Well Lastpass was just an example. With enough effort any service can be hacked, but if the bar is high enough it means it's more likely that the US gov can't/w

Well Lastpass was just an example. With enough effort any service can be hacked, but if the bar is high enough it means it's more likely that the US gov can't/won't do it en masse. I would note that Lastpass allows you to implement Google Authenticator/Yubikey/One-time-pad/Biometrics to help secure your key against a simple XSS attack. I think that probably qualifies as 'setting the bar high.' In any case, my question was more towards the _legal_ situation, not the technical. Suppose you have a near-perfect no-knowledge system, how does the US gov view that entity? At least in theory, if they cannot reasonably force the company to give up the keys, what can they legally do? Can they force the company to shutdown? Can they make the company force users off the service in an attempt to get them into a less secure realm? Are such systems even legal in the current climate? Of course there is always a way to hack it, and the $5 wrench will beat anything (pun intended), but as far as the mass surveillance mandate goes those options are probably out.