4 ms·

Uh didn't Lavabit destroy themselves? They offered an impossible product and refused to comply with lawful (and not unreasonable) court orders. They essentially

Uh didn't Lavabit destroy themselves? They offered an impossible product and refused to comply with lawful (and not unreasonable) court orders. They essentially lied about what they were capable of. Hint: If you're receiving SMTP from the world, you always have access to the content of that email. Even if you think you're clever by encrypting it "right away".

taneq 11y ago
They promised secure communications and when the government made it impossible for them to legally continue to offer that service, they shut down rather than betray their users. As far as I can see, they delivered on their promise.
- nickpsecurity 11y ago
  No, he promised secure communications, developed a dumb design that tied all users to one secret, and folded rather than divulge it. Fortunately, others learned from his mistake in designing better services.
  - taneq 11y ago
    In hindsight, yes. It's possible (although seems naive these days) that he didn't actually believe he had to count his own government as hostile.
    - nickpsecurity 11y ago
      No, in foresight. It was so dumb that secure messaging from 80's and 90's did better in various ways. High assurance already settled on proxies, guards, and per message crypto due to many attacks possible. Hushmail put the needed functionality in an applet to avoid relying on just web tech. Then, there was Lavabit founder acting snobby talkinv about how he used same security as banks. What might that be? HSM's for keys, link encryption, and per user policies? No, one SSL key protecting everyone like a generic website. Ohhh.... Definitely foresight on my part when I avoided that and similar services. Not to mention I thought they'd 0-day the servers. Still not sure why they didnt. You dont need US government in your threat profile to know top notch hackers like Chinese, Russians, and Israelis might target you to see who you're hiding with "bank style" security. Note: I protect my Hacker News posts with bank-grade security. I require a login, name, and HTTPS on all posts. I feel safer already.
      - taneq 11y ago
        You make a lot of good points. Have a bank-grade-security upvote.
        nickpsecurity 11y ago
        I appreciate it lol.
- MichaelGG 11y ago
  Wikipedia says Lavabit complied with previous search orders. They just chose to take a stand. They did not create a secure communications platform. Any email sent to a user would be delivered plaintext (SMTP), and nothing stopped Lavabit from intercepting that info other than them saying so. This is why (afaik) Silent Circle stopped offering their "secure" email system, because Lavabit made it clear that such a service is not really secure. As a side note, Snowden also used Cryptocat so the fact he used Lavabit isn't necessarily a positive endorsement.
SixSigma 11y ago
If I receive plain text and then encrypt it with the public key of the receiver I can no longer decrypt it myself. I have no idea about how Lavabit operated but that's the service I would offer. With SSL only on the incoming port then interception is in the hands of the sender (modulo errors in SSL).

taneq 11y ago

They promised secure communications and when the government made it impossible for them to legally continue to offer that service, they shut down rather than betray their users. As far as I can see, they delivered on their promise.

nickpsecurity 11y ago
No, he promised secure communications, developed a dumb design that tied all users to one secret, and folded rather than divulge it. Fortunately, others learned from his mistake in designing better services.
- taneq 11y ago
  In hindsight, yes. It's possible (although seems naive these days) that he didn't actually believe he had to count his own government as hostile.
  - nickpsecurity 11y ago
    No, in foresight. It was so dumb that secure messaging from 80's and 90's did better in various ways. High assurance already settled on proxies, guards, and per message crypto due to many attacks possible. Hushmail put the needed functionality in an applet to avoid relying on just web tech. Then, there was Lavabit founder acting snobby talkinv about how he used same security as banks. What might that be? HSM's for keys, link encryption, and per user policies? No, one SSL key protecting everyone like a generic website. Ohhh.... Definitely foresight on my part when I avoided that and similar services. Not to mention I thought they'd 0-day the servers. Still not sure why they didnt. You dont need US government in your threat profile to know top notch hackers like Chinese, Russians, and Israelis might target you to see who you're hiding with "bank style" security. Note: I protect my Hacker News posts with bank-grade security. I require a login, name, and HTTPS on all posts. I feel safer already.
    - taneq 11y ago
      You make a lot of good points. Have a bank-grade-security upvote.
      - nickpsecurity 11y ago
        I appreciate it lol.
MichaelGG 11y ago
Wikipedia says Lavabit complied with previous search orders. They just chose to take a stand. They did not create a secure communications platform. Any email sent to a user would be delivered plaintext (SMTP), and nothing stopped Lavabit from intercepting that info other than them saying so. This is why (afaik) Silent Circle stopped offering their "secure" email system, because Lavabit made it clear that such a service is not really secure. As a side note, Snowden also used Cryptocat so the fact he used Lavabit isn't necessarily a positive endorsement.

SixSigma 11y ago

If I receive plain text and then encrypt it with the public key of the receiver I can no longer decrypt it myself. I have no idea about how Lavabit operated but that's the service I would offer. With SSL only on the incoming port then interception is in the hands of the sender (modulo errors in SSL).