> The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect

> The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. No, not completely true. From what I recall about the case, law enforcement asked Lavabit to eavesdrop on his communications. I recall law enforcement claiming that Lavabit had done this before, previously, when asked. Lavabit balked this time for some particular reason, and ineffectively attempted to fight the request in immature ways. When asked for digital data, printed out a bunch of hex or base64 on many reams of paper. Courts frown on this kind of shenanigans. In this and other ways, Levison engaged with the court in naive, immature, and ineffectual ways, including by appearing in court without representation. By failing to make a number of arguments in his defense at trial, he was consequently unable to revisit most issues on appeal. (You usually cannot raise new issues on appeal.) It was only after Lavabit refused to eavesdrop, after receiving a lawful order to do so, that law enforcement demanded the TLS keys in order to do it themselves. Lavabit's ineffectual handling of the issue alone was what put the privacy of the rest of their users at risk. Lavabit was not a secure service. The site could easily eavesdrop on your communications at will and decrypt your data. The site simply made a promise not to store a key based on the user password (if I'm recalling correctly), but had the technical ability to do so upon each login. Quote from their site: "Lavabit has developed a system so secure that it prevents everyone, even us, from reading the email of the people that use it." The site was not actually secure in the ways that it claimed, specifically the claims that it was secure against site operators reading your data, and as a consequence obviously against law enforcement. Lavabit was poorly designed and dangerously close to snake oil, and I don't think they should be hailed as having done something venerable by privacy or security advocates. They were essentially a regular webmail service with a gimmick that allowed them to claim they were doing something different, without actually doing something that provided a meaningful security guarantee. This critique by Moxie Marlinspike includes a detailed substantiation of my statements above: https://moxie.org/blog/lavabit-critique/ https://moxie.org/blog/lavabit-critique/ > The cryptography was nothing more than a lot of overhead and some shorthand for a promise not to peek. Even though they advertised that they “can’t” read your email, what they meant was that they would choose not to. (Moxie is behind Open Whisper Systems, the end-to-end encryption system that was recently integrated into WhatsApp) There is no way for a webmail provider to ever handle your email in the clear (such as while sending or receiving it) while claiming not to be able to read it. The only way for this to be true is with end-to-end encryption with keys that reside exclusively on client machines. DarkMail, however, which Levison started contributing to after the shutdown of Lavabit, does appear to attempt to provide true end-to-end security for email participants. https://darkmail.info/ https://darkmail.info/