10 ms·
Is there any person as trustworthy as Ladar Levison for a service like email or chat? To my knowledge, he is one of the few that has gone to the mat for his us
by codehusker 10y ago
Is there any person as trustworthy as Ladar Levison for a service like email or chat?
To my knowledge, he is one of the few that has gone to the mat for his users.
- MaymayMaster 10y agoVincent Canfield
- psybin 10y agoThe owner of Cock Mail / cock.li is at least completely realistic with what can be expected from an email provider. Goofy domain names aside, being completely frank about privacy and security realities is what you want.
- SSLy 10y agosadly he seems MIA.
- psybin 10y agoHe has a phone number, go call him.
- pvg 10y agoA good way to regain and build trust with users would have been to acknowledge his previous mistakes. Then at least you could say "he's been around the block, done it wrong and learned how to do it right". Instead, he writes: "In August 2013, I was forced to make a difficult decision: violate the rights of the American people and my global customers or shut down. I chose Freedom." That isn't what happened. He chose to build and sell a supposedly secure email service that was fundamentally vulnerable to government intrusion. He then decided to play chicken with the USG over a warrant no different than ones he'd complied with previously. The completely pointless escalation forced him to compromise all of his users, something the government had not been asking for. He then shut the service down. There are a lot of ways to describe this but 'I chose Freedom' without any acknowledgment of his previous mis-steps is both misleading and shameless. I wouldn't buy supposedly secure services from him.
- ycmbntrthrwaway 10y ago> The completely pointless escalation forced him to compromise all of his users How has he compromised all of his users? The service was shut down and emails kept encrypted. Am I missing something?
- pvg 10y agoHe gave up the cert, there was no PFS-only configuration, plus, presumably the FBI got to do their surveillance except instead of the target's email, they could read everyone's. So no, you are not right.
- ycmbntrthrwaway 10y agoI was not aware he gave up the cert in the end. Thought he just closed website without disclosing TLS cert. Now it looks way worse than I imagined. Anyway, I really hope that it leads to adoption of backward-compatible and secure email protocols. Server encryption can't be trusted anymore anyway, we need end-to-end encryption.
- pvg 10y agoThe business with the cert was just the final outcome. The initial mistake was making and selling snake oil. It is possible for someone to innocently do this, out of inexperience and ignorance. Over time, though, it's become increasingly clear Ladar Levison is just a snakeoil salesman who misled his users. He's never acknowledged he did anything wrong. Don't fall for his posturing about 'Freedom'.
- jevinskie 10y agoHere is an article about that: https://www.techdirt.com/articles/20131002/17443624734/lavabit-tried-giving-feds-its-ssl-key-11-pages-4-point-type-feds-complained-that-it-was-illegible.shtml https://www.techdirt.com/articles/20131002/17443624734/lavab...
- Spone 10y ago
- deleted 10y ago[deleted]
- berry_sortoro 10y agoWell AFTER all this happened I would sure call Ladar trustworthy. Before that, not so much https://moxie.org/blog/lavabit-critique/ https://moxie.org/blog/lavabit-critique/ He was was advertising a false sense of security to people and even snowden trusted him but as moxie explains very well that it was basically not was all thought it was. The claim "we can't read your stuff" was simply wrong.
- geofft 10y agoHe didn't go to the mat for his users. He built a service that he knew was vulnerable to standard legal process (or if he didn't, he was amazingly incompetent) but sold it as if it were safe from the government, duping even Edward Snowden. The government, naturally, engaged in standard legal process, and found that he possessed a key that would give the government access to everything they needed, and that he was capable of turning it over. So he was ordered to turn it over, which should have surprised no one. He did surrender the key, although by printing out the key in 4-point font (unclear if he was buying time, or just thought contempt charges sounded fun). After the government pressed him harder, he shut down the service days later. He didn't disclose that he had surrendered the key; the public found out when the court documents, including the key itself, were unsealed. If something can't be done securely, don't tell your users that it can be done securely. If you know you can't win, there's honor in refusing to lose without a fight. But there's no honor in first promising people that you'll win, and there's quite a bit of dishonor in asking people to pay you to win. Lavabit v1 should never have been built. Many people were technically qualified to build something like it it (it's email, which constrains the design significantly), had the resources, and chose not to. The fact that Levison built it, and that he hasn't apologized for building it, demonstrates that he's untrustworthy. This is not to say that he's a bad person; everyone makes mistakes, and I wouldn't trust myself to build a secure email service singlehandedly, because I know what mistakes I've made and what sort of personality flaws I have. It's just a statement that the required level of trust is extremely high, and Levison hasn't demonstrated it. Lavabit v2's "Trustful" mode has all of the same flaws as Lavabit v1. He writes about his "free and open source server" and asks how you feel about "trusting our servers," when that was never the problem. If you can magically make sure that the government doesn't have access to your system, a standard unencrypted email server will do just fine. If you can't, they'll issue the exact same legal order to Lavabit v2 that they did to v1, and it'll be just as effective.
- curun1r 10y agoIf Edward Snowden started a mail service, I'd probably trust it more. If you want to talk about "going to the mat" for people, I think Snowden has made the bigger sacrifice. Moxie and Whisper Systems probably would get my nod too. Perhaps even DJB or Bruce Schnier.
- pvg 10y agoSnowden is not a security expert nor a cryptographer. He used Cryptocat and Lavabit, for instance - he was (like most people) unable to independently assess the quality of their security guarantees and believed their claims.
- nyolfen 10y agohe has said that he used pgp in his emails with poitras and greenwald because he knew from personal experience that, properly implemented, nsa was unable to decrypt messages protected with it
- pvg 10y agoAre you saying he didn't use Lavabit and Cryptocat?
- gardnr 10y agoI think nyolfen probably meant to start their comment with "yes and". Maybe you should try some meditation or exercise to help you relax.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- ycmbntrthrwaway 10y agoHe used PGP over Lavabit. So even though Lavabit was compromised, content of his emails is secure.
- msh 10y agoPhil Zimmermann He went to prison over pgp. But then the mail service he was involved in (silent circle mail) shut down at the same time as lavabit.