4 ms·
If Edward Snowden started a mail service, I'd probably trust it more. If you want to talk about "going to the mat" for people, I think Snowden has made the bigg
by curun1r 10y ago
If Edward Snowden started a mail service, I'd probably trust it more. If you want to talk about "going to the mat" for people, I think Snowden has made the bigger sacrifice.
Moxie and Whisper Systems probably would get my nod too. Perhaps even DJB or Bruce Schnier.
- pvg 10y agoSnowden is not a security expert nor a cryptographer. He used Cryptocat and Lavabit, for instance - he was (like most people) unable to independently assess the quality of their security guarantees and believed their claims.
- nyolfen 10y agohe has said that he used pgp in his emails with poitras and greenwald because he knew from personal experience that, properly implemented, nsa was unable to decrypt messages protected with it
- pvg 10y agoAre you saying he didn't use Lavabit and Cryptocat?
- gardnr 10y agoI think nyolfen probably meant to start their comment with "yes and". Maybe you should try some meditation or exercise to help you relax.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- ycmbntrthrwaway 10y agoHe used PGP over Lavabit. So even though Lavabit was compromised, content of his emails is secure.
- nommm-nommm 10y agoMoxie is not impressed with lavabit as lavabit's entire security model relied on "we totally promise we won't look at your private key." https://moxie.org/blog/lavabit-critique/ https://moxie.org/blog/lavabit-critique/ >Unlike the design of most secure servers, which are ciphertext in and ciphertext out, this is the inverse: plaintext in and plaintext out. The server stores your password for authentication, uses that same password for an encryption key, and promises not to look at either the incoming plaintext, the password itself, or the outgoing plaintext. >The ciphertext, key, and password are all stored on the server using a mechanism that is solely within the server’s control and which the client has no ability to verify. There is no way to ever prove or disprove whether any encryption was ever happening at all, and whether it was or not makes little difference Anyways, having good inventions doesn't equal having a secure product.
- simplehuman 10y agoMoxie is not impressed with anything other than signal
- pvg 10y agoHe lists two projects unrelated to Signal in the article. There is no mention of Signal.
- ycmbntrthrwaway 10y agoThis one is about old Lavabit. It equals "trustful mode" of the new Lavabit.
- zymhan 10y agoDid you RTFA? You can keep your private key private now, or, like always, just run your own server and not have to worry about ever trusting anyone with anything. Though "Paranoid" mode in DIME seems to accomplish the same thing.
- nommm-nommm 10y agoYeah but the GP was saying that Ladar Levison must have made a trustworthy system because he's Ladar Levison. However, I was pointing out that there was serious issues with the trustworthiness of the original lavabit.