8 ms·

So an American government agency destroyed an American business merely as collateral damage of trying to persecute an unrelated guy who'd revealed their wrongdo

• beardog 11y ago
  Indeed, sad isn't it.
• serge2k 11y ago
  He destroyed his own business. I do respect his morals, but I'm not clear what exactly he hoped to accomplish? Could you legally reveal the target of an active phone wiretap? Intercepting email metadata for a specific person under investigation seems like a reasonable thing for law enforcement to attempt. Is his problem with it the action, or the idea of a secretive court allowing this? The other issue is having to turn over encryption keys. This is much more of a grey area, and I can see why he would shut down rather than set that precedent. This is why if you want your data safe you should have the keys.
  • ipsin 11y ago
    I think he hoped to avoid being forced to run a honeypot meant to capture Mr. Snowden's communications.
  • late2part 11y ago
    His moral stand wasn't for Snowden. He surmised the court would give the key to the Feds and they would use it to unencrypt things beyond the scope of the order. He stood on principle against the courts insistence that he trust the plaintiff to use the tool within the courts orders. The courts naievete is cringeworthy.
    • Pyxl101 11y ago
      No, that's not what happened. The government initially asked LavaBit to intercept and provide data for one user only. LavaBit had done this in the past for FBI on other cases. However, the owner dragged his feet for no legally defensible reason responding to this particular request, and asked for compensation et cetera, and so the government demanded the SSL keys to do it themselves.
      • asquabventured 11y ago
        > LavaBit had done this in the past for FBI on other cases. Citation needed.
        • nommm-nommm 11y ago
          https://cryptome.org/2013/08/joey006/usa-v-joey006.htm https://cryptome.org/2013/08/joey006/usa-v-joey006.htm
• duaneb 11y ago
  > So an American government agency destroyed an American business merely as collateral damage of trying to persecute an unrelated guy who'd revealed their wrongdoing. I'd argue they destroyed it because it doesn't align with their view of how the country should work. The government hasn't moved much from treating encryption like munitions—they probably viewed lavabit as an existential threat.
  • lliamander 11y ago
    RE: Government Treating Crypto like munitions - I'm curious, from anyone who knows about this stuff, is the argument in https://www.xkcd.com/504/ https://www.xkcd.com/504/ valid? I.E. could crypto be protected under the Second Amendment? To my IANAL eyes, it seems to me to be a completely legitimate argument.
    • Sanddancer 11y ago
      The second amendment only applies to stuff that happens within the US. You have to file paperwork to transmit things like gun schematics over national borders, which is why plans for the Liberator pistol got pulled from the main site in a couple days and are now shared mostly through torrent sites. However, crypto not being a munition means that a good argument could be made that it is speech, and therefore falling under the much more firmly challenged and discussed First Amendment, so restricting crypto could be considered a prior restraint.
      • lliamander 11y ago
        Makes sense. So, hypothetically, if crypto was used within US borders (e.g. I encrypt my hard drive) and no algorithms were shared across national borders, then one could attempt a Second Amendment defense (assuming it was still labeled as munitions)? I can see how recognizing it as speech and protecting it under the First Amendment would be superior. Thanks!
      • x1798DE 11y ago
        Even without this cross-border thing, there are tons of regulations about what kind of weaponry you can have, and I don't think anyone argues that the 2nd amendment would allow anyone unlimited access to bazookas or nuclear weapons. Presumably if cryptography were treated as munitions, they'd argue that you can have access to some cryptography, but not "military grade cryptography".
• madaxe_again 11y ago
  And they accidentally disclosed that they're pursuing a guy who is concerned great power is in hands not competent to wield it. Oh the irony.
• EC1 11y ago
  I was a lot happier a long time ago before I started reading HN / news in general. The "spark" that lit everything is gone.
  • anonbanker 11y ago
    Is it better to be happy, or informed?
    • jacquesm 11y ago
      http://vladdolezal.com/blog/2011/circle-of-concern-circle-of-influence-circle-of-control/ http://vladdolezal.com/blog/2011/circle-of-concern-circle-of... Ignorance is bliss. Personally I'd rather be informed, that way when I do have the power to exert a little influence (such as in the voting booth) I'm more likely to make a decision that will steer away from more mess. Even so that almost always feels like decisions between various grades of bad rather than something good.
    • EC1 11y ago
      Happy. Trying my best to get over existential dread.
      • stray 11y ago
        Definitely happy.
    • calvins 11y ago
      "It is better to be a human being dissatisfied than a pig satisfied; better to be Socrates dissatisfied than a fool satisfied. And if the fool, or the pig, are of a different opinion, it is because they only know their own side of the question. The other party to the comparison knows both sides." - John Stuart Mill
      • EGreg 11y ago
        Can anyone really know what it's like to be a pig? - Thomas Nagle paraphrased :)
• MichaelGG 11y ago
  Uh didn't Lavabit destroy themselves? They offered an impossible product and refused to comply with lawful (and not unreasonable) court orders. They essentially lied about what they were capable of. Hint: If you're receiving SMTP from the world, you always have access to the content of that email. Even if you think you're clever by encrypting it "right away".
  • taneq 11y ago
    They promised secure communications and when the government made it impossible for them to legally continue to offer that service, they shut down rather than betray their users. As far as I can see, they delivered on their promise.
    • nickpsecurity 11y ago
      No, he promised secure communications, developed a dumb design that tied all users to one secret, and folded rather than divulge it. Fortunately, others learned from his mistake in designing better services.
      • taneq 11y ago
        In hindsight, yes. It's possible (although seems naive these days) that he didn't actually believe he had to count his own government as hostile.
        • nickpsecurity 11y ago
          No, in foresight. It was so dumb that secure messaging from 80's and 90's did better in various ways. High assurance already settled on proxies, guards, and per message crypto due to many attacks possible. Hushmail put the needed functionality in an applet to avoid relying on just web tech. Then, there was Lavabit founder acting snobby talkinv about how he used same security as banks. What might that be? HSM's for keys, link encryption, and per user policies? No, one SSL key protecting everyone like a generic website. Ohhh.... Definitely foresight on my part when I avoided that and similar services. Not to mention I thought they'd 0-day the servers. Still not sure why they didnt. You dont need US government in your threat profile to know top notch hackers like Chinese, Russians, and Israelis might target you to see who you're hiding with "bank style" security. Note: I protect my Hacker News posts with bank-grade security. I require a login, name, and HTTPS on all posts. I feel safer already.
• skylan_q 11y ago
  It wouldn't be gov't if that isn't exactly what they did.
• fleitz 11y ago
  Even though I very much agree with lavabit I think it's more honest to construe it as the owner decided to shutter the business rather than comply with the spirit of the order.
  • tobltobs 11y ago
    If you force a company, which sells encryption, to break this encryption for all existing customer, you pretty much destroy this company. What the owner finally does, doesn't matter anymore.
    • nxzero 11y ago
      Sadly, if the owner had decided to comply, their customers wouldn't have known. Lucky this didn't happen.
• noir_lord 11y ago
  As someone watching the IP bill go through the UK parliament closely I have a horrible feeling we'll be doing the same shortly (if we aren't already). Seems to be an all out assault by the 'leadership' of a lot of western countries at the moment.
  • lioeters 11y ago
    So much so that one might be led to suspect a coordinated effort, or a "conspiracy"? It's not only western countries, Japan for example is eagerly part of the program.
    • noir_lord 11y ago
      Possibly a ad-hoc conspiracy, at that level they all talk to each other and watch what they are doing, the permanent political class is a problem for all democracies I think.
      • lioeters 11y ago
        I suppose that's kind of what I had in mind when I wrote "conspiracy" in quotes. I don't mean secret societies (nor to rule that out either) - but it seems pretty clear that some groups are seeking to extend their power and it's a coordinated effort.
• tptacek 11y ago
  "Lavabit has developed a system so secure that it prevents everyone, even us, from reading the email of the people that use it." That's the entire unique selling proposition of this American business (and a direct quote from their website), and it was a bald-faced lie. The DOJ didn't "destroy" this business; it revealed it for the sham it was. It could have continued operating long after DOJ remanded its keys; it was no less secure after than it was before.
  • ghshephard 11y ago
    If I understand what you are saying, then the same could be said about the iPhone 5C - that it was built with a backdoor/security flaw - the ability to install a new OS without passcode that will allow brute forcing simple 4-digit passcode.
    • pcwalton 11y ago
      You could use a secure password in lieu of the 4-digit one, though, couldn't you? My understanding was that the software running on the device to enforce the retry limit functioned as a backup measure against passcodes vulnerable to brute force in the first place. If the password was strong, the brute force would be futile.
      • ghshephard 11y ago
        Re: Use of complex password would have made iPhone more secure - that's a fair point, but prior to touch ID, more than 4 digit password were pretty rare in reality (I suspect < 1% of users). Apple could have avoided this entirely through putting a delay in hardware that couldn't be changed without the passcode. The nuance I'm trying to get to here - is that the fundamental security flaw / backdoor is already present on the iPhone5C, the FBI is just trying to utilize it. Something as simple as a mandatory hardware-enforced increasing timeout would have made brute-forcing the passcode prohibitively expensive. (50 ms, 100 ms, 250 ms, 500 ms, 1sec, 2sec, 5 sec, 10 sec, 30 sec, 1min, etc...)
  • andrewfree 11y ago