3 ms·

Lavabit could almost never claim to be unable to provide plaintexts. In the worst case they would only need to wait for the user to log in again, or perhaps to

Lavabit could almost never claim to be unable to provide plaintexts. In the worst case they would only need to wait for the user to log in again, or perhaps to just brute force the user's password (this does actually work, even for seemingly hard-to-guess passwords). This is really not any different from Hushmail.

acqq 13y ago
Lavabit wouldn't be these that bruteforce the passwords. We all know who's in charge for such things. That they earlier provided what they had is to be expected, those were normal court orders, as you were able to prove by linking to them. What happend now must have been something significantly different to make the owner shutting down the company. The owner is not even allowed to say what, which is directly against the First amendment. That's really a huge issue. Please don't keep trying to distract from that by mixing up the normal court orders with what's going on now. Thanks in advance.
- betterunix 13y ago
  While there may be legal and policy differences between "normal" court orders and PRISM, the only technical difference is the scale. If Lavabit could respond to "normal" court orders, then they could have participated in PRISM. Lavabit's users are lucky that the company's founder took a stand for their privacy rights; he could have just gone the other way and kept a record of all their passwords / secret keys / etc. Of course Lavabit would not be the one brute forcing the passwords. That is not the point. The point is that the security of Lavabit is a matter of the user's password, and only in the best case where the user does not log in. Ultimately Lavabit's security is a matter of the trustworthiness of Lavabit's employees, not the size of your key; it is marginally related to the strength of your password, but only under very specific circumstances. The fact that cryptography is being used somewhere in the system is a distraction. If instead of the US government showing up with a court order it had been a Chinese spy sending business secrets back to the Chinese government, would you still be defending Lavabit?
  - acqq 13y ago
    Sorry, you are the one doing the distraction. Do read again what I've already written here, I'm leaving this discussion.
  - sophacles 13y ago
    Your entire argument comes down to "I don't think anyone but me can be right, and further I can't imagine any way this software could have been architected, therefore lavabit must be evil". Or something. It is very hard to follow your argument. You keep claiming various contradictory things....

acqq 13y ago

Lavabit wouldn't be these that bruteforce the passwords. We all know who's in charge for such things. That they earlier provided what they had is to be expected, those were normal court orders, as you were able to prove by linking to them. What happend now must have been something significantly different to make the owner shutting down the company. The owner is not even allowed to say what, which is directly against the First amendment. That's really a huge issue. Please don't keep trying to distract from that by mixing up the normal court orders with what's going on now. Thanks in advance.

betterunix 13y ago
While there may be legal and policy differences between "normal" court orders and PRISM, the only technical difference is the scale. If Lavabit could respond to "normal" court orders, then they could have participated in PRISM. Lavabit's users are lucky that the company's founder took a stand for their privacy rights; he could have just gone the other way and kept a record of all their passwords / secret keys / etc. Of course Lavabit would not be the one brute forcing the passwords. That is not the point. The point is that the security of Lavabit is a matter of the user's password, and only in the best case where the user does not log in. Ultimately Lavabit's security is a matter of the trustworthiness of Lavabit's employees, not the size of your key; it is marginally related to the strength of your password, but only under very specific circumstances. The fact that cryptography is being used somewhere in the system is a distraction. If instead of the US government showing up with a court order it had been a Chinese spy sending business secrets back to the Chinese government, would you still be defending Lavabit?
- acqq 13y ago
  Sorry, you are the one doing the distraction. Do read again what I've already written here, I'm leaving this discussion.
- sophacles 13y ago
  Your entire argument comes down to "I don't think anyone but me can be right, and further I can't imagine any way this software could have been architected, therefore lavabit must be evil". Or something. It is very hard to follow your argument. You keep claiming various contradictory things....