4 ms·

The problem is that in order to get that information the first way Lavabit would have had to write code that made all of their business claims a lie.

jauer 13y ago
Except that per the article they already had that code written so they couldn't credibly claim that they weren't able to do it: "The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to 'defeat [its] own system,'" the government complained.
- Glyptodon 13y ago
  "Technical ability" means that yes, it's doable if someone does work. It's doesn't mean that they 'already had the ability' other than in a theoretical sense. And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc.
  - kartikkumar 13y ago
    I think you're reading the sentence incorrectly. The way I read it, it's not saying that they "technically had the ability", which is what you're suggesting as having the ability in a theoretical sense. It's stating that they "had the technical ability", i.e., they had the technical prowess, knowledge, etc.
  - betterunix 13y ago
    ""Technical ability" means that yes, it's doable if someone does work. It's doesn't mean that they 'already had the ability' other than in a theoretical sense." That is a meaningless distinction. It is the difference between having to type a large number of characters (not even that large -- how hard is it to capture a password?), or a small number of characters. Lavabit, as designed, could access any user's email the moment that user logged in. That is obvious to anyone who understands what encryption is. It is an inherent vulnerability in every system that does what Lavabit/Hushmail/etc. do. "And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc." If Lavabit advertised itself as an email service that cannot read your email, then that suit could have happened regardless, because the claim is untrue. If, on the other hand, it was advertised as a service that will not read your email and that protects your email while it is stored, that is different and would not have been affected by their cooperation with the FBI's demands.
tptacek 13y ago
That's true. But then, engage with the question of whether those promises were reasonable. "Even if we have the capability of complying with a request for information on a specific user, we will resist the courts". There's a reason providers tend not to make that promise: keeping it can involve going out of business.
- Glyptodon 13y ago
  That's not the promise they made, rather it was that they had not developed and would not develop any means to circumvent the protection/encryption for paying users' accounts. The 'not complying' is only a side effect, and is more so tantamount to a refusal to do work for the government in opposition to lavabit's own business promises. I'm not sure the government in any instance has a right to compel work to meet their specified ends.
  - tptacek 13y ago
    Here my biases as a secure software engineer may be coloring my comments, because to my mind, building an architecture which solicits sensitive data from clients but fails to preclude the disclosure of those secrets without enormous engineering effort is the same thing as conceding that such disclosure is possible. Imagine a mail service that operated solely as a Tor hidden service and required all users to use PGP --- for instance, by checking the contents of mail messages to ensure they were encoding them, and rejecting them if they weren't. That's a service that might reasonably make a promise not to cooperate with a court order. Lavabit didn't have that system and instead had to make a difference promise: that they would shutter the enterprise before cooperating with a court. And so they did.
  - thrownaway2424 13y ago
    That's retarded though. The absence of getpeername calls in their frontend does not constitute an inability to comply with a pen register order. There are costs of doing business and one of the costs is the ability to comply with lawful court orders. You are completely wrong about the government lacking the means to compel compliance.
deleted 13y ago
[deleted]
wmf 13y ago
Arguably they should have thought about that (especially in the wake of Hushmail) before making such claims.
betterunix 13y ago
Strictly speaking, Lavabit always had a back door. Writing the code to exploit it does not in any way change the truth or lack of truth in any of Lavabit's business statements. At some point the secret keys of each Lavabit user were sitting in some part of the server's memory, in the clear, there for the taking. At best Lavabit only ever provided security between logins i.e. when the data is "at rest." Any claims of security beyond that are, to be polite, overstated.

jauer 13y ago

Except that per the article they already had that code written so they couldn't credibly claim that they weren't able to do it: "The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to 'defeat [its] own system,'" the government complained.

Glyptodon 13y ago
"Technical ability" means that yes, it's doable if someone does work. It's doesn't mean that they 'already had the ability' other than in a theoretical sense. And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc.
- kartikkumar 13y ago
  I think you're reading the sentence incorrectly. The way I read it, it's not saying that they "technically had the ability", which is what you're suggesting as having the ability in a theoretical sense. It's stating that they "had the technical ability", i.e., they had the technical prowess, knowledge, etc.
- betterunix 13y ago
  ""Technical ability" means that yes, it's doable if someone does work. It's doesn't mean that they 'already had the ability' other than in a theoretical sense." That is a meaningless distinction. It is the difference between having to type a large number of characters (not even that large -- how hard is it to capture a password?), or a small number of characters. Lavabit, as designed, could access any user's email the moment that user logged in. That is obvious to anyone who understands what encryption is. It is an inherent vulnerability in every system that does what Lavabit/Hushmail/etc. do. "And even so, it still doesn't change the fact that it would have turned all their business claims into giant lies, possibly even exposing them to suits for false advertising, etc." If Lavabit advertised itself as an email service that cannot read your email, then that suit could have happened regardless, because the claim is untrue. If, on the other hand, it was advertised as a service that will not read your email and that protects your email while it is stored, that is different and would not have been affected by their cooperation with the FBI's demands.

tptacek 13y ago

That's true. But then, engage with the question of whether those promises were reasonable. "Even if we have the capability of complying with a request for information on a specific user, we will resist the courts". There's a reason providers tend not to make that promise: keeping it can involve going out of business.

Glyptodon 13y ago
That's not the promise they made, rather it was that they had not developed and would not develop any means to circumvent the protection/encryption for paying users' accounts. The 'not complying' is only a side effect, and is more so tantamount to a refusal to do work for the government in opposition to lavabit's own business promises. I'm not sure the government in any instance has a right to compel work to meet their specified ends.
- tptacek 13y ago
  Here my biases as a secure software engineer may be coloring my comments, because to my mind, building an architecture which solicits sensitive data from clients but fails to preclude the disclosure of those secrets without enormous engineering effort is the same thing as conceding that such disclosure is possible. Imagine a mail service that operated solely as a Tor hidden service and required all users to use PGP --- for instance, by checking the contents of mail messages to ensure they were encoding them, and rejecting them if they weren't. That's a service that might reasonably make a promise not to cooperate with a court order. Lavabit didn't have that system and instead had to make a difference promise: that they would shutter the enterprise before cooperating with a court. And so they did.
- thrownaway2424 13y ago
  That's retarded though. The absence of getpeername calls in their frontend does not constitute an inability to comply with a pen register order. There are costs of doing business and one of the costs is the ability to comply with lawful court orders. You are completely wrong about the government lacking the means to compel compliance.

deleted 13y ago

[deleted]

wmf 13y ago

Arguably they should have thought about that (especially in the wake of Hushmail) before making such claims.

betterunix 13y ago

Strictly speaking, Lavabit always had a back door. Writing the code to exploit it does not in any way change the truth or lack of truth in any of Lavabit's business statements. At some point the secret keys of each Lavabit user were sitting in some part of the server's memory, in the clear, there for the taking. At best Lavabit only ever provided security between logins i.e. when the data is "at rest." Any claims of security beyond that are, to be polite, overstated.