CloudFlare’s last Warrant Canary was published over a year ago

https://www.cloudflare.com/learning/privacy/what-is-warrant-canary/

by JHorse • 3 years ago

245 132 3 years ago

lallysingh• 3 years ago

So they got a warrant that they can't talk about. That seems obvious.

JHorse6• 3 years ago

Their Canary has more to do with their infrastructure being compromised. It's likely one or more of these statements are no longer true:

1. Cloudflare has never turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone.

2. Cloudflare has never installed any law enforcement software or equipment anywhere on our network.

3. Cloudflare has never provided any law enforcement organization a feed of our customers' content transiting our network.

4. Cloudflare has never modified customer content at the request of law enforcement or another third party.

5. Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party.

6. Cloudflare has never weakened, compromised, or subverted any of its encryption at the request of law enforcement or another third party.

13of402• 3 years ago

I wonder how pedantic you could legally get with that.

Cloudflare has never been compelled to give up information to an agency called AAA. Cloudflare has never been compelled to give up information to an agency called AAB. ...etc.

badrabbit• 3 years ago

#5 seems most likely.

eastdakota9• 3 years ago

I'll state right here: all these are still true. We'll get the canary updated. Checking with legal and trust & safety why it hasn't been for so long. Likely just slipped someone's mind. Will make sure that doesn't happen again.

james_in_the_uk2• 3 years ago

Bear in mind that there are multiple ways for Cloudflare to give law enforcement or intelligence agencies customer information that do not breach one of these six statements.

It doesn’t mean that they are not helpful. Just that - as warrant canaries go - they are not complete.

owenmarshall• 3 years ago

That seems obvious.

You would assume, but when the Riseup canary expired plenty of people seemed willing to believe that a procedural issue or carelessness was to blame.

depereo• 3 years ago

Same with Spideroak.

tsujamin2• 3 years ago

The glossary entry on warrant canaries is dated December 2020, but there is a more recent canary list in their 2022 transparency report (https://www.cloudflare.com/en-au/transparency/) with the same 6 items in it.

Bizarre they appear to have skipped the H2 2022 transparency report unless I’m missing something

JHorse6• 3 years ago

H2 2022 and H1 2023

tsujamin2• 3 years ago

Give H1 2023 has only just wrapped up I optimistically presumed it would be in production now, but I’ve got no idea what the lead time on these reports historically has been

richij• 3 years ago

also on that page: "Confirmed: July 31, 2023"

sulam• 3 years ago

Warrant canaries are largely believed to be unworkable. Ie federal lawyers are going to say "cute, but no, you cannot disclose that we warranted you in this or any other way."

93po• 3 years ago

Is there a precedent for compelling speech, even with something like an NSL?

EGreg2• 3 years ago

https://en.m.wikipedia.org/wiki/Compelled_speech#:~:text=Pet....

devman0• 3 years ago

Compelled speech has lots of examples from warning labels, disclosures, truth in advertising, etc.

What you should be asking is their precedent for compelled false speech, which is a much more interesting and difficult to answer.

nradov• 3 years ago

Perhaps, but until there's a test case we're all just guessing. So far the Supreme Court has been fairly strict in following the compelled speech doctrine.

https://www.mtsu.edu/first-amendment/encyclopedia/case/30/co...

causality02• 3 years ago

Compelled speech of any kind has been repeatedly ruled unconstitutional. Also many companies have triggered their canaries, including Apple, Silent Circle, and Reddit. If Apple's legal department considers it valid I'm inclined to agree with them absent positive evidence of the contrary.

abigail95• 3 years ago

What's more likely, they removed it to signal they think canaries are a legal uncertainty or because of something else?

yencabulator3• 3 years ago

If they don't think warrant canaries are legally doable, wouldn't they have put out a statement saying that?

Clamchop• 3 years ago

Untested except obliquely but it is a compelling idea given the tests of the first that we've seen so far.

LorenPechtel• 3 years ago

Yes and no.

They can say "don't do anything". They can't say "don't avoid doing something." That's the point if the age of the warrant canary notification--they stopped updating it. This is in effect a dead canary, they're saying they are subject to an order they can't disclose.

causality02• 3 years ago

Is there a point to a company as large as Cloudflare even having a warrant canary? Half the internet goes through their servers. Of course the US government had or has hooks in them for something or other.

jvanderbot• 3 years ago

To legitimize the suspicion. That's always been the point.

nathanaldensr• 3 years ago

And, it's not like there are really alternatives. So what if they were served a warrant? What are they, and the people, going to do about it?

landemva• 3 years ago

Until the people go on a general strike and stop working, the gears will continue to turn and squeeze the vice tighter.

DANmode• 3 years ago

Is there a point to a company as large as Cloudflare even having a warrant canary?

There was, is. There likely won't be, going forward.

eastdakota9• 3 years ago

No they don't.

cj• 3 years ago

Remember, Cloudflare CEO/CTO is active on HN.

Their lack of reply (if that turns out to be the case) on this post would be telling.

EGreg2• 3 years ago

Well, it’s been 4 minutes. I’m calling it!

eastdakota9• 3 years ago

Hmm. Don't think that's intentional. Will ping legal and policy team and make sure they get a heartbeat published ASAP.

eastdakota9• 3 years ago

Sorry for the delay. I was writing our Q2 earnings script rather than checking HN. And John (CTO) is in Lisbon where he's probably just waking up. Also: he's on vacation this week.

tedunangst• 3 years ago

What action do I need to take in response? Please advise.

BillyTheMage• 3 years ago

I'm not an expert, but my course of action is to stop using cloudflare. I never used them for whatever that other thing they do is, but I switched my upstream DNS to quad9 (9.9.9.9).

edandersen5• 3 years ago

Chrome should starting warning users if Cloudflare is used to protect a website, due to the risk of MITM.

ocdtrekkie• 3 years ago

The biggest MITMer should complain about another service being an MITM? How much has Google now routed to go through themselves or be checked by them prior to serving your destination?

Bear in mind Google doesn't have a warrant canary because it is served literally hundreds or thousands of warrants per year, to the tune it's just called a transparency report to count them.

edandersen5• 3 years ago

Okay, Firefox should start warning users.

tick_tock_tick2• 3 years ago

How do you think any CDN works?

edandersen5• 3 years ago

By MITMing traffic between you and the host. Maybe Firefox should display a warning when it detects intermediaries that could have decrypted the traffic between the host and you?

Dylan168073• 3 years ago

Do you want a similar warning on every site that the server might be compromised? Because I don't think that risk is smaller than the CloudFlare MITM risk.

lmm• 3 years ago

I want a similar warning on any provider that is known to routinely MITM and send data unencrypted across the Internet. As far as I know that would only be sites hosted by Cloudflare and sites using certificates issued by the government of Kazakhstan. There's a difference between screwing up (and I wouldn't be against holding companies liable for that) and wilfully setting up a https:// URL that sends your requests unencrypted over the public Internet.

entriesfull• 3 years ago

So what's stopping these people that claim to be so righteous by using canaries from lying to you? Anyhow the ISPs and internet backbones are all tapped as many whistle-blowers have already revealed.

JHorse6• 3 years ago

Nothing is stopping them from lying.

Signaling that their infrastructure has been compromised is kind of a weird lie for them to make though...

eastdakota9• 3 years ago

The SEC could throw me in jail. And, sure, you could believe that the FBI or whoever could tell the SEC what to do. We have European and Asian investors too, so their financial regulators could also sue me personally for lying. Perhaps the FBI/CIA/NSA control them too? Gets tricky to believe: the bigger the conspiracy the faster it falls apart. It's really, really hard to be part of some grand conspiracy as a public company.

nepthar• 3 years ago

Sorry, I must have missed the claim of righteousness in the canary. Can you point me to it?

stubish2• 3 years ago

Nothing stops anyone from lying to you. In this case it would be considered fraud if the lie was discovered or leaked. Which is one of the rationales on why courts cannot compel a company to lie and post false warrant canaries, because it would incriminate them.

flangola72• 3 years ago

Courts absolutely can and do compel companies to maintain warrant canaries.

Fraud? Fraud against who? For what damages?

ck2• 3 years ago

It's weird to me people think warrants are still used.

No warrant is needed by any government agent to read your email that is over six months old and the major providers just give them a backdoor so as not to waste any time/money with requests.

Who is going to stop them from doing that with anything else? The supreme court? Good luck with that belief system. You think the NSA ever stopped just because they were discovered? Or did they just switch to "try to stop us".

djur• 3 years ago

Their "canaries" don't make any reference to warrants, and two of them explicitly rule out providing a backdoor for governments ("Cloudflare has never installed any law enforcement software or equipment anywhere on our network" and "Cloudflare has never provided any law enforcement organization a feed of our customers' content transiting our network").

barrysteve• 3 years ago

So.. what? Endless despair?

soared• 3 years ago

Source?

adamgamble5• 3 years ago

I love cloudflare, but honestly I assumed they WERE the CIA/FBI not just compromised by them. It would be the perfect front company for the government.

adamgamble5• 3 years ago

Why wouldn’t they fund the worlds largest MITM attack?

charcircuit2• 3 years ago

Cloudflare is not a MitM attack. By that same logic AWS would be an even bigger MitM attack.

yencabulator3• 3 years ago

You can avoid that with some programming/setup and money: https://developers.cloudflare.com/ssl/keyless-ssl/

eastdakota9• 3 years ago

These threads amuse me.

If adamgamble's speculation were the case, I'd go to jail for things I'd have illegally signed in our SEC disclosures attesting to the sources of our revenue and any government contracts. Suffice it to say, I like not being in jail. It's really, really hard for public companies to be part of some grand conspiracy for so many different reasons. So… once we went public I kind of thought this silly speculation would end. But guess not.

Beyond that, if you think about it, it's a way better business to run Cloudflare and serve the world than serve some US intelligence entity. That's just per se true. So if that's the case why would we ever do anything that would remotely compromise the trust necessary to, you know, be Cloudflare?

Lastly, here's a funny story. Early in our history one of our investors suggested that we talk to In-Q-Tel. Here's how naive Michelle and I were: we had no idea it was the CIA's venture capital arm. So we showed up in their office on Sand Hill Road. It was weirdly austere compared with other VCs we'd visited. And lots of security cameras. The partner at some point came out and greeted us. As he was walking us back he looked back right before we crossed the threshold back to the inner offices, "You're both American citizens, right?"

"No," Michelle said. "I'm Canadian."

"Oh." the VC said. Then you can't come back here.”

"I'm not going back there without her," I said.

"Ok, well, I guess we'll have to do the meeting in the reception area," decided the In-Q-Tel VC.

We had a very cordial meeting and then left. As we were driving away Michelle said, "Those guys were weird." And that was the end of that. Never talked to In-Q-Tel again.

But maybe it's the Canadian equivalent of the CIA/FBI/NSA we're beholden to??! ;-)

TechTechTech2• 3 years ago

Hi, kind of hijacking this conversation but as Cloudflare is unfortunately routing the majority of websites I visit I have to ask this:

Can you guarantee my Firefox browser will keep on working on 'the open internet' now Chrome moves towards "Web Environment Integrity" and Safari towards "Private Access Tokens" and Cloudflare is supporting and implementing such technologies on scale?

I intent to not participate in these DRM APIs with my Firefox browser and would like to keep browsing the internet.

shapefrog• 3 years ago

I'd go to jail for things I'd have illegally signed in our SEC disclosures attesting to the sources of our revenue and any government contracts

CIA/FBI/NSA agreements include immunity from prosecution in the US at least. Your problem would be in foreign jurisdictions only.

adamgamble5• 3 years ago

Ha thanks for the reply, was mostly just joking didn't expect a reply from Matthew directly :). I appreciate that you're active on HN though!

DropInIn• 3 years ago

Your response really shows a disconnect with the user and what was said

Not many users who encounter your service while trying to connect to a website will know _anything_ about your company, let alone knows its public or read disclosures.

Cloudflare has a public perception and sentiment problem and dismissing it as you have will lead to an inevitably negative outcome.

JohnFen2• 3 years ago

So… once we went public I kind of thought this silly speculation would end. But guess not.

In fairness, there are quite a number of public companies that turned out to be operating partially as fronts for spying agencies (AT&T is the shining example here). So simply being a public company could not be expected to serve as some kind of proof of independence.

Terretta• 3 years ago

It's really, really hard for public companies to be part of some grand conspiracy for so many different reasons.

As difficult as it was to keep PRISM and the many other overt and covert arrangements (public, private but leaked, and private but not yet leaked) between backbones, carriers, CDNs, hosting providers, ISPs, etc., and the agencies leveraging them, out of each firm's public filings?

Because evidence is it's not difficult at all, considering the whole of the 30 years since the Internet went commercial.

burnished• 3 years ago

What is the language around the non-disclosure order? There seems to be speculation that a warrant canary would be construed the same as a disclosure, but are you required to not inform the concerned party, or required to not disclose law enforcement contacting you at all?

From a practical perspective I don't imagine that cloudflare removing a canary could give any one organization a signal - I don't know what the bar for a 'disclosure' is but informally I would not consider it a targeted specific warning.

EDIT: the other component I am curious about is duration, there is still utility in the canary even if it comes late, future users will know that there was a compromise and that further ones are likely, right?

benreesman• 3 years ago

Maybe I’m just getting old and distracted, but I feel like CloudFlare went from “whoa some HN pros are doing great CDN work with some serious chops and an underdog work ethic” to “is it possible to never connect to them” like, really fast.

tmpX7dMeXU• 3 years ago

I think there was 10 or so years in the middle there :)

probably_a_gpt• 3 years ago

I think we’d all be pleased to build something out of passion and have it survive a decade without corruption, probably harder than it sounds

CloudFlare’s last Warrant Canary was published over a year ago

Related Stories