8 ms·
Gag Order on Lavabit’s Levison Lifted
- peterkshultz 10y agoNo surprise here. Snowden knew he was the target as soon as Lavabit got shut down.
- orik 10y agoI think the attack vector (getting ssl/tls keys) the government was going after was a surprise. I had thought they would have requested access to the servers.
- neopallium 10y agoEither they had captured packets from Lavabit that they wanted to decrypt, or they wanted to be able to decrypt all traffic to/from Lavabit. With how much traffic the NSA was collecting and archiving during that time, it is very likely that they had captured traffic that they thought might contain messages to/from Snowden.
- pedrocr 10y agoHopefully Lavabit was using TLS with forward secrecy making this impossible: https://en.wikipedia.org/wiki/Forward_secrecy https://en.wikipedia.org/wiki/Forward_secrecy
- ekianjo 10y agoWhile it's an official confirmation it was already very clearly mentioned several months ago.
- redouane 10y agoalready known, i believe it was leaked due to a non-redaction ( by mistake) of a released document
- gsmethells 10y agoI concur. This is old news.
- imron 10y agoThe gag order being lifted is new news.
- Timothycquinn 10y agoThis news is definitely a win for humanity. Ladar and Edward, we need more people like you. Thank you! For those who dont want to read blog posts on Facebook, here is a well written piece on this: https://techcrunch.com/2016/06/24/ladar-levison-finally-confirms-snowden-was-target-of-lavabit-investigation/ https://techcrunch.com/2016/06/24/ladar-levison-finally-conf...
- joshka 10y agoReplace title with: "Gag Order on Lavabit’s Levison Lifted After Three-Year Battle" perhaps?
- dang 10y agoOk, we'll use that.
- mzarate06 10y agoGreat news of the gag order being lifted, and to hear from Levison himself. Although in regard to the post title (which has since been changed) indicating Snowden was the Lavabit investigation target, here's original discussion from March: https://news.ycombinator.com/item?id=11308160 https://news.ycombinator.com/item?id=11308160
- Steeeve 10y agoWhat year is it? This was widely known a long time ago.
- digler999 10y agoit's the year you should start reading the article before you comment.
- deleted 10y ago[deleted]
- exodust 10y agoThe problem with linking to Facebook posts is that non-Facebook users are now greeted with a "sign in or sign up" pop-over that cannot be removed and obstructs the page. This is a relatively recent change. Facebook do not want to be part of the open web, so don't link to them as if they are.
- captn3m0 10y agoI have a tiny css snippet that hides the nagbar for me: https://github.com/captn3m0/.css/blob/master/facebook.com.css#L89-L92 https://github.com/captn3m0/.css/blob/master/facebook.com.cs...
- RKearney 10y agoThis is a public wall post by the creator of Lavabit himself. Would you rather a random third party news site pick it up first before it is reposted here? I see no problem with Facebook posts if they were created by an authoritative representative of the discussion and that was the primary point of publication (i.e. not a Facebook post pointing to their blog, in which case their blog would be a better place to link to.)
- exodust 10y agoYep and there is nothing wrong with a public wall post up until 2016 when Facebook decided to restrict read-access to those public pages by way of the annoying nag prompt. Clicking "not now" doesn't hide the nag prompt enough to call the page 'publicly accessible'. Sorry to be off-topic on this, but I feel Facebook is quite arrogant with this behavior, as their users should be in control of the public status of their posts, not Facebook.
- jklinger410 10y agoYou're stretching the definitions of "read-access" and "publicly accessible." The word you're looking for is "annoying" which is already implied by "nag prompt."
- 10y ago
- runesoerensen 10y agoAlso https://news.ycombinator.com/item?id=11308160 https://news.ycombinator.com/item?id=11308160
- andrepd 10y agoIt's a bit ironic how a news about such a topic as this is posted on facebook...
- Pyxl101 10y ago> The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. No, not completely true. From what I recall about the case, law enforcement asked Lavabit to eavesdrop on his communications. I recall law enforcement claiming that Lavabit had done this before, previously, when asked. Lavabit balked this time for some particular reason, and ineffectively attempted to fight the request in immature ways. When asked for digital data, printed out a bunch of hex or base64 on many reams of paper. Courts frown on this kind of shenanigans. In this and other ways, Levison engaged with the court in naive, immature, and ineffectual ways, including by appearing in court without representation. By failing to make a number of arguments in his defense at trial, he was consequently unable to revisit most issues on appeal. (You usually cannot raise new issues on appeal.) It was only after Lavabit refused to eavesdrop, after receiving a lawful order to do so, that law enforcement demanded the TLS keys in order to do it themselves. Lavabit's ineffectual handling of the issue alone was what put the privacy of the rest of their users at risk. Lavabit was not a secure service. The site could easily eavesdrop on your communications at will and decrypt your data. The site simply made a promise not to store a key based on the user password (if I'm recalling correctly), but had the technical ability to do so upon each login. Quote from their site: "Lavabit has developed a system so secure that it prevents everyone, even us, from reading the email of the people that use it." The site was not actually secure in the ways that it claimed, specifically the claims that it was secure against site operators reading your data, and as a consequence obviously against law enforcement. Lavabit was poorly designed and dangerously close to snake oil, and I don't think they should be hailed as having done something venerable by privacy or security advocates. They were essentially a regular webmail service with a gimmick that allowed them to claim they were doing something different, without actually doing something that provided a meaningful security guarantee. This critique by Moxie Marlinspike includes a detailed substantiation of my statements above: https://moxie.org/blog/lavabit-critique/ https://moxie.org/blog/lavabit-critique/ > The cryptography was nothing more than a lot of overhead and some shorthand for a promise not to peek. Even though they advertised that they “can’t” read your email, what they meant was that they would choose not to. (Moxie is behind Open Whisper Systems, the end-to-end encryption system that was recently integrated into WhatsApp) There is no way for a webmail provider to ever handle your email in the clear (such as while sending or receiving it) while claiming not to be able to read it. The only way for this to be true is with end-to-end encryption with keys that reside exclusively on client machines. DarkMail, however, which Levison started contributing to after the shutdown of Lavabit, does appear to attempt to provide true end-to-end security for email participants. https://darkmail.info/ https://darkmail.info/
- deleted 10y ago[deleted]
- c-slice 10y agoWhen the court forced him to turn over the SSL private key for lavabit's servers, Ladar submitted the private key in miniscule font on like 30 printed pages. The gov was not pleased. Mad respect for Mr. Levison. Glad to hear the gag was lifted.
- kordless 10y ago> when such opinions are concerned with such a public and controversial issue as state surveillance This is the first rule of state surveillance.
- deleted 10y ago[deleted]
- Asooka 10y agoCopy-paste for people who do not wish to visit facebook: Press Release Gag Order on Lavabit’s Levison Lifted After Three-Year Battle For Immediate Release: June 24, 2016 Alexandria, VA--Lavabit founder Ladar Levison can finally confirm that Edward Snowden was the target of the 2013 investigation, which led to the shutdown of the Lavabit email service. The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. After three years, and five separate attempts, the federal judge overseeing the case has granted Mr. Levison permission to speak freely about investigation. The recently delivered court decision unseals the vast majority of the court filings, and releases Mr. Levison from the gag order, which has limited his ability to discuss the proceedings until now. Mr. Levison has consistently relied on the First Amendment in his court filings, which sought to remove the gag orders entered against him. He argued that such orders are an unconstitutional restraint against speech, and an afront to the democratic process. He plans to use his newfound freedom to discuss the case during a planned presentation on Compelled Decryption at DEF CON 24 in Las Vegas, NV. “One of the rights guaranteed to Americans, and a cornerstone for a functional democracy, is the freedom to speak the truth,” stated Mr. Levison in announcing the court decision. “The First Amendment protects opinions, including those unfavorable to government, from injunctions against speech. The gag orders in this case were a violation of that inalienable right. No American should have to live for three years, gagged, with every word carefully weighed, when such opinions are concerned with such a public and controversial issue as state surveillance. I believe the public only grants permission to be governed when it knows the means and methods its government uses to protect the body politic. While I'm pleased that I can finally speak freely about the target of the investigation, I also know the fight to protect our collective freedom is far from over. That is why I will continue to do everything within my power to protect our right to speak freely and privately.We must decide when speech is necessary. Our rights must never be subject to the whims of those officials we seek to criticize.” In order to continue the fight, Mr. Levison is forming the Lavabit Legal Defense Foundation (or “LavaLegal”), a non-profit organization founded to, among other things, protect service providers from becoming complicit in unconstitutional activities, and fight secret attempts aimed circumventing digital privacy or impinging upon the right of those involved to speak of the experience. The foundation will be funded by donations from people and organizations all over the world that want to help protect digital privacy and bolster our collective defense against government overreach. Donations can be accepted at the foundation’s rally.org page or through bitcoin donations at 1Bqqy3SxZ27ZUogEeiKHYqPsmFwuRTErMu. For more information contact Lavabit founder Ladar Levison or Lavabit’s counsel, Jesse Binnall.