Hacker News Reader

Comment by read | Hacker News Reader

Is a warrant canary even legal? If it isn't, what's the point of having them?

From http://en.wikipedia.org/wiki/Warrant_canary

The US security researcher Moxie Marlinspike states that "every lawyer we've spoken to has confirmed that [a warrant canary] would not work" for the TextSecure server.

Direct link: https://github.com/WhisperSystems/whispersystems.org/issues/...

View on HN

The main worry for TextSecure is that Google upon receiving a NSL will send you a targeted update for the TS client and GAPPS framework that sends all your msgs to a three letter agency before being encrypted and sent as usual. So Google would need a canary for the play store

Except for the fact that Google does not have the signing keys that are used for the TextSecure binaries. They cannot silently distribute a binary that has been tampered with. This distributed trust system is one of Android's strengths:

https://developer.android.com/tools/publishing/app-signing.h...

To clarify, so Google can distribute a binary that has been tampered with, but it'd be trivial to prove that they had in fact done that?

That's correct. Android will warn you if the signatures don't match too. Even if we're in the full-on conspiracy theory territory of Google disabling that core security feature, impersonating a third-party developer, and dropping a binary onto a single user's phone, they still couldn't fake the signature.

They could simply disable the warning. It's android giving the warning, not the app.

Unless you have a phone still vuln to the Android signature bug, which is millions of devices still running unpatched carrier builds.

But they own the OS, so I guess they can intercept whatever they want before it even reaches the app.

Though don't they control the code that does the signature checking?

If you're concerned about that threat vector, you wouldn't be using GAPPS/Play. Except that's the only way they'll distribute TextSecure.

The EFF quote in your link suggest yes.

Reply on news.ycombinator.com