7 ms·

Well, he may not have been able to hand over the old data, but he may have been asked to include an exploit for all mail going forward. That could have been as

Well, he may not have been able to hand over the old data, but he may have been asked to include an exploit for all mail going forward. That could have been as simple as the authorities inserting some middleware.

lawnchair_larry 13y ago
This actually did happen with hushmail. It's hosted in Canada, but the US leaned on them hard enough that they ended up backdooring the client to let the feds snoop on the targeted user.
- computer 13y ago
  Background: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/
- 616c 13y ago
  That is not quite what happened. As the link below says, it was not an exploit. Users were warned that using pure IMAP access and/or webmail, which was a convenience feature and continues to be with them, would require your private key. It was recommended you do not do that, and use the provided Java applet or mobile app. The person in question in those criminal proceedings used one of those convenience functions, if memory serves. Not that defend Hushmail. I do not, fuck 'em for that. There are plenty of services like Lavabit that avoid that problem, but that requires intelligent users/criminals/what-have-you.
  - betterunix 13y ago
    "It was recommended you do not do that, and use the provided Java applet" Which is equally insecure, as the company could easily insert a back door the next time you load the applet. Hushmail was and is snake oil.
    - 616c 13y ago
      For sure, but can I fault idiots for inability to read the documentation and caveats? Maybe, but not really lest most on this site could not "do computers" professionally. Unfortunately, the trust problem you mention is pervasive. It was a signed applet IIRC, but we both requires you trust the original and modified applets from the developer. I am wishing someone released an auto-encrypting PGP service and client, open-sourced on purpose. We all know only four people would read the source of that, and two of those would verify the dev key given with the release. :-)
      - rdl 13y ago
        The correct way to do a signed applet or signed extension is to give the signing key to a third party who has responsibility for auditing it, or at least being "out of the subpoena chain" so when bad stuff happens, they suddenly stop signing new versions. I kind of wish there were a (well armed) organization which did this for other projects.
      - SimHacker 13y ago
        Well, it looks like we got ourselves a reader. http://www.youtube.com/watch?v=BwkdGr9JYmE http://www.youtube.com/watch?v=BwkdGr9JYmE
        616c 13y ago
        Unfortunately, I cannot find a clip of this from the movie Ronin. One of my favorites with Robert DeNiro as a criminal or spy, and not even his own gang of crooks are trusting of him. Among my many favorite quotes (I am reviewing all of them and laughing; the movie is a goldmine [0]): Spence: You think too hard. Sam (DeNiro): Nobody ever told me that before. [0] http://www.imdb.com/title/tt0122690/quotes http://www.imdb.com/title/tt0122690/quotes
        SimHacker 13y ago
        "I'm try'n to think, but nuthin happens!" -Curly Joe http://www.youtube.com/watch?v=WxtW98VSegk http://www.youtube.com/watch?v=WxtW98VSegk
  - Dylan16807 13y ago
    In my eyes a backdoor is a subcategory of exploit. But the term used doesn't matter. The point is that they altered the software used by their clients to not only encrypt emails with the key, but to forward copies to be given to the government. The warning they gave out was to point out lower security, it does not absolve them of the obligation to try to keep their severs secure.
jlgreco 13y ago
Perhaps such a request is why they have shut down?
- chmars 13y ago
  That's reasonable. And while you can get already in trouble for not having stored user data in the past, you cannot really refuse to store user data from now on. Ergo probably this surprise shutdown now … :(
MagicWishMonkey 13y ago
The feds wanted to install a prism device on his network, not sure if he shut everything down to prevent that from happening or if there are other factors at play. The guy who runs the service is one of my best friends. He's the kind of guy who would burn the server farm to the ground before he did something that violated the terms dictated in his privacy policy.
- jlgaddis 13y ago
  If true, you probably shouldn't put these details here (especially mentioning that he's one of your best friends). I was curious to know, of course, but I'm afraid that this could somehow be used against him later.

lawnchair_larry 13y ago

This actually did happen with hushmail. It's hosted in Canada, but the US leaned on them hard enough that they ended up backdooring the client to let the feds snoop on the targeted user.

computer 13y ago
Background: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/
616c 13y ago
That is not quite what happened. As the link below says, it was not an exploit. Users were warned that using pure IMAP access and/or webmail, which was a convenience feature and continues to be with them, would require your private key. It was recommended you do not do that, and use the provided Java applet or mobile app. The person in question in those criminal proceedings used one of those convenience functions, if memory serves. Not that defend Hushmail. I do not, fuck 'em for that. There are plenty of services like Lavabit that avoid that problem, but that requires intelligent users/criminals/what-have-you.
- betterunix 13y ago
  "It was recommended you do not do that, and use the provided Java applet" Which is equally insecure, as the company could easily insert a back door the next time you load the applet. Hushmail was and is snake oil.
  - 616c 13y ago
    For sure, but can I fault idiots for inability to read the documentation and caveats? Maybe, but not really lest most on this site could not "do computers" professionally. Unfortunately, the trust problem you mention is pervasive. It was a signed applet IIRC, but we both requires you trust the original and modified applets from the developer. I am wishing someone released an auto-encrypting PGP service and client, open-sourced on purpose. We all know only four people would read the source of that, and two of those would verify the dev key given with the release. :-)
    - rdl 13y ago
      The correct way to do a signed applet or signed extension is to give the signing key to a third party who has responsibility for auditing it, or at least being "out of the subpoena chain" so when bad stuff happens, they suddenly stop signing new versions. I kind of wish there were a (well armed) organization which did this for other projects.
    - SimHacker 13y ago
      Well, it looks like we got ourselves a reader. http://www.youtube.com/watch?v=BwkdGr9JYmE http://www.youtube.com/watch?v=BwkdGr9JYmE
      - 616c 13y ago
        Unfortunately, I cannot find a clip of this from the movie Ronin. One of my favorites with Robert DeNiro as a criminal or spy, and not even his own gang of crooks are trusting of him. Among my many favorite quotes (I am reviewing all of them and laughing; the movie is a goldmine [0]): Spence: You think too hard. Sam (DeNiro): Nobody ever told me that before. [0] http://www.imdb.com/title/tt0122690/quotes http://www.imdb.com/title/tt0122690/quotes
        SimHacker 13y ago
        "I'm try'n to think, but nuthin happens!" -Curly Joe http://www.youtube.com/watch?v=WxtW98VSegk http://www.youtube.com/watch?v=WxtW98VSegk
- Dylan16807 13y ago
  In my eyes a backdoor is a subcategory of exploit. But the term used doesn't matter. The point is that they altered the software used by their clients to not only encrypt emails with the key, but to forward copies to be given to the government. The warning they gave out was to point out lower security, it does not absolve them of the obligation to try to keep their severs secure.

jlgreco 13y ago

Perhaps such a request is why they have shut down?

chmars 13y ago
That's reasonable. And while you can get already in trouble for not having stored user data in the past, you cannot really refuse to store user data from now on. Ergo probably this surprise shutdown now … :(

MagicWishMonkey 13y ago

The feds wanted to install a prism device on his network, not sure if he shut everything down to prevent that from happening or if there are other factors at play. The guy who runs the service is one of my best friends. He's the kind of guy who would burn the server farm to the ground before he did something that violated the terms dictated in his privacy policy.

jlgaddis 13y ago
If true, you probably shouldn't put these details here (especially mentioning that he's one of your best friends). I was curious to know, of course, but I'm afraid that this could somehow be used against him later.