD36jQ

What is Purplix Canary?

Purplix Canary is a free & open source warrant canary tool what helps you to build trust with your users.

It allows you to inform users cryptographically if your site has been compromised, seized or raided by anyone.

How does it work?

Site verification

Purplix uses DNS records to verify the domain the canary is for, giving your users confidence they are trusting the right people.

Canary signatures

Each domain is associated with a unique key pair. The private key is generated locally and securely stored within the owner's keychain. When a user visits a canary from a specific domain for the first time, their private key is used to sign the public key. This signed version of the public key is then automatically employed for subsequent visits, effectively mitigating man-in-the-middle attacks and ensuring the trustworthiness of canary statements from the respective domain.

Files

Canaries can include signed documents to help users further understand a situation.

Notifications

Users are automatically notified on the event of a new statement being published.

all 20 comments
sorted by: hot top controversial new old
[-] jet@hackertalks.com 17 points 1 year ago* (last edited 1 year ago)

Shouldn't there be a notification when a statement isn't published? Or when the text changes? (Or is that what is meant by a new statement?)

Is the intention to build this into a browser extension?

Love your projects, love the philosophy, great work!

[-] Ward@lemmy.nz 11 points 1 year ago

Agreed, should have an alart for missed canaries. Each canary has "statements" you publish new statements to update ur canary. This provides a signed record of passed canaries.

Browser extension or even mobile app could be another aspect of further securing validation. Currently we do store a offline backup for each public key in idb storage & a signed copy if you have a account for further validation if the URL hash has been tampered with.

Thank you for your kind words ❤️❤️

[-] CameronDev@programming.dev 7 points 1 year ago

Someone please correct me if I am wrong, but I was under the impression that warrent canaries were a broken concept. Anyone with the power to submit a warrant to a company also has the ability to prevent the company from triggering their canary.

[-] explore_broaden@midwest.social 24 points 1 year ago

The idea is that there is no such action as “triggering the canary” that the government can stop them from taking. Instead they refrain from updating it, thus alerting people that something has occurred. However, since the point of a canary is that not updating it raises concerns, I’m not sure how this service makes any sense (alerts on new canaries?).

The idea is that there is a big difference between the government saying “don’t tell anyone about this” and saying “you must make a false statement (the canary) every X amount of time indefinitely.” In the past courts in the US have taken a fairly dim view of the government trying to compel speech. There are some example cases at https://en.m.wikipedia.org/wiki/Compelled_speech#United_States.

[-] uriel238@lemmy.blahaj.zone 3 points 1 year ago* (last edited 1 year ago)

I wonder where mandated sonograms and abortions are bad disclaimers to patients seeking abortions falls.

That speecch is mandated, yet SCOTUS barred California from mandating crisis pregancy centers reporting to patients you cannot get an abortion here but instead call these numbers to schedule one

Lots of controversies outside the topic of the thread, but certainly examples of mandated speech and rulings to prevent mandated speech.

[-] CameronDev@programming.dev 3 points 1 year ago

None of those compelled speech examples include national security though, which has its own level of rules and courts. (I am not American or a lawyer, so i may be wrong).

And if a company can be compelled to hand over customer data, why wouldnt they be hand over access to the systems that update the canaries?

The other issue is thar once a canary is triggered, it cant be reset, which means that XXX agency can trigger the canary with something meaningless, and then its forever untrustworthy.

You may well be correct, and they are sufficient, but i am not convinced that canaries work, especially against the higher level adversaries.

[-] explore_broaden@midwest.social 3 points 1 year ago

Yes, most of those points are the concerns with warrant canaries. So far as we know the concept is totally untested in court so it’s hard to say what the result would be until it happens.

Updating the canary should require a human input (like a password to unlock the GPG key), which is not sometime the government would generally get access to (they make a request for data about XYZ user, and the company turns it over; they wouldn’t get actual access to the production system). The government could seek a ruling to force the company to update the canary, but as such a thing hasn’t been granted before (at least as far as we know), it’s not a guarantee. So, there is a chance that the warrant canary will serve to alert users to something happening, which is better than nothing. But because of its untested nature, it might be broken by a court.

I’m not sure I understand your point about “once it’s triggered it can’t be reset.” If a company fails to update their canary on schedule it means something happened that they can’t disclose. Once they are released from the NDA they can release a new canary explaining what happened.

[-] CameronDev@programming.dev 2 points 1 year ago

Wikipedia does claim that patriot act subpeonas can penalise any disclosure of the subpeona. But i am not a lawyer, and afaik this is untested (or at least undisclosed :/ )

https://en.m.wikipedia.org/wiki/Warrant_canary

Some subpoenas, such as those covered under 18 U.S.C. §2709(c) (enacted as part of the USA Patriot Act), provide criminal penalties for disclosing the existence of the subpoena to any third party, including the service provider's users.

In September 2014, U.S. security researcher Moxie Marlinspike wrote that "every lawyer I've spoken to has indicated that having a 'canary' you remove or choose not to update would likely have the same legal consequences as simply posting something that explicitly says you've received something."

I think my point is that a gag order with a long time out essentially kills the canary, even if it doesnt affect the vast majority of the services users.

Thanks for your response though, I appreciate the additional information.

[-] Ward@lemmy.nz 2 points 1 year ago

Also to note, that Purplix does warn users to assume the site has been compromised if the latest statement has expired.

[-] explore_broaden@midwest.social 5 points 1 year ago

That actually could be useful, by having a completely external company send a notification without action by the company receiving the warrant, it may be possible to circumvent the prohibition on alerting users.

[-] rinkan@burggit.moe 2 points 1 year ago

The canary is triggered through inaction, not action. The government would have to compel the target of the subpoena to keep updating the canary on schedule.

[-] eatham@aussie.zone 6 points 1 year ago

Purplix.io looks cool, I don't make surveys but If I do I'd probably use it

[-] stifle867@programming.dev 6 points 1 year ago

This is a great idea! I wish more websites did warrant canaries, and those that do often fail to maintain them or plan for the case when a gag order prevents them from updating an existing canary. The only thing I would suggest is making it more clear that being in an alpha stage means that the product should not be relied upon in critical situations.

[-] CameronDev@programming.dev 2 points 1 year ago

A failed warrant canary is effectively a triggered warrant canary. If its triggered, you have to assume the company has been issued a warrant, and is therefore vulnerable.

[-] stifle867@programming.dev 1 points 1 year ago

What do you mean by a failed warrant canary? In most cases there is no clear failure because there's no clear plan in place to maintain them.

For example, if a website has a statement "we have received 0 warrants". When was that published? Yesterday? A year ago? More? Even if it has a date, say 6 months ago. What does that mean? That they only update it every year? Or maybe there were meant to update it they just forgot, maybe they aren't allowed to update it due to a gag order.

Due to the way each website does things differently with no clear guidelines, there isn't actually a defined failure case.

[-] CameronDev@programming.dev 1 points 1 year ago

They typically have a date for the message and the date for the next update. If they miss their update, they have failed.

[-] stifle867@programming.dev 1 points 1 year ago

While you can find examples of companies doing it correctly, it's also easy to find companies who do not. Also, some update theirs seemingly daily but don't actually state this. Sure, you can check and see that it was updated "today", but what if it doesn't get updated and you don't know its "typically" updated daily. Again, no date for the next update.

These are all examples of companies who do not explicitly specify when the next update will be: kagi.com/privacy nordvpn.com/security-efforts/ cloudflare.com/transparency/

[-] totallynotfbi@lemm.ee 1 points 1 year ago

Maybe it was updated after your comment, but the demo site has that notice prominently at the top for me

this post was submitted on 08 Oct 2023
86 points (100.0% liked)

Privacy Guides

16263 readers
11 users here now

In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.

This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.

You can subscribe to this community from any Kbin or Lemmy instance:

Learn more...

Check out our website at privacyguides.org before asking your questions here. We've tried answering the common questions and recommendations there!

Want to get involved? The website is open-source on GitHub, and your help would be appreciated!

This community is the "official" Privacy Guides community on Lemmy, which can be verified here. Other "Privacy Guides" communities on other Lemmy servers are not moderated by this team or associated with the website.

Moderation Rules:

  1. We prefer posting about open-source software whenever possible.
  2. This is not the place for self-promotion if you are not listed on privacyguides.org. If you want to be listed, make a suggestion on our forum first.
  3. No soliciting engagement: Don't ask for upvotes, follows, etc.
  4. Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
  5. Be civil, no violence, hate speech. Assume people here are posting in good faith.
  6. Don't repost topics which have already been covered here.
  7. News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
  8. Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
  9. No help vampires: This is not a tech support subreddit, don't abuse our community's willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
  10. No misinformation: Extraordinary claims must be matched with evidence.
  11. Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
  12. General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.

Additional Resources:

founded 1 year ago
MODERATORS
jonah@lemmy.one
dngray@lemmy.one
freddy@lemmy.one
ninchuka@lemmy.one
jonah@lemmy.jonaharagon.net