3 ms·

The corollary is that Hushmail is a shitty service. A good service for private e-mail should make it impossible for the server administrators to see what is goi

by marvin 14y ago

The corollary is that Hushmail is a shitty service. A good service for private e-mail should make it impossible for the server administrators to see what is going on. Obviously that checkbox should make any user that needs real security turn around in the door. I've never used Hushmail, but I assumed "secure e-mail" == "none of my information touches the server in plaintext". So this comment is quite interesting.

SageRaven 14y ago
Supposedly lavabit.com is (from the admin perspective) about as close to zero knowledge as it gets. Logs are kept for a minimum to diagnose abuse/performance issues, and crypto keys are strictly between the user and server. As I understand it, the only legal compromise would be a national security letter style gag order to alter the binary that interfaces the client (be it Outlook, your phone, or the web-mail host) to the back-end data store, which is stored encrypted on disk. Security flaws are another thing entirely. I have no idea if anyone, aside from internal developers, has vetted the system for flaws that typically result in server compromises. I was a satisfied free user some years ago, and the above was my understanding of the service after a few pointed queries to the support address.
- noibl 14y ago
  > alter the binary that interfaces the client Which, in case it's not clear, is exactly what Hushmail did/does. http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator-bolts-to-hush.html?showComment=1309018784191#c7610754517237372617 http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator...
  - SageRaven 14y ago
    The main difference being that the modification was code sent to, and then executed by, the end-user's browser in the form of a Java applet. I personally believe that Lavabit (a tiny company composed of a few dedicated folks) would rather shut down service than do something as underhanded as what Hushmail did. In either case, the end user is relying on a proprietary system/company to fight the good fight for them, which is foolhardy if your well being is on the line. Those in need of strong privacy would probably use PGP+tor for communication anyway.
    - noibl 14y ago
      You said '(be it Outlook, your phone, or the web-mail host)'. I was just providing a relevant historical example to support your point. (Lavabit does have a webmail interface.) FWIW, the Hushmail ex-CEO seems to strongly agree with you on both the ethics point and the need for users to take blind trust out of the security equation. --- So I've just gone to the Lavabit site and it looks like that they store your private key on the server.[1] That doesn't strike me as being more secure than Malone's idea of externally-audited client-side crypto. But then, as you say, you've arrived at PGPGPG. The fact, then, that Zimmerman was involved with the company so early on and they still fucked it up just goes to show that faith in the efforts of 'a few dedicated folks' doesn't get you very far. [1] http://lavabit.com/secure.html http://lavabit.com/secure.html
napoleond 14y ago
The realities of the browser environment make it impossible to do what you describe. It's been possible with native clients for a long time, but has always been pretty cumbersome for non-geeks--I've been working on a native client solution that would be easy for non-geeks to use and provide a few different levels of security (which come with varying levels of convenience) that are all better than the "plain-text everywhere" option most people use now. I posted a link to this yesterday and don't mean to spam, but the topic has come up a few times in the past day, so: http://parley.co http://parley.co
- noibl 14y ago
  > http://parley.co http://parley.co Excellent writeup. It really helps when the conversation is steered away from terms like 'amendment', 'advertisers', 'enforcement', 'criminality' and steered back to the central idea of recovering and safeguarding an intuitive and traditional idea of privacy in personal communication (postcard analogy). Lots of people, many with vested interests, insist that this isn't possible, that the genie is out of the bottle. But let's at least try, right? In fact, PGP was a neat solution for the internet of the '90s with its quaint directory services (Bigfoot, anyone?) and dialup links. I think it had Pretty Good uptake too. So I'm very interested to see what can be done in today's environment. (Your exchange with jmillikin looked promising too. Did it continue?)
  - napoleond 14y ago
    Thanks noibl, that's very generous of you. Besides being as self-conscious as anyone might be when publishing a bit of writing, I knew that I was writing for two separately critical audiences (computer security experts and those who would tend to brush off most privacy advocates as unnecessarily alarmist) which made it considerably more daunting. You put it quite well yourself, though: let's at least try. The defeatist attitude many people take toward privacy (and I'll be the first to admit, I do it too sometimes) is at least as concerning to me as the privacy challenges themselves, but I really do believe we stand a fighting chance on both fronts. My exchange with jmillikin didn't continue, unfortunately, but I really do want to discuss exactly what we're building with anyone who will listen--there will be more information on the website soon enough but I would love for anyone who reads this to email me any time. My email is in my profile.

by marvin 14y ago

SageRaven 14y ago

Supposedly lavabit.com is (from the admin perspective) about as close to zero knowledge as it gets. Logs are kept for a minimum to diagnose abuse/performance issues, and crypto keys are strictly between the user and server. As I understand it, the only legal compromise would be a national security letter style gag order to alter the binary that interfaces the client (be it Outlook, your phone, or the web-mail host) to the back-end data store, which is stored encrypted on disk. Security flaws are another thing entirely. I have no idea if anyone, aside from internal developers, has vetted the system for flaws that typically result in server compromises. I was a satisfied free user some years ago, and the above was my understanding of the service after a few pointed queries to the support address.

noibl 14y ago
> alter the binary that interfaces the client Which, in case it's not clear, is exactly what Hushmail did/does. http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator-bolts-to-hush.html?showComment=1309018784191#c7610754517237372617 http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator...
- SageRaven 14y ago
  The main difference being that the modification was code sent to, and then executed by, the end-user's browser in the form of a Java applet. I personally believe that Lavabit (a tiny company composed of a few dedicated folks) would rather shut down service than do something as underhanded as what Hushmail did. In either case, the end user is relying on a proprietary system/company to fight the good fight for them, which is foolhardy if your well being is on the line. Those in need of strong privacy would probably use PGP+tor for communication anyway.
  - noibl 14y ago
    You said '(be it Outlook, your phone, or the web-mail host)'. I was just providing a relevant historical example to support your point. (Lavabit does have a webmail interface.) FWIW, the Hushmail ex-CEO seems to strongly agree with you on both the ethics point and the need for users to take blind trust out of the security equation. --- So I've just gone to the Lavabit site and it looks like that they store your private key on the server.[1] That doesn't strike me as being more secure than Malone's idea of externally-audited client-side crypto. But then, as you say, you've arrived at PGPGPG. The fact, then, that Zimmerman was involved with the company so early on and they still fucked it up just goes to show that faith in the efforts of 'a few dedicated folks' doesn't get you very far. [1] http://lavabit.com/secure.html http://lavabit.com/secure.html

napoleond 14y ago

The realities of the browser environment make it impossible to do what you describe. It's been possible with native clients for a long time, but has always been pretty cumbersome for non-geeks--I've been working on a native client solution that would be easy for non-geeks to use and provide a few different levels of security (which come with varying levels of convenience) that are all better than the "plain-text everywhere" option most people use now. I posted a link to this yesterday and don't mean to spam, but the topic has come up a few times in the past day, so: http://parley.co http://parley.co

noibl 14y ago
> http://parley.co http://parley.co Excellent writeup. It really helps when the conversation is steered away from terms like 'amendment', 'advertisers', 'enforcement', 'criminality' and steered back to the central idea of recovering and safeguarding an intuitive and traditional idea of privacy in personal communication (postcard analogy). Lots of people, many with vested interests, insist that this isn't possible, that the genie is out of the bottle. But let's at least try, right? In fact, PGP was a neat solution for the internet of the '90s with its quaint directory services (Bigfoot, anyone?) and dialup links. I think it had Pretty Good uptake too. So I'm very interested to see what can be done in today's environment. (Your exchange with jmillikin looked promising too. Did it continue?)
- napoleond 14y ago
  Thanks noibl, that's very generous of you. Besides being as self-conscious as anyone might be when publishing a bit of writing, I knew that I was writing for two separately critical audiences (computer security experts and those who would tend to brush off most privacy advocates as unnecessarily alarmist) which made it considerably more daunting. You put it quite well yourself, though: let's at least try. The defeatist attitude many people take toward privacy (and I'll be the first to admit, I do it too sometimes) is at least as concerning to me as the privacy challenges themselves, but I really do believe we stand a fighting chance on both fronts. My exchange with jmillikin didn't continue, unfortunately, but I really do want to discuss exactly what we're building with anyone who will listen--there will be more information on the website soon enough but I would love for anyone who reads this to email me any time. My email is in my profile.