5 ms·

The contents of e-mail hosted by third parties will always be subject to legal demand. Even if Mr Levinson wins his action against NSLs, that will remain true.

The contents of e-mail hosted by third parties will always be subject to legal demand. Even if Mr Levinson wins his action against NSLs, that will remain true. Non-NSL warrants conform to the Constitutional protections and will continue to be served and fulfilled.

devx 13y ago
Probably, but it would still be a huge win, if we could make it so they could only get e-mails with a normal warrant, from a normal Court (none of that secret courts/"millions of records-are-relevant nonsense). Also, I don't know if it's currently "legal" or not to demand companies to keep encryption keys of what they're encrypting, but I'm pretty sure it's unconstitutional. So encrypting communications end to end should be constitutional/legal. The companies can still do that (if they have the will/customer pressure). As for coerced backdoors, like they tried with Lavabit, that's just disgustingly immoral, and definitely unconstitutional.
- danielweber 13y ago
  > if we could make it so they could only get e-mails with a normal warrant, from a normal Court That is probably a legislative challenge, not a legal challenge. Is he setting up a PAC?
- dingaling 13y ago
  I agree it would be a monumental victory against secret demands, but if a non-sysadmin layman read that rally.org page he might believe that the result that all e-mails would be 'safe' forever. You make an interesting point about encryption keys; it is unconstitutional to demand that an individual hand-over his keys in a speculative manner, but is not considered self-incrimination if the prosecutor knows that the relevant document is encrypted. for example, if the individual boasts that 'The Man can't read my encrypted tax evasion plan'. But I have no idea how that reads-across to a corporation.
  - ladar 13y ago
    Third parties like Lavabit can be forced to turn over user keys... which is why I encrypted a user's private key with the user's password.
fennecfoxen 13y ago
Oh, come now. It's not as simple as that and you know it (or you should know it). The Lavabit design - its entire premise -was that the service stored all the emails in an encrypted form that even Lavabit couldn't access. It was especially constructed that way to be different from other services, at the cost of considerable time and expense. The Lavabit threat is universally considered to be a government order to (in essence) stop running the service that way. This is different from previous government demands in which Lavabit did turn over information which they had. So the question is: should encrypted-hosting service designs be illegal unless they have a backdoor for the government and the service provider to get in?
- betterunix 13y ago
  It is as simple as that. If you are not encrypting your email locally you are relying on the service provider to be honest. Claiming that Lavabit could not access your email is silly; Lavabit could easily access it, at the very least when you next log in (presumably this is why the service was shut down). There is no meaningful difference between Lavabit's design and Hushmail's design, and both services had responded to previous government requests. If you want private email, you need to encrypt locally before the message is sent and decrypt locally after the message is received -- end of story.
  - balabaster 13y ago
    and the only problem with this is that unless you can unequivocally prove that the public key you are encrypting with is for the intended recipient, you're stuck. Until we have an infrastructure that can allow truly secure proof of identity, you can be assured, email (end every other form of internet communication) is insecure. The only secure email is the one you never sent... or if you're using webmail, it's the one you never wrote. If you want truly secure email, only use a public key to encrypt it if you can prove beyond a shadow of a doubt that the public key you are encrypting with is for the person you intend to write to. Internet delivery of the public key by the standard methods aren't foolproof.
    - 13y ago
fsckin 13y ago
What if your email host was also your 'attorney'?
- gknoy 13y ago
  Or your spouse?
  - rdl 13y ago
    Our your friendly neighborhood ULC minister.
- tedunangst 13y ago
  http://en.wikipedia.org/wiki/Attorney%E2%80%93client_privilege#When_the_privilege_may_not_apply http://en.wikipedia.org/wiki/Attorney%E2%80%93client_privile...
ladar 13y ago
The question is whether our government can access the private data of people not involved in an investigation and whether companies can be forced to surrender their own sensitive info... or be forced to help subvert the security of their own products and services.

devx 13y ago

Probably, but it would still be a huge win, if we could make it so they could only get e-mails with a normal warrant, from a normal Court (none of that secret courts/"millions of records-are-relevant nonsense). Also, I don't know if it's currently "legal" or not to demand companies to keep encryption keys of what they're encrypting, but I'm pretty sure it's unconstitutional. So encrypting communications end to end should be constitutional/legal. The companies can still do that (if they have the will/customer pressure). As for coerced backdoors, like they tried with Lavabit, that's just disgustingly immoral, and definitely unconstitutional.

danielweber 13y ago
> if we could make it so they could only get e-mails with a normal warrant, from a normal Court That is probably a legislative challenge, not a legal challenge. Is he setting up a PAC?
dingaling 13y ago
I agree it would be a monumental victory against secret demands, but if a non-sysadmin layman read that rally.org page he might believe that the result that all e-mails would be 'safe' forever. You make an interesting point about encryption keys; it is unconstitutional to demand that an individual hand-over his keys in a speculative manner, but is not considered self-incrimination if the prosecutor knows that the relevant document is encrypted. for example, if the individual boasts that 'The Man can't read my encrypted tax evasion plan'. But I have no idea how that reads-across to a corporation.
- ladar 13y ago
  Third parties like Lavabit can be forced to turn over user keys... which is why I encrypted a user's private key with the user's password.

fennecfoxen 13y ago

Oh, come now. It's not as simple as that and you know it (or you should know it). The Lavabit design - its entire premise -was that the service stored all the emails in an encrypted form that even Lavabit couldn't access. It was especially constructed that way to be different from other services, at the cost of considerable time and expense. The Lavabit threat is universally considered to be a government order to (in essence) stop running the service that way. This is different from previous government demands in which Lavabit did turn over information which they had. So the question is: should encrypted-hosting service designs be illegal unless they have a backdoor for the government and the service provider to get in?

betterunix 13y ago
It is as simple as that. If you are not encrypting your email locally you are relying on the service provider to be honest. Claiming that Lavabit could not access your email is silly; Lavabit could easily access it, at the very least when you next log in (presumably this is why the service was shut down). There is no meaningful difference between Lavabit's design and Hushmail's design, and both services had responded to previous government requests. If you want private email, you need to encrypt locally before the message is sent and decrypt locally after the message is received -- end of story.
- balabaster 13y ago
  and the only problem with this is that unless you can unequivocally prove that the public key you are encrypting with is for the intended recipient, you're stuck. Until we have an infrastructure that can allow truly secure proof of identity, you can be assured, email (end every other form of internet communication) is insecure. The only secure email is the one you never sent... or if you're using webmail, it's the one you never wrote. If you want truly secure email, only use a public key to encrypt it if you can prove beyond a shadow of a doubt that the public key you are encrypting with is for the person you intend to write to. Internet delivery of the public key by the standard methods aren't foolproof.
  - 13y ago

fsckin 13y ago

What if your email host was also your 'attorney'?

gknoy 13y ago
Or your spouse?
- rdl 13y ago
  Our your friendly neighborhood ULC minister.
tedunangst 13y ago
http://en.wikipedia.org/wiki/Attorney%E2%80%93client_privilege#When_the_privilege_may_not_apply http://en.wikipedia.org/wiki/Attorney%E2%80%93client_privile...

ladar 13y ago

The question is whether our government can access the private data of people not involved in an investigation and whether companies can be forced to surrender their own sensitive info... or be forced to help subvert the security of their own products and services.