It doesn't seem very secure that they give out their security measures. I mean, "To increase the randomness of our hash outputs...combines the password with th

It doesn't seem very secure that they give out their security measures. I mean, "To increase the randomness of our hash outputs...combines the password with the account name," so now I know they use an account name so what is the point in that tiny part? Many little parts of this just give away stuff that should be secret in my opinion. That doesn't necessarily make it insecure, just a dumb idea if something ever did go wrong. Overall the process sounds good if you just want to store data on their server and not have it be readable if someone happens to come across a "dead" HDD that lavabit threw away. Oh, on a similar note: how do they decrypt these messages after you have verified your user/password during sign in if it requires the plaintext password to decrypt each message? By storing the password in a plaintext session database?