5 ms·

No, that isn't the case. Lavabit's emails were encrypted on the server for paying users, and only if enabled by them. In a case where one of those users (whos

by nilved 13y ago

No, that isn't the case. Lavabit's emails were encrypted on the server for paying users, and only if enabled by them. In a case where one of those users (whose numbers were less than 2000) had their data subpoenaed, Lavabit would be unable to do so without MITMing themselves in a way that grabbed the plaintext password in transit. Since that didn't happen (why would he close the site when he was asked to do it again?) we can surmise that the only data that was given over was free users and only when compelled by the government.

betterunix 13y ago
...how is that different from Hushmail?
- nilved 13y ago
  The difference is that Hushmail sold out and did perform the password sniffing. Lavabit shut down instead.
  - betterunix 13y ago
    Is there some reason to think that Lavabit was not grabbing user passwords in any of the 24 warrants they complied with prior to shut down?
    - Dylan16807 13y ago
      Because a warrant can't force you to log something you never logged, and he doesn't seem like the kind of person that would sell out when he didn't have to, and then shut down when forced to sell out. Why do you assume he's a lying bastard like the people at hushmail?
      - ds9 13y ago
        Actually, I read about a case (US) where the court ruled that a service operator had to turn on logging. The rationale was that the required data existed on the server, albeit only transitorily in memory, and therefore was "in possession" and therefore subject to seizure with a warrant. This was maybe a year or two ago. Sorry I don't recall enough, or have time to look this up. It may have been a lower court decision, subject to appeal. This is really the point that bothers me - if the NSL type of thing is now going to extend to removing the right of server operators to decide what code will or won't run, then this campaign against citizens being able to communicate privately shifts from "design a non-tappable service" to more like a whack-a-mole situation with only transitory, small scale possibilities of private communication being available. Edit: also this: https://news.ycombinator.com/item?id=6208631 https://news.ycombinator.com/item?id=6208631
    - nilved 13y ago
      Firstly, because I trust Lavabit. For two, because he recently shut down the site instead of doing that. It's not definitive, but it doesn't make sense to me that he'd decrypt one user's data but shut down instead of decrypting anothers.
      - betterunix 13y ago
        The way I read the story, he shut down the site because he received a non-specific warrant e.g. demands for access to every user's messages. It seems to be pretty clear that he believed that specific warrants are fine. I saw nothing here, nor in any of the other HN front-page stories about Lavabit, to suggest that Lavabit was unable or unwilling to provide law enforcement agencies with plaintext for suspected criminals. Lavabit's users are lucky that the founder is not willing to participate in wholesale surveillance.

by nilved 13y ago

betterunix 13y ago

...how is that different from Hushmail?

nilved 13y ago
The difference is that Hushmail sold out and did perform the password sniffing. Lavabit shut down instead.
- betterunix 13y ago
  Is there some reason to think that Lavabit was not grabbing user passwords in any of the 24 warrants they complied with prior to shut down?
  - Dylan16807 13y ago
    Because a warrant can't force you to log something you never logged, and he doesn't seem like the kind of person that would sell out when he didn't have to, and then shut down when forced to sell out. Why do you assume he's a lying bastard like the people at hushmail?
    - ds9 13y ago
      Actually, I read about a case (US) where the court ruled that a service operator had to turn on logging. The rationale was that the required data existed on the server, albeit only transitorily in memory, and therefore was "in possession" and therefore subject to seizure with a warrant. This was maybe a year or two ago. Sorry I don't recall enough, or have time to look this up. It may have been a lower court decision, subject to appeal. This is really the point that bothers me - if the NSL type of thing is now going to extend to removing the right of server operators to decide what code will or won't run, then this campaign against citizens being able to communicate privately shifts from "design a non-tappable service" to more like a whack-a-mole situation with only transitory, small scale possibilities of private communication being available. Edit: also this: https://news.ycombinator.com/item?id=6208631 https://news.ycombinator.com/item?id=6208631
  - nilved 13y ago
    Firstly, because I trust Lavabit. For two, because he recently shut down the site instead of doing that. It's not definitive, but it doesn't make sense to me that he'd decrypt one user's data but shut down instead of decrypting anothers.
    - betterunix 13y ago
      The way I read the story, he shut down the site because he received a non-specific warrant e.g. demands for access to every user's messages. It seems to be pretty clear that he believed that specific warrants are fine. I saw nothing here, nor in any of the other HN front-page stories about Lavabit, to suggest that Lavabit was unable or unwilling to provide law enforcement agencies with plaintext for suspected criminals. Lavabit's users are lucky that the founder is not willing to participate in wholesale surveillance.