24 ms·

Lavabit Founder Says He Had ‘Obligation’ to Shut Service

231 points by bmmayer1 13y ago

betterunix 13y ago
I am more concerned about this: "Lavabit had complied with 'narrowly tailored' court orders for user information on at least two dozen occasions in the past" In other words Lavabit is not any better than Hushmail. Lavabit did not base its security on cryptography, it based on it trusting the people who worked for the company. Cryptography was just a side show, just like with Hushmail, because Lavabit could get the plaintexts whenever someone working there wanted (or whenever they were compelled to do so by a government, criminal organization, etc.).
- stevenrace 13y ago
  Note that 'encrypted storage' was only for paid accounts. It's unclear if these orders related to paying customers or not. While cited as an 'encrypted' email service, it apparently operated as a normal (web)mail server by default.
- acqq 13y ago
  I don't think so. He based his service on the premise that he didn't have the keys o the encryption, and I can imagine he was able to respond to the requests "this is what I have." Specifically, as the service customers paid for, he was able to give, for example, the name and the credit cards of the specific investigated customers if he billed them directly. But it is OK, there were narrow court orders, everybody is expected to get and respond to such. What happened now must be different. Otherwise, why would he decide to do what he did now? BTW it's a really nice article, gives a nice personal side to the whole story.
  - betterunix 13y ago
    Your theory is wrong. Here is the warrant Lavabit complied with: http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.236204/gov.uscourts.mdd.236204.docket.html http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.2362... Take a quick look at attachment B and you'll see that Lavabit was asked to provide the plaintext message bodies and attachments of emails sent by the user. This was not a demand for metadata, it was a demand for messages, and it was a demand that Lavabit complied with.
    - acqq 13y ago
      Do we know the user was the one who paid for the service? I understood only those had the stored e-mails encrypted. Otherwise, free users had only clear text, and the e-mails in transit which happened after the order were also in clear before they were encrypted, so Lavabit simply had to provide such, for those they weren't able to say "we can't."
      - betterunix 13y ago
        Lavabit could almost never claim to be unable to provide plaintexts. In the worst case they would only need to wait for the user to log in again, or perhaps to just brute force the user's password (this does actually work, even for seemingly hard-to-guess passwords). This is really not any different from Hushmail.
        acqq 13y ago
        Lavabit wouldn't be these that bruteforce the passwords. We all know who's in charge for such things. That they earlier provided what they had is to be expected, those were normal court orders, as you were able to prove by linking to them. What happend now must have been something significantly different to make the owner shutting down the company. The owner is not even allowed to say what, which is directly against the First amendment. That's really a huge issue. Please don't keep trying to distract from that by mixing up the normal court orders with what's going on now. Thanks in advance.
        betterunix 13y ago
        While there may be legal and policy differences between "normal" court orders and PRISM, the only technical difference is the scale. If Lavabit could respond to "normal" court orders, then they could have participated in PRISM. Lavabit's users are lucky that the company's founder took a stand for their privacy rights; he could have just gone the other way and kept a record of all their passwords / secret keys / etc. Of course Lavabit would not be the one brute forcing the passwords. That is not the point. The point is that the security of Lavabit is a matter of the user's password, and only in the best case where the user does not log in. Ultimately Lavabit's security is a matter of the trustworthiness of Lavabit's employees, not the size of your key; it is marginally related to the strength of your password, but only under very specific circumstances. The fact that cryptography is being used somewhere in the system is a distraction. If instead of the US government showing up with a court order it had been a Chinese spy sending business secrets back to the Chinese government, would you still be defending Lavabit?
- kaonashi 13y ago
  They could have handed over encrypted files, is there something to suggest they handed over plaintext messages?
  - AsymetricCom 13y ago
    It is more likely, he modified the site to give the targeted individuals a different front-end that would capture the keys. OSPF
- jmillikin 13y ago
  Lavabit was hosted webmail, and therefore inherently dependent on the host not being evil. It is not possible to construct a hosted webmail service that is safe against a malicious/compromised host. The phrase "user information" is vague; it could include timestamps of all requests from a particular IP, for example. Given that he was willing to shut down his sole source of income on principle, I'm willing to believe that he had reasonable crypto in place to protect user data at rest. Cryptography was just a side show, just like with Hushmail, because Lavabit could get the plaintexts whenever someone working there wanted (or whenever they were compelled to do so by a government, criminal organization, etc.). Assuming good faith and a reasonable storage implementation, it is possible that Lavabit is not capable of providing plaintext messages on demand. I heard somewhere that messages were stored with a key derived from the user's password; if true, then a warrant for johndoe@lavabit.com might not be fulfillable until after the next successful login from johndoe@.
  - betterunix 13y ago
    "The phrase "user information" is vague; it could include timestamps of all requests from a particular IP, for example." Sure, but this warrant makes it pretty clear that the government was seeking message bodies, attachments, etc.: http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.236204/gov.uscourts.mdd.236204.docket.html http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.2362... "I heard somewhere that messages were stored with a key derived from the user's password; if true, then a warrant for johndoe@lavabit.com might not be fulfillable until after the next successful login from johndoe@." ...or to try brute forcing the password offline, which has a reasonable probability of working. Either way, it is not any different than the situation with Hushmail, and I would put both squarely in the "snake oil" category.
    - dalke 13y ago
      Lavabit had two account types. The no-cost one stored the messages unencrypted and the for-fee one stored the messages encrypted. You have not established that that warrant was for accounts of the second type. You have not established that the contents of the DVD were readable by the authorities. You have not established that the type of person who would have a Lavabit account would be the type of person who would choose a password which has "a reasonable probability" of being brute-forced in under a decade.
- nilved 13y ago
  No, that isn't the case. Lavabit's emails were encrypted on the server for paying users, and only if enabled by them. In a case where one of those users (whose numbers were less than 2000) had their data subpoenaed, Lavabit would be unable to do so without MITMing themselves in a way that grabbed the plaintext password in transit. Since that didn't happen (why would he close the site when he was asked to do it again?) we can surmise that the only data that was given over was free users and only when compelled by the government.
  - betterunix 13y ago
    ...how is that different from Hushmail?
    - nilved 13y ago
      The difference is that Hushmail sold out and did perform the password sniffing. Lavabit shut down instead.
      - betterunix 13y ago
        Is there some reason to think that Lavabit was not grabbing user passwords in any of the 24 warrants they complied with prior to shut down?
        Dylan16807 13y ago
        Because a warrant can't force you to log something you never logged, and he doesn't seem like the kind of person that would sell out when he didn't have to, and then shut down when forced to sell out. Why do you assume he's a lying bastard like the people at hushmail?
        ds9 13y ago
        Actually, I read about a case (US) where the court ruled that a service operator had to turn on logging. The rationale was that the required data existed on the server, albeit only transitorily in memory, and therefore was "in possession" and therefore subject to seizure with a warrant. This was maybe a year or two ago. Sorry I don't recall enough, or have time to look this up. It may have been a lower court decision, subject to appeal. This is really the point that bothers me - if the NSL type of thing is now going to extend to removing the right of server operators to decide what code will or won't run, then this campaign against citizens being able to communicate privately shifts from "design a non-tappable service" to more like a whack-a-mole situation with only transitory, small scale possibilities of private communication being available. Edit: also this: https://news.ycombinator.com/item?id=6208631 https://news.ycombinator.com/item?id=6208631
- andrewcooke 13y ago
  https://www.hnsearch.com/search#request/all&q=tptacek+javascript+crypto&start=0 https://www.hnsearch.com/search#request/all&q=tptacek+javasc...
- MagicWishMonkey 13y ago
  You are wrong. For one thing, Ladar is the only person at Lavabit with access to the servers or hosting environment. Absolutely no one could access the plain text version of anything (password or email contents) without the password to an account, because all data for a specific user is encrypted using a key that is stored as an encrypted string in the database, without the account password the key cannot be decrypted. Now, it would be possible for him to have installed software to intercept the password for a specific user when they authenticate, I have no idea if he ever had to do that. I do know that he's obligated by law to comply with court orders, you can't just refuse to cooperate if federal officials give you a warrant, if you don't cooperate they will throw you in jail until you change your mind. Those rules apply to every American company, not just Lavabit.
- aqme28 13y ago
  There's a huge gap between complying with a legitimate warrant (read: narrow, reasonable, justifiable) and a general warrant.
  - betterunix 13y ago
    Not as far as the security of the system is concerned. If you can comply with one then you can technically comply with the other, and the users are at the mercy of your decision on that matter.
    - mpyne 13y ago
      But that's just it. Some users would not mind a service that can be ordered to comply with a particularized and specific warrant. Not everyone's threat model includes what your threat model includes, so as long as users are aware of that going into it then let the user decide.
      - betterunix 13y ago
        How do you design a service that can comply with a specific warrant but which cannot: 1. Allow a hacker to read your messages by attacking the mail server? 2. Allow a spy to read your messages by gaining employment with the service provider? 3. Comply with a broad, non-specific warrant?
        mpyne 13y ago
        You can't. That's why trust comes into play. Even if you can design such a system, you must still trust the implementer to get it right, and in the case of email, trust the receiver not to do anything stupid with the cleartext.
        sophacles 13y ago
        1. This is a different issue. You can't design a service that doesn't comply with a specific warrant and guarantee this. 2. N-part keys go along way for this. No one employee has the ability to do the things for warrant compliance. Yes still gamable, but so is any system. See 1. 3. Shut down when a non specific warrant is received. Have a big red button that kills everything. Make the system so that it deletes everything if more than N warrant accesses occur in M time units. In the worse case, passive agressive compliance that causes big outages, unintentional security leaks, and so on (while implementing the removal of BRB and N/M scheme) would go a long way in making the paranoid move on before following the world.
- mtgx 13y ago
  Only the paid accounts are fully encrypted. The free ones are just like Gmail.
- consultant23522 13y ago
  I think the distinction between providing aid to the FBI (or whoever) for a specific, targeted warrant but telling them to fly a kite when they want access to everyone without reasonable cause is perfectly reasonable from his perspective.
grey-area 13y ago
There's also an interview with the Lavabit founder Ladar Levison and his lawyer over on democracy now (seems to be on the HN banlist): http://www.democracynow.org/2013/8/13/exclusive_owner_of_snowdens_email_service http://www.democracynow.org/2013/8/13/exclusive_owner_of_sno...
- dombili 13y ago
  I did share that link 5 hours ago, maybe it's because of that. https://news.ycombinator.com/item?id=6206623 https://news.ycombinator.com/item?id=6206623
  - gsibble 13y ago
    Your link doesn't appear to work.
    - dombili 13y ago
      That's strange, I can see it just fine. Edit: Tried it on private mode and I couldn't see it either. No clue as to why.
      - zwegner 13y ago
        You have showdead on, it seems...
        dombili 13y ago
        Nope, it's off. Anyway, who cares. The conversation is happening, that's all that matters.
      - PavlovsCat 13y ago
        Maybe it's like hellbans: everybody can see the submission is dead except the submitter. HN, where you're always the last to know ^^
    - deleted 13y ago
jusben1369 13y ago
“I’ve always sort of believed it’s important for Americans to have private conversations with other Americans,” Mr. Levison said in a telephone interview Monday, “and not fear that their conversations were being monitored by the government.” The problem with that is you know your service is going to be used by criminals, child pornography, organized crime, terrorists etc. So if you start this service you know you're going to have to comply with government requests for that data. It seems disingenuous to complain about their requests as though you didn't expect them and that they wouldn't e reasonable. And I think he's saying that in his own way when you get into the details: "Yep, I supported the narrowly defined ones but the broadly defined ones are the straw that broke the camels back"
- rorrr2 13y ago
  If you think this mass surveillance was set up to fight child porn or terrorists, you're extremely naive. It's a power grab. Pure and simple. Those who control this system can easily find dirt on their political/corporate opponents, while being completely immune. They might stop some occasional clueless idiot terrorists or CP distributors, but that's not the end goal, that's just the political theater. You really think terrorists don't properly encrypt their conversations? You really think high-level criminals don't properly encrypt their conversations? Think again.
  - betterunix 13y ago
    "You really think high-level criminals don't properly encrypt their conversations?" Funny story about that: http://www.theregister.co.uk/2006/04/19/mafia_don_clueless_crypto/ http://www.theregister.co.uk/2006/04/19/mafia_don_clueless_c...
    - rorrr2 13y ago
      If you think mafia bosses are high-level criminals, I have news for you. Wall st.
      - veidr 13y ago
akkartik 13y ago
"After his announcement last Thursday, a second company, Silent Circle, based in Maryland, said it would close its secure e-mail service. That company said it had not been served with a government order of any kind. In a pre-emptive bid to protect its customers’ data, Silent Circle said it had obliterated everything in its server." Uh, what? This could almost be the story satirized by this passage from 1911: "A certain German art expert, who had obtained from the municipality of Bergamo permission to inspect the famous masterpiece, declared it to be a spurious Pincini... The editor of an Italian art journal refuted the contentions of the German expert and undertook to prove that his private life did not conform to any modern standard of decency. The whole of Italy and Germany were drawn into the dispute, and the rest of Europe was soon involved in the quarrel. There were stormy scenes in the Spanish Parliament, and the University of Copenhagen bestowed a gold medal on the German expert (afterwards sending a commission to examine his proofs on the spot), while two Polish schoolboys in Paris committed suicide to show what THEY thought of the matter." -- Saki, "The Background" (http://ebooks.adelaide.edu.au/s/saki/clovis/chapter6.html http://ebooks.adelaide.edu.au/s/saki/clovis/chapter6.html)
- notaddicted 13y ago
  It depends what you care about more, the emails or the privacy. The privacy is now ensured, and it isn't like they've erased the emails from the users' minds, only the records of the email.
- harshreality 13y ago
  Uh, what? This could almost be... They're nothing alike. Suppose Silent Circle sent an email to all its users announcing that they would destroy the data on the server in 7 days. It's a good bet the government has accounts on most privacy-advocating web services, simply to keep tabs. That gives the government 7 days to try to get a FISA warrant, or if they think they can get away with it, unilaterally issue a NSL. They would only be able to subpoena a few of the email accounts (or maybe a lot, but certainly not all), but that still breaks the privacy model many people assume given its advertisement as "secure" webmail. Silent Circle didn't want to take the chance, and your hyperbolic parallel notwithstanding, they had good reason to do what they did.
ballard 13y ago
The problem with centralized privacy-as-a-service is the Fed raid problem. In order to be "fed proof," a service must be sufficiently distributed. PS: I'll say what has been said again, Lavabit was so close to being wildly successful, it's a shame that an insecure govt leadership decided to squash a thriving venture. Though it was a likely conclusion because of centralized ownership.
- betterunix 13y ago
  The problem is not limited to any specific government; the problem is that you are doing something inherently insecure when you allow a service provider to generate, store, and utilize your private keys. Exploits by law enforcement are not the only problem -- spies, criminals, etc. can also exploit the weakness.
vpeters25 13y ago
I'm no lawyer but I think Mr. Levinson should lay low and avoid talking to the media. I think he is already in deep trouble, if he keeps talking, he is pretty much challenging federal prosecutors to have him "Swartz'd"
- mtgx 13y ago
  Defy the system. Abusive governments win when everyone shuts up.
- epo 13y ago
  "Levison", perhaps at this point keeping himself public keeps him safe(r).
anovikov 13y ago
An idea for fixing this is having an email provider broken up between several countries that are not expected to cooperate (like U.S., Russia, Equador and Iran) and coded in a way that renders information worthless unless pieces from all parts are used. Then no court order can help.
- anovikov 13y ago
  Correction: better having some redundancy because otherwise a single country can shut down the system (while not steal data).

231 points by bmmayer1 13y ago

I am more concerned about this: "Lavabit had complied with 'narrowly tailored' court orders for user information on at least two dozen occasions in the past" In other words Lavabit is not any better than Hushmail. Lavabit did not base its security on cryptography, it based on it trusting the people who worked for the company. Cryptography was just a side show, just like with Hushmail, because Lavabit could get the plaintexts whenever someone working there wanted (or whenever they were compelled to do so by a government, criminal organization, etc.).

stevenrace 13y ago
Note that 'encrypted storage' was only for paid accounts. It's unclear if these orders related to paying customers or not. While cited as an 'encrypted' email service, it apparently operated as a normal (web)mail server by default.
acqq 13y ago
I don't think so. He based his service on the premise that he didn't have the keys o the encryption, and I can imagine he was able to respond to the requests "this is what I have." Specifically, as the service customers paid for, he was able to give, for example, the name and the credit cards of the specific investigated customers if he billed them directly. But it is OK, there were narrow court orders, everybody is expected to get and respond to such. What happened now must be different. Otherwise, why would he decide to do what he did now? BTW it's a really nice article, gives a nice personal side to the whole story.
- betterunix 13y ago
  Your theory is wrong. Here is the warrant Lavabit complied with: http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.236204/gov.uscourts.mdd.236204.docket.html http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.2362... Take a quick look at attachment B and you'll see that Lavabit was asked to provide the plaintext message bodies and attachments of emails sent by the user. This was not a demand for metadata, it was a demand for messages, and it was a demand that Lavabit complied with.
  - acqq 13y ago
    Do we know the user was the one who paid for the service? I understood only those had the stored e-mails encrypted. Otherwise, free users had only clear text, and the e-mails in transit which happened after the order were also in clear before they were encrypted, so Lavabit simply had to provide such, for those they weren't able to say "we can't."
    - betterunix 13y ago
      Lavabit could almost never claim to be unable to provide plaintexts. In the worst case they would only need to wait for the user to log in again, or perhaps to just brute force the user's password (this does actually work, even for seemingly hard-to-guess passwords). This is really not any different from Hushmail.
      - acqq 13y ago
        Lavabit wouldn't be these that bruteforce the passwords. We all know who's in charge for such things. That they earlier provided what they had is to be expected, those were normal court orders, as you were able to prove by linking to them. What happend now must have been something significantly different to make the owner shutting down the company. The owner is not even allowed to say what, which is directly against the First amendment. That's really a huge issue. Please don't keep trying to distract from that by mixing up the normal court orders with what's going on now. Thanks in advance.
        betterunix 13y ago
        While there may be legal and policy differences between "normal" court orders and PRISM, the only technical difference is the scale. If Lavabit could respond to "normal" court orders, then they could have participated in PRISM. Lavabit's users are lucky that the company's founder took a stand for their privacy rights; he could have just gone the other way and kept a record of all their passwords / secret keys / etc. Of course Lavabit would not be the one brute forcing the passwords. That is not the point. The point is that the security of Lavabit is a matter of the user's password, and only in the best case where the user does not log in. Ultimately Lavabit's security is a matter of the trustworthiness of Lavabit's employees, not the size of your key; it is marginally related to the strength of your password, but only under very specific circumstances. The fact that cryptography is being used somewhere in the system is a distraction. If instead of the US government showing up with a court order it had been a Chinese spy sending business secrets back to the Chinese government, would you still be defending Lavabit?
kaonashi 13y ago
They could have handed over encrypted files, is there something to suggest they handed over plaintext messages?
- AsymetricCom 13y ago
  It is more likely, he modified the site to give the targeted individuals a different front-end that would capture the keys. OSPF
jmillikin 13y ago
Lavabit was hosted webmail, and therefore inherently dependent on the host not being evil. It is not possible to construct a hosted webmail service that is safe against a malicious/compromised host. The phrase "user information" is vague; it could include timestamps of all requests from a particular IP, for example. Given that he was willing to shut down his sole source of income on principle, I'm willing to believe that he had reasonable crypto in place to protect user data at rest. Cryptography was just a side show, just like with Hushmail, because Lavabit could get the plaintexts whenever someone working there wanted (or whenever they were compelled to do so by a government, criminal organization, etc.). Assuming good faith and a reasonable storage implementation, it is possible that Lavabit is not capable of providing plaintext messages on demand. I heard somewhere that messages were stored with a key derived from the user's password; if true, then a warrant for johndoe@lavabit.com might not be fulfillable until after the next successful login from johndoe@.
- betterunix 13y ago
  "The phrase "user information" is vague; it could include timestamps of all requests from a particular IP, for example." Sure, but this warrant makes it pretty clear that the government was seeking message bodies, attachments, etc.: http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.236204/gov.uscourts.mdd.236204.docket.html http://ia600908.us.archive.org/9/items/gov.uscourts.mdd.2362... "I heard somewhere that messages were stored with a key derived from the user's password; if true, then a warrant for johndoe@lavabit.com might not be fulfillable until after the next successful login from johndoe@." ...or to try brute forcing the password offline, which has a reasonable probability of working. Either way, it is not any different than the situation with Hushmail, and I would put both squarely in the "snake oil" category.
  - dalke 13y ago
    Lavabit had two account types. The no-cost one stored the messages unencrypted and the for-fee one stored the messages encrypted. You have not established that that warrant was for accounts of the second type. You have not established that the contents of the DVD were readable by the authorities. You have not established that the type of person who would have a Lavabit account would be the type of person who would choose a password which has "a reasonable probability" of being brute-forced in under a decade.
nilved 13y ago
No, that isn't the case. Lavabit's emails were encrypted on the server for paying users, and only if enabled by them. In a case where one of those users (whose numbers were less than 2000) had their data subpoenaed, Lavabit would be unable to do so without MITMing themselves in a way that grabbed the plaintext password in transit. Since that didn't happen (why would he close the site when he was asked to do it again?) we can surmise that the only data that was given over was free users and only when compelled by the government.
- betterunix 13y ago
  ...how is that different from Hushmail?
  - nilved 13y ago
    The difference is that Hushmail sold out and did perform the password sniffing. Lavabit shut down instead.
    - betterunix 13y ago
      Is there some reason to think that Lavabit was not grabbing user passwords in any of the 24 warrants they complied with prior to shut down?
      - Dylan16807 13y ago
        Because a warrant can't force you to log something you never logged, and he doesn't seem like the kind of person that would sell out when he didn't have to, and then shut down when forced to sell out. Why do you assume he's a lying bastard like the people at hushmail?
        ds9 13y ago
        Actually, I read about a case (US) where the court ruled that a service operator had to turn on logging. The rationale was that the required data existed on the server, albeit only transitorily in memory, and therefore was "in possession" and therefore subject to seizure with a warrant. This was maybe a year or two ago. Sorry I don't recall enough, or have time to look this up. It may have been a lower court decision, subject to appeal. This is really the point that bothers me - if the NSL type of thing is now going to extend to removing the right of server operators to decide what code will or won't run, then this campaign against citizens being able to communicate privately shifts from "design a non-tappable service" to more like a whack-a-mole situation with only transitory, small scale possibilities of private communication being available. Edit: also this: https://news.ycombinator.com/item?id=6208631 https://news.ycombinator.com/item?id=6208631
andrewcooke 13y ago
https://www.hnsearch.com/search#request/all&q=tptacek+javascript+crypto&start=0 https://www.hnsearch.com/search#request/all&q=tptacek+javasc...
MagicWishMonkey 13y ago
You are wrong. For one thing, Ladar is the only person at Lavabit with access to the servers or hosting environment. Absolutely no one could access the plain text version of anything (password or email contents) without the password to an account, because all data for a specific user is encrypted using a key that is stored as an encrypted string in the database, without the account password the key cannot be decrypted. Now, it would be possible for him to have installed software to intercept the password for a specific user when they authenticate, I have no idea if he ever had to do that. I do know that he's obligated by law to comply with court orders, you can't just refuse to cooperate if federal officials give you a warrant, if you don't cooperate they will throw you in jail until you change your mind. Those rules apply to every American company, not just Lavabit.
aqme28 13y ago
There's a huge gap between complying with a legitimate warrant (read: narrow, reasonable, justifiable) and a general warrant.
- betterunix 13y ago
  Not as far as the security of the system is concerned. If you can comply with one then you can technically comply with the other, and the users are at the mercy of your decision on that matter.
  - mpyne 13y ago
    But that's just it. Some users would not mind a service that can be ordered to comply with a particularized and specific warrant. Not everyone's threat model includes what your threat model includes, so as long as users are aware of that going into it then let the user decide.
    - betterunix 13y ago
      How do you design a service that can comply with a specific warrant but which cannot: 1. Allow a hacker to read your messages by attacking the mail server? 2. Allow a spy to read your messages by gaining employment with the service provider? 3. Comply with a broad, non-specific warrant?
      - mpyne 13y ago
        You can't. That's why trust comes into play. Even if you can design such a system, you must still trust the implementer to get it right, and in the case of email, trust the receiver not to do anything stupid with the cleartext.
      - sophacles 13y ago
        1. This is a different issue. You can't design a service that doesn't comply with a specific warrant and guarantee this. 2. N-part keys go along way for this. No one employee has the ability to do the things for warrant compliance. Yes still gamable, but so is any system. See 1. 3. Shut down when a non specific warrant is received. Have a big red button that kills everything. Make the system so that it deletes everything if more than N warrant accesses occur in M time units. In the worse case, passive agressive compliance that causes big outages, unintentional security leaks, and so on (while implementing the removal of BRB and N/M scheme) would go a long way in making the paranoid move on before following the world.
mtgx 13y ago
Only the paid accounts are fully encrypted. The free ones are just like Gmail.
consultant23522 13y ago
I think the distinction between providing aid to the FBI (or whoever) for a specific, targeted warrant but telling them to fly a kite when they want access to everyone without reasonable cause is perfectly reasonable from his perspective.

grey-area 13y ago

There's also an interview with the Lavabit founder Ladar Levison and his lawyer over on democracy now (seems to be on the HN banlist): http://www.democracynow.org/2013/8/13/exclusive_owner_of_snowdens_email_service http://www.democracynow.org/2013/8/13/exclusive_owner_of_sno...

dombili 13y ago
I did share that link 5 hours ago, maybe it's because of that. https://news.ycombinator.com/item?id=6206623 https://news.ycombinator.com/item?id=6206623
- gsibble 13y ago
  Your link doesn't appear to work.
  - dombili 13y ago
    That's strange, I can see it just fine. Edit: Tried it on private mode and I couldn't see it either. No clue as to why.
    - zwegner 13y ago
      You have showdead on, it seems...
      - dombili 13y ago
        Nope, it's off. Anyway, who cares. The conversation is happening, that's all that matters.
    - PavlovsCat 13y ago
      Maybe it's like hellbans: everybody can see the submission is dead except the submitter. HN, where you're always the last to know ^^
  - deleted 13y ago

jusben1369 13y ago

“I’ve always sort of believed it’s important for Americans to have private conversations with other Americans,” Mr. Levison said in a telephone interview Monday, “and not fear that their conversations were being monitored by the government.” The problem with that is you know your service is going to be used by criminals, child pornography, organized crime, terrorists etc. So if you start this service you know you're going to have to comply with government requests for that data. It seems disingenuous to complain about their requests as though you didn't expect them and that they wouldn't e reasonable. And I think he's saying that in his own way when you get into the details: "Yep, I supported the narrowly defined ones but the broadly defined ones are the straw that broke the camels back"

rorrr2 13y ago
If you think this mass surveillance was set up to fight child porn or terrorists, you're extremely naive. It's a power grab. Pure and simple. Those who control this system can easily find dirt on their political/corporate opponents, while being completely immune. They might stop some occasional clueless idiot terrorists or CP distributors, but that's not the end goal, that's just the political theater. You really think terrorists don't properly encrypt their conversations? You really think high-level criminals don't properly encrypt their conversations? Think again.
- betterunix 13y ago
  "You really think high-level criminals don't properly encrypt their conversations?" Funny story about that: http://www.theregister.co.uk/2006/04/19/mafia_don_clueless_crypto/ http://www.theregister.co.uk/2006/04/19/mafia_don_clueless_c...
  - rorrr2 13y ago
    If you think mafia bosses are high-level criminals, I have news for you. Wall st.
    - veidr 13y ago

akkartik 13y ago

"After his announcement last Thursday, a second company, Silent Circle, based in Maryland, said it would close its secure e-mail service. That company said it had not been served with a government order of any kind. In a pre-emptive bid to protect its customers’ data, Silent Circle said it had obliterated everything in its server." Uh, what? This could almost be the story satirized by this passage from 1911: "A certain German art expert, who had obtained from the municipality of Bergamo permission to inspect the famous masterpiece, declared it to be a spurious Pincini... The editor of an Italian art journal refuted the contentions of the German expert and undertook to prove that his private life did not conform to any modern standard of decency. The whole of Italy and Germany were drawn into the dispute, and the rest of Europe was soon involved in the quarrel. There were stormy scenes in the Spanish Parliament, and the University of Copenhagen bestowed a gold medal on the German expert (afterwards sending a commission to examine his proofs on the spot), while two Polish schoolboys in Paris committed suicide to show what THEY thought of the matter." -- Saki, "The Background" (http://ebooks.adelaide.edu.au/s/saki/clovis/chapter6.html http://ebooks.adelaide.edu.au/s/saki/clovis/chapter6.html)

notaddicted 13y ago
It depends what you care about more, the emails or the privacy. The privacy is now ensured, and it isn't like they've erased the emails from the users' minds, only the records of the email.
harshreality 13y ago
Uh, what? This could almost be... They're nothing alike. Suppose Silent Circle sent an email to all its users announcing that they would destroy the data on the server in 7 days. It's a good bet the government has accounts on most privacy-advocating web services, simply to keep tabs. That gives the government 7 days to try to get a FISA warrant, or if they think they can get away with it, unilaterally issue a NSL. They would only be able to subpoena a few of the email accounts (or maybe a lot, but certainly not all), but that still breaks the privacy model many people assume given its advertisement as "secure" webmail. Silent Circle didn't want to take the chance, and your hyperbolic parallel notwithstanding, they had good reason to do what they did.

ballard 13y ago

The problem with centralized privacy-as-a-service is the Fed raid problem. In order to be "fed proof," a service must be sufficiently distributed. PS: I'll say what has been said again, Lavabit was so close to being wildly successful, it's a shame that an insecure govt leadership decided to squash a thriving venture. Though it was a likely conclusion because of centralized ownership.

betterunix 13y ago
The problem is not limited to any specific government; the problem is that you are doing something inherently insecure when you allow a service provider to generate, store, and utilize your private keys. Exploits by law enforcement are not the only problem -- spies, criminals, etc. can also exploit the weakness.

vpeters25 13y ago

I'm no lawyer but I think Mr. Levinson should lay low and avoid talking to the media. I think he is already in deep trouble, if he keeps talking, he is pretty much challenging federal prosecutors to have him "Swartz'd"

mtgx 13y ago
Defy the system. Abusive governments win when everyone shuts up.
epo 13y ago
"Levison", perhaps at this point keeping himself public keeps him safe(r).

anovikov 13y ago

An idea for fixing this is having an email provider broken up between several countries that are not expected to cooperate (like U.S., Russia, Equador and Iran) and coded in a way that renders information worthless unless pieces from all parts are used. Then no court order can help.

anovikov 13y ago
Correction: better having some redundancy because otherwise a single country can shut down the system (while not steal data).