3 ms·
http://www.lavabit.com/ http://www.lavabit.com/ They (claim to) use some sort of encryption scheme such that they do not have access to the data on their own s
by lmkg 17y ago
http://www.lavabit.com/ http://www.lavabit.com/
They (claim to) use some sort of encryption scheme such that they do not have access to the data on their own servers. I don't know enough about crypto to verify, but if your concern for moving away from Google is privacy and/or security, it's probably worth at least a cursory glance.
- tectonic 17y agoHere's the description. Can anyone tell us if this seems secure? http://lavabit.com/secure.html http://lavabit.com/secure.html
- invisible 17y agoIt doesn't seem very secure that they give out their security measures. I mean, "To increase the randomness of our hash outputs...combines the password with the account name," so now I know they use an account name so what is the point in that tiny part? Many little parts of this just give away stuff that should be secret in my opinion. That doesn't necessarily make it insecure, just a dumb idea if something ever did go wrong. Overall the process sounds good if you just want to store data on their server and not have it be readable if someone happens to come across a "dead" HDD that lavabit threw away. Oh, on a similar note: how do they decrypt these messages after you have verified your user/password during sign in if it requires the plaintext password to decrypt each message? By storing the password in a plaintext session database?