I think it's very valuable for people who might not already now this to see an example of why it's true, as the post does: > "What’s happening here is simple:

I think it's very valuable for people who might not already now this to see an example of why it's true, as the post does: > "What’s happening here is simple: The web application has the ability to decrypt different records encrypted with different keys. If you pass records that were encrypted for Alice to the application to decrypt it for Bob, and you’re not authenticating your access patterns, Bob can read Alice’s data by performing this attack." An interesting question here is whether or not there's a god key that allows the administrator to decrypt all the data even if they can't authenticate as the user (or if they just have copies of all keys). Searching HN for 'lavabits' turns up some results related to this, e.g. https://www.eff.org/press/releases/eff-has-lavabits-back-contempt-court-appeal https://www.eff.org/press/releases/eff-has-lavabits-back-con...