It's not much but it's something.
Which, in my mind, is preferable to the alternative.
But if you are still a carrot fetishist in the future, they can use the knowledge that you used to be a carrot fetishist to set up a sting operation. A little parallel reconstruction, they seize your phone and laptop, and next thing you know you're in prison in the future, thanks to the data they hoovered up today and will be in their database forever.
So would J Edgar Hoover.
I probably should have been more explicit about two of my big problems/uncertainties with warrant canaries in my initial comment. The biggest issue is that they only really seem to matter in circumstances where I assumed the service provided was a secure and private communication platform. My personal threat model does not treat the reddit platform as a secure and private communication platform and Reddit Inc. is just slightly less of an adversary than Eve's Agency. (sidenote: You are Threat Model Shostack correct?)
My other issue is that the canaries seem to be backward looking and do not do much for my future outlook. It seems that the knowledge that an NSL was served just tells me about the past, but very little about the future. Should I assume that since an NSL was served once that I should expect that they will continue to be served repeatedly and regularly going forward? I am having trouble expressing the latter adequately and clearly, hopefully it is teased out below.
For the sake of argument I am assuming/ignoring that Eve does not do global surveillance and cannot easily associate requests from my IP to reddit with submissions/comment timestamps, vote changes, etc.
> If the NSA hoovered up this data, suddenly they might learn a lot
> about you that they didn't know before
In C1, I continue to visit /r/BDSM, /r/guns, /r/earthliberationfront, etc and the record of my sensitive activities on reddit is even larger if they are served an NSL in the future.
> suddenly things that may have been frowned upon before by
> the general public are suddenly made illegal by Executive order
> or some other horrible twisting of our laws? This provides the
> government with a great way to narrow down the list and identify
> targets that have become "inconvenient" for them.
> Think it can't happen or that this is an off-the-wall conspiracy
> theory? Germany and Russia would like to have a chat with you.
> Case in point from a couple days ago:
> https://news.ycombinator.com/item?id=11374839
You're right that an early-warning system hasn't been developed. We have no way of knowing what the NSA will decide to analyse after the fact. Indeed, we do not know if an asteroid will hit the earth tomorrow. At one level, there is a limit to our ability to predict the future.
So it's up to the individual. We self-censor, or don't. The chilling effect of the knowledge of surveillance is well documented. Are you making a point that thinking you're being spied upon is more damaging than any fallout of the actual spying?
Edit: spelling
Or anybody monitoring their traffic. coughNSAcough
I found:
"Identifying Website Users by TLS Traffic Analysis: New Attacks and Effective Countermeasures"
https://hal.inria.fr/hal-00732449/
Does anyone know of other, recent research in this area? It's been a long time since I last looked at opaque data captures of TLS/SSL traffic.
I also found: https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305... which states in part:
"It should be noted that AEADs, such as ChaCha20-Poly1305, are not intended to hide the lengths of plaintexts. When this document speaks of side-channel attacks, it is not considering traffic analysis, but rather timing and cache side-channels. Traffic analysis, while a valid concern, is outside the scope of the AEAD and is being addressed elsewhere in future versions of TLS."
On a skim of https://tools.ietf.org/html/draft-ietf-tls-tls13-11 I couldn't find anything new wrt. recommendations on padding with the goal of thwarting traffic analysis?
Anyone have any pointers on this?
I would be shocked if NSA didn't get a secret court order to get AWS access.
Let's say you frequent lots of subreddits that might be considered outside societal norms. Right now that data is ONLY available internally at Reddit.
If the NSA hoovered up this data, suddenly they might learn a lot about you that they didn't know before (although there's probably a fair argument that people probably leave enough other clues scattered across other data sources they likely have access to that make this redundant).
Maybe you aren't looking at things that would set off their alerts for today's hot media topics. But what about the future? What if we end up with a President with a radical discriminatory agenda (a scarily likely possibility at this point unfortunately)? What if suddenly things that may have been frowned upon before by the general public are suddenly made illegal by Executive order or some other horrible twisting of our laws? This provides the government with a great way to narrow down the list and identify targets that have become "inconvenient" for them.
Think it can't happen or that this is an off-the-wall conspiracy theory? Germany and Russia would like to have a chat with you.
Sure, the mainstream users probably won't have any noticeable impact on their lives. For now at least. But this can still have a chilling effect on free speech today, without the nightmare scenario I outlined above occurring.
Case in point from a couple days ago: https://news.ycombinator.com/item?id=11374839