https://theintercept.com/2016/11/29/something-happened-to-ac...
If I would be a user of this service, that's enough of a red flag for me to quit it immediately. Even though I agree that most rumors are blown out of proportion considering the timing.
Looking at the warrant canary and why it might not have been updated, I suppose the most benign explanation is that they're under a "gag order" of some sort. But why? Under what realistic scenario would they be gagged, but not have disclosed user data?
Or does that cross some arbitrary legal line?
If you had a canary for 0-99, 100-199, etc, and then removed the canary that didn't match, a court might decide that your decision not to assert that you didn't receive 0-99 canaries was as good as asserting that you did receive 0-99. Whereas, if you have a general canary, you can say you removed it because you just didn't want to use a canary any more.
Having said that, I suspect that a court that's sympathetic to the government might well decide that choosing not to speak is itself an act of speech, and that even if you can't be forced to restore a warrant canary, you can be prosecuted for removing it.
"Every third Tuesday of the month" is a canary whereas "About once a quarter, at our discretion, if Bob from Legal remembers" is useless.
Yes it makes more work for the staff, but if that's a problem then just don't do a canary at all.
¹ — https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
Worth reading up about Key Disclosure Law too: https://en.wikipedia.org/wiki/Key_disclosure_law
If so, why not compromise the system yourself, and then advertise that? Accidentally leaving your SSL private key online temporarily would do it, surely?
[...]
>Riseup intends to update this report approximately once per quarter.
So, 5 months later, no update means they have been compromised after August and received a gag order.
There are absolutely no benefits to be gained from choosing riseup over any other provider, but a plenty of harm comes from centralizing communications of at-risk users.
For reference, I have no clue what precedent they've set already.
