5 ms·

While I understand that Lavabit and others have taken a stand, Im not sure that I would call going out of business fighting. I see this as an NSA victory. If th

by S_A_P 13y ago

While I understand that Lavabit and others have taken a stand, Im not sure that I would call going out of business fighting. I see this as an NSA victory. If they could shut down all of these niche secure email businesses, what option will people have but to use less private alternatives? I would argue that a shut down is exactly what the NSA wanted from lavabit. Of course the flip side is that you don't want to be complicit in aiding the NSA, so the stance is honorable. I do think that it would take a company with the utility Google drawing the line for any traction to occur with the average person. Google would either have to: - suspend operations like the SOPA blackout - put up a fight very publicly to the point where there is so much transparency the NSA has no either back down or to penalize them in a way that would piss people off. Otherwise, this is and will always be a fringe topic.

rhizome 13y ago
A fundamental principle of Judo is, "don't be there when someone wants to hit you."
ge0rg 13y ago
If they could shut down all of these niche secure email businesses, what option will people have but to use less private alternatives? I think Ladar Levison answered that question, implicitly, in his shutdown announcement: "I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States." It is high time to provide secure services hosted in countries without secret surveillance courts, or maybe even in countries where law enforcement has bigger problems to fight than "Internet crime".
- drivingmenuts 13y ago
  Great if you live outside the US, but if you're inside the US, would not the very act of connecting to a foreign secure service automatically make you suspect? There is a much deeper issue here: as Americans, we need to decide how much protection we actually want. One group says everyone is responsible for their own protection, another says everyone needs protecting from everyone else, yet another group says we'll protect you if you don't look to closely behind the curtain, and so on e pluribus ad-infinitum ... Nobody has a good solution, yet. Personally, I don't mind the NSA spying on foreigners (that's their job) and if you're not from the US, I feel like you should have known that was a possibility. What I'd settle for at the moment is more independent oversight by people not intimately connected to the defense industry and less secret courts and judgements that make us look and sound like cartoon banana republic.
  - Sauer_Kraut 13y ago
    While I wouldn't consider the comment down-vote worth as someone else deemed it, I find one part I have to respond to. "if you're not from the US, I feel like you should have known that was a possibility." Known exactly what was a possibility? In another comment I brought up Endgame Systems, here is some of their offerings: 'There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet-analytics package gets you access to a database of Internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million.' When you say 'foreigners' should have known the NSA "doing their thing" so to speak is a possibility, does that include them being exploited, or their stolen financial/personal information on botnets being used by the NSA?
    - drivingmenuts 13y ago
      I think the idea that you can trust any country that is not your own to be up to no good on the internet should be the default state of mind, even the countries that are, in other aspects, considered allies. This should be the mindset for every country and this should be communicated to their users frequently and explicitly: "If you store your data outside our borders, you probably will get screwed in some way." NOTE: Where I said "foreigners" I probably should have written "foreign countries". The term "foreigners" reads a bit offensively on review. As for the "stolen financial/personal information" bit, that's part of the information gathering (and technically, it's not stolen - see the whole argument on copyright). As long as the data is being used for analysis, that's a fair use for a government organization dedicated to spying. If it's being used for financial gain, that's a very grey area dependent on current laws, and if it's being turned over to or collected by private entities operating without oversight, that's just out-of-bounds. Ultimately, the point was that one should be able to trust one's own government to be operating in one's own best interest, but never assume that another government or it's framework of laws will ever be of any help to you. If it is, then you got lucky.
  - adaml_623 13y ago
    Do you mind if the UK, Russian, or Chinese security agencies spy on you? After all that's their job? And by spy I do mean trojan your personal machine and keep you in a database?
- anologwintermut 13y ago
  What country? Most of Europe has worse laws than the US for surveillance of their own subjects (though their secret interpretations of their worse laws as far as we know are better than the US interpretations). What they don't have, because no one does, is restrictions on spying on people outside of their country. We are just as much fair game for the BND(German), DSGE(French),FAPSI/GRU (Russia) as their subjects are to us. Absent massive efficiency advances in multi party computation and fully homomorphic encryption, most of the cloud is antithetical to privacy, no mater where it's hosted.
  - mcovey 13y ago
    The point is to host outside the US because it hurts the US economy and takes their business away. That is the only way to get anything done in America. If it hurts the economy, they will do anything to fix it. Of course the USA is leading the pack on surveillance so if they have to reduce it then the EU countries are free to (and probably will) do so as well.
- rst 13y ago
  Which countries would these be, and how could you be sure? Remember that exceptions to normal judicial procedures might take some form other than a secret court, and can be a whole lot less overt. (And that the governments may be motivated to lie about what they're doing, and whether they exist.)
- mark_l_watson 13y ago
  There are many hosting companies in Iceland - I have been doing some research to see what the options are. Vote with our wallets...
tlb 13y ago
Lavabit probably believes, correctly, that no company can provide secure-against-government email as a service. The only way for two people to communicate securely is with in-person key exchange and dedicated devices running open-source right down to the hardware. By continuing to exist, they create a false illusion of security which is worse than no security at all.
deegles 13y ago
It was a win-win situation. Shut down the service, or get a backdoor into the emails of people who are explicitly trying to keep their communication private. Had lavabit capitulated, we wouldn't know about it.

by S_A_P 13y ago

rhizome 13y ago

A fundamental principle of Judo is, "don't be there when someone wants to hit you."

ge0rg 13y ago

If they could shut down all of these niche secure email businesses, what option will people have but to use less private alternatives? I think Ladar Levison answered that question, implicitly, in his shutdown announcement: "I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States." It is high time to provide secure services hosted in countries without secret surveillance courts, or maybe even in countries where law enforcement has bigger problems to fight than "Internet crime".

drivingmenuts 13y ago
Great if you live outside the US, but if you're inside the US, would not the very act of connecting to a foreign secure service automatically make you suspect? There is a much deeper issue here: as Americans, we need to decide how much protection we actually want. One group says everyone is responsible for their own protection, another says everyone needs protecting from everyone else, yet another group says we'll protect you if you don't look to closely behind the curtain, and so on e pluribus ad-infinitum ... Nobody has a good solution, yet. Personally, I don't mind the NSA spying on foreigners (that's their job) and if you're not from the US, I feel like you should have known that was a possibility. What I'd settle for at the moment is more independent oversight by people not intimately connected to the defense industry and less secret courts and judgements that make us look and sound like cartoon banana republic.
- Sauer_Kraut 13y ago
  While I wouldn't consider the comment down-vote worth as someone else deemed it, I find one part I have to respond to. "if you're not from the US, I feel like you should have known that was a possibility." Known exactly what was a possibility? In another comment I brought up Endgame Systems, here is some of their offerings: 'There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet-analytics package gets you access to a database of Internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million.' When you say 'foreigners' should have known the NSA "doing their thing" so to speak is a possibility, does that include them being exploited, or their stolen financial/personal information on botnets being used by the NSA?
  - drivingmenuts 13y ago
    I think the idea that you can trust any country that is not your own to be up to no good on the internet should be the default state of mind, even the countries that are, in other aspects, considered allies. This should be the mindset for every country and this should be communicated to their users frequently and explicitly: "If you store your data outside our borders, you probably will get screwed in some way." NOTE: Where I said "foreigners" I probably should have written "foreign countries". The term "foreigners" reads a bit offensively on review. As for the "stolen financial/personal information" bit, that's part of the information gathering (and technically, it's not stolen - see the whole argument on copyright). As long as the data is being used for analysis, that's a fair use for a government organization dedicated to spying. If it's being used for financial gain, that's a very grey area dependent on current laws, and if it's being turned over to or collected by private entities operating without oversight, that's just out-of-bounds. Ultimately, the point was that one should be able to trust one's own government to be operating in one's own best interest, but never assume that another government or it's framework of laws will ever be of any help to you. If it is, then you got lucky.
- adaml_623 13y ago
  Do you mind if the UK, Russian, or Chinese security agencies spy on you? After all that's their job? And by spy I do mean trojan your personal machine and keep you in a database?
anologwintermut 13y ago
What country? Most of Europe has worse laws than the US for surveillance of their own subjects (though their secret interpretations of their worse laws as far as we know are better than the US interpretations). What they don't have, because no one does, is restrictions on spying on people outside of their country. We are just as much fair game for the BND(German), DSGE(French),FAPSI/GRU (Russia) as their subjects are to us. Absent massive efficiency advances in multi party computation and fully homomorphic encryption, most of the cloud is antithetical to privacy, no mater where it's hosted.
- mcovey 13y ago
  The point is to host outside the US because it hurts the US economy and takes their business away. That is the only way to get anything done in America. If it hurts the economy, they will do anything to fix it. Of course the USA is leading the pack on surveillance so if they have to reduce it then the EU countries are free to (and probably will) do so as well.
rst 13y ago
Which countries would these be, and how could you be sure? Remember that exceptions to normal judicial procedures might take some form other than a secret court, and can be a whole lot less overt. (And that the governments may be motivated to lie about what they're doing, and whether they exist.)
mark_l_watson 13y ago
There are many hosting companies in Iceland - I have been doing some research to see what the options are. Vote with our wallets...

tlb 13y ago

Lavabit probably believes, correctly, that no company can provide secure-against-government email as a service. The only way for two people to communicate securely is with in-person key exchange and dedicated devices running open-source right down to the hardware. By continuing to exist, they create a false illusion of security which is worse than no security at all.

deegles 13y ago

It was a win-win situation. Shut down the service, or get a backdoor into the emails of people who are explicitly trying to keep their communication private. Had lavabit capitulated, we wouldn't know about it.