13 ms·
Lavabit founder Ladar Levison's promised big announcement
- deleted 13y ago[deleted]
- antocv 13y agoHere is a non-facebook link ssl link. https://ezcrypt.it/fl7n#RL16xMj9JWYSezVvk5FxnG68 https://ezcrypt.it/fl7n#RL16xMj9JWYSezVvk5FxnG68
- p4bl0 13y agoMore readable (but not https) version here: http://pastie.org/private/v0wn72dm8nklqxlrjv8qpg http://pastie.org/private/v0wn72dm8nklqxlrjv8qpg
- dutchbrit 13y agoNot sure why an SSL link would add any benefit in this situation anyway...
- antocv 13y agoMore encrypted data for NSA to churn through!
- betterunix 13y agoIt helps to make encryption the norm. Better to be using encryption in situations where it is not needed than to fail to use it in situations where it matters.
- rmc 13y agoIt will also help if some Treacherous Government complains that "You must have been doing something bad, you used SSL!" and everyone can turn around and say "But loads of things are SSL!"
- simgidacav 13y ago+1 for you, sir. I was indeed disturbed by the link coming from facebook.
- TeMPOraL 13y agoWe've seen many "articles" on HN that were basically Google+ posts. Some people use Facebook instead of G+ for similar purpose.
- dingaling 13y agoLavabit was created so every law-abiding citizen has access to a secure and private email service. What an intriguing statement. I'm not sure if I should read anything into it, but 'law-abiding' and 'citizen' seem odd in that context. Edit: Why not just say 'everyone'? Otherwise it sounds as if Lavabit was making a decision as to whether someone was eligible or not, which I don't think is what he means.
- kybernetikos 13y agoI think he said that because he was happy to work with reasonable law enforcement requests for specific individuals that were part of a criminal investigation. It was just when they were asking for the ability to completely backdoor his system for all users that he started with the civil disobedience.
- smackay 13y agoI think you are reading too much into the statement. It's likely to be a figure of speech so that regular folks i.e. not child pornographers, drug smugglers, terrorists or other ne'er do wells, can feel good about using the service.
- notdonspaulding 13y agoBecause it's a statement in front of a court. Specifically, in giving the rationale for why handing over the private key is a 4th amendment violation, it's helpful to point out that lawbreakers (for whom specific, particular, narrow warrants have been issued) have no expectation of privacy even on Lavabit's system.
- acqq 13y agoWidely unrecognized in the other discussions on HN is that: "During an investigation into several Lavabit user accounts, the federal government demanded both unfettered access to all user communications and a copy of the Lavabit encryption keys used to secure web, instant message and email traffic." Note that the initial court order although appearing to target the specific user demanded explicitly that Lavabit "shall furnish agents from the Federal Bureau of Investigation, forthwith, all information, facilities, and technical assistance necessary to accomplish the installation and use of the pen/trap device." (http://s3.documentcloud.org/documents/801182/redacted-pleadings-exhibits-1-23.pdf http://s3.documentcloud.org/documents/801182/redacted-pleadi...) Then defying the initial order was definitely not Lavabit protecting one (famous) person as some wanted to present this case, as the goal of FBI as stated in this announcement was unfettered "access to the Lavabit network without (Lavabit) being able to audit the information being collected." For the first time in history the general public can actually see the most of the documents related to such kind of orders. Up to now the people receiving such orders weren't allow to tell anybody even that they received them. This is unprecedented.
- tedunangst 13y agoWouldn't the installation of the pen trap device be necessary to target one individual as well?
- acqq 13y agoWhy should it be necessary to install their device to target just one individual?
- tedunangst 13y agoFor all I know, trap device could be FBI speak for USB hard drive. He needs to plug in the hard drive so he can copy the data on to it. (I am aware the FBI has other, much more capable network intercept devices. I suspect the term pen/trap device is standard jargon for anything that gets installed on site regardless of capability.)
- adamnemecek 13y agoSomeone posted a link to the Lavabit Court Orders in the comments. http://cryptome.org/2013/10/lavabit-orders.pdf http://cryptome.org/2013/10/lavabit-orders.pdf
- p4bl0 13y agoBeware, this PDF is more than 16MB.
- dingaling 13y agoPage 121 has a redacted section in a field of fixed-pitch font.
- revelation 13y agoThat judge is kind of a pushover. Hes not happy the government would have to trust Lavabit with their solution, but he doesn't even begin to question the governments proposal to just MITM all the traffic through a box with unknown software operated by whoever with certainly no tamper-safe logs of any kind. It's likely because his level of technical competence barely suffices to turn a computer on, but yet he gets to decide on these cases, and the gov lawyer happily aids in his ignorance by supplying factually wrong technical sounding terms (the 'metadata stream') and analogues from an analog world (a 'filter').
- plorg 13y agoThat is a bad reason, yes. However, the prosecutor also objected to Levison's proposal to supply metadata, where he would wait until the 60 days were up, decrypt the stored messages (from which, to my knowledge, he could only read the headers unencrypted - the body is encrypted with PGP, I think), strip the "Subject" headers (per the legal standards on pen/trap orders) and then deliver that data to the FBI, via SCP, in bulk. One reason that this was rejected, then, was that it did not fulfill the requirements of the 'trap/trace' part of the order, which require the metadata to be provided in real time or close to real time.
- trobertson 13y ago
- deleted 13y ago[deleted]
- devx 13y agoHe's only received $50,000 so far, which seems pretty low to me for such an important case like this. If you can't/won't participate in protests against the mass surveillance and privacy abuses of the government, then at least consider supporting those that fight for our 1st Amendment, 4th Amendment, and human right to privacy, like Ladar Levinson does: https://rally.org/lavabit https://rally.org/lavabit
- rdl 13y agoWhile I agree he needs more money, it's not like he's going to have to pay $800/hr to get the world's best lawyers on his team. Since he appears to be the poster child for a test case on this, I think the money will mostly only need to be spent on expenses (travel, etc.), vs. lawyer time, and there will probably be in-kind donations of services. Lader is the kind of person you want to bring to a case before SCOTUS, not weev.
- option_greek 13y agoYou will be surprised how many hours can be logged by lawyers. They live and breath billing hours.
- rdl 13y agoYes, but the top lawyers in the field can do this pro bono, because it's a good case (or it could be paid directly by other organizations, using staff attorneys).
- znowi 13y agoCan't upvote this enough. This is a real opportunity to fight for user privacy and support the only company that openly defied the government's unconstitutional demands. A virtue we all longed for just a couple of months ago at the height of the NSA scandal. But here it is now and instead we see comments picking on Lavabit and questioning their moral qualities... People just can't get past character debate. Bickering while their rights are gradually stripped off under their noses.
- deanclatworthy 13y agoNothing unexpected from this announcement. It was heavily implied that he was asked to provide the encryption keys to decrypt the communications of all users. I'm surprised that some academic lawyers aren't helping take on this case for no cost, due to the precedent it may set and the exposure it will get.
- acqq 13y agoPlease don't diminish the importance of it. This release is unprecedented. For the first time in history the public can actually see the most of the documents related to such kind of orders. See also: https://news.ycombinator.com/item?id=6487986 https://news.ycombinator.com/item?id=6487986
- hondje 13y agoLinking to yourself like that is incredibly tacky
- acqq 13y agoLinking is there to avoid repeating the arguments written in much more detail in the linked post. Is it better when everything is written twice instead in one post? Linking also helps concentrating the relevant arguments to the relevant thread. It's not to "myself" it's to the relevant node in the discussion tree which contains a lot of arguments. If there's anything written where you've found some error you can present your arguments. Attacking persons aren't arguments.
- andrewcooke 13y agooh come on. when it's not confirmed we have threads with people saying "but there's no evidence, you're only assuming". then when it is confirmed we have "but we already knew this". neither adds anything. but people seem to vote up world-weary comments. yay for internet points.
- deanclatworthy 13y ago
- darkarmani 13y ago> MR. TRUMP: That's one and the same, Your Honor. Just so the record is clear. We understand from Mr. Levison that the encryption keys were purchased commercially. They're not somehow custom crafted by Mr. Levison. He buys them from a vendor and then they're installed . Wrong. You pay to have your public key signed by a commercial entity. The private key was generated by Mr. Levison.
- pilom 13y agoLater on the government submits an "Appendix B" which actually gets it right. The lawyers for both sides made technical mistakes while in court.
- jlebrech 13y agowhy not hand over all the keys and say you were hacked and get everyone to change keys?
- debacle 13y agoThe law doesn't work like that.
- jmaygarden 13y agoThen they would ask for the keys again. If they thought you did it on purpose, then it's another--probably much worse--contempt charge.
- Confusion 13y agoExactly. They don't need to prove you weren't hacked two or three times: they just need to convince a judge that it's unlikely. And the next step, setting up a regular key-changing scheme, simply results in you have to provide new copies automatically every time the keys change.
- hyperbovine 13y agoI highly doubt law enforcement would look kindly on that. Simply shuttering the business "fell just short of a criminal act".
- asparagui 13y agoBecause then the NSA, who totally hasn't been recording these emails for the past ten years, can retroactively decrypt all of them?
- Perseids 13y agoIs there some way I can donate money via Amazon payments? It would be vastly more comfortable.
- orofino 13y agoInterestingly, the letter states he's received over 150k in support. The rally.org campaign now states over 50k has been pledged. I'm not finding the campaign for support to be terribly transparent. When receiving the link to the rally.org campaign yesterday (through pinbord on twitter or gruber) I thought it represented the entire universe of assistance Lavar had received. On top of that, the upper limit of the rally campaign keeps changing. Originally I saw 40k, then last nigth 50k, now this morning 96k. I'm not saying that they're trying to be misleading, but as someone who is interested in this and is considering a donation, I was disquieted by the moving target at rally.org and the lack of transparency until this morning about how much had truly been raised.
- acqq 13y agoIt doesn't matter that you haven't seen some other figure on rally.org (just one of the sources). It doesn't change the fact that Levison will almost certainly need the orders of magnitude more legal funds than what he received up to now. Even having a case with the copyright trolls costs around a million. You bother about the thousands and about the totals which nobody claimed. And Levison had to shut down his own company.
- orofino 13y agoAbsolutely agree. All I'm trying to say is that I find the lack of transparency about the real 'goal' for rally.org and real total (which now we have transparency about) doesn't make me feel great about donating.
- acqq 13y agoSo where is it written that rally.org is supposed to publish the totals of funds collected via other channels? Based on what actually have you expected that?
- orofino 13y agoIt isn't. I think based on the giant bar saying X out of Y pledged that it represented the largest chuck of what had been pledged.
- deleted 13y ago[deleted]
- frank_boyd 13y agoAs a side note: Pretty ironic how he uses Facebook, a NSA partner company, to publish such a statement.
- marquis 13y agoGiven that it's a public statement intended to be read by as many people as possible I find it completely unironic.
- hyperbovine 13y agoPerhaps even more eyeballs than he intended will read this statement. Doesn't seem particularly ironic to me.
- joelrunyon 13y agoFor all of Google's talk of "don't be evil" - it's pretty amazing to me that this one tiny player has more balls to stand up for his principles & users than some monolithic organization like Google.
- jpwagner 13y agoThis is not unbelievable. Google has more to lose.
- gozzoo 13y agoyes, but they also have much more resources to fight and from what we know so far they didn't even try.
- deleted 13y ago[deleted]
- chii 13y agoyea they do have more resources to fight, but from a profit perspective, its unlikely to net any gains, and the gains cannot be only for google (fighting for public good is never profitable). Therefore, its much better to just comply, and take the risk that the users might find out later. Who knows, users might not care, or might not be able to move off google at all...
- JackpotDen 13y agothey don't have much to lose. If they're careful, they have backup servers in multiple places. If they can launder their money through offshore places, they can move their servers.
- wavefunction 13y agoLike the trust and business of their users, both domestic and international? They had to assume that people would find out eventually, so why capitulate? It's like giving in to extortion, you're just delaying the long-term inevitable while damaging yourself in the short-run as well.
- Lagged2Death 13y agoIf you haven't got time to read the whole thing, consider these sentences: In fact the FBI agents even admitted their intention to collect passwords in transit so they could access emails protected by Lavabit’s encrypted storage feature. This was in stark contrast the DOJ attornies who maintained that only the metadata authorized by the court order would be collected. Levison was running a business. A privacy business. After years of peaceful co-operation with federal authorities, the FBI suddenly told him he was about to not be in the privacy business anymore, that the business he'd poured ten years of his life into would now shamble forward as a living lie, a thrall of the surveillance state it was conceived to oppose in the first place. And the motive for this dramatic move? An attempt to find the guy who broke the news about how much spying the government's been doing. That is, the FBI's instinct about how to handle a scandal about unprecedented levels of domestic surveillance was to increase their level of domestic surveillance.
- acqq 13y agoMore important is that the collection was initially already demanded to be via the FBI's own device (that they referred to as a "pen/trap device") that they were to install and control effectively providing them unwarranted access to all the traffic and all the content of it of all users. Nobody actually gave FBI the warrant to access everything but they were to effectively have the access. Later on they also demanded the SSL keys which have more or less the same effect. There's a major difference between collecting the data of the specific individual under investigation and accessing the data of everybody. And this is the first time such secret orders are accessible to the public.
- pilom 13y agoIn the court transcript the judge says something to the effect of "lavabit is an email provider and email providers in the US are required to comply with US laws. The government has requested information which it is legally entitled to. The fact that you designed your system in such a way to make that difficult does not take precedence over the fact that they are legally entitled to this information." So basically, due to design decisions, the only way for the government to get access to the data they are entitled to, was to hand over the master private key. If lavabit had designed in such a way as to have one key per customer, then the government would have only been legally able to request the single key for that customer. I'm not saying that lavabit should have had an SSL cert per customer, just that the designed in a way which didn't mesh well with US law and they paid the price.
- thrillgore 13y ago"I'm not going to scramble jets to catch some hacker"
- epsylon 13y agoI find it incredibly ironic that in the process of investigating against Snowden's leaks that the NSA is spying on netizens, we see such court orders where feds ask for broad unregulated surveillance where a single targeted tap would have sufficed. The worse is that the judge happily enables this.
- notdonspaulding 13y agoIANAL, so I don't know what the actual process is called, but that judge needs to be fired. When confronted with an issue about which the judge knows nothing, the court basically deferred to whatever the government suggested. I'm not reading into it, it's basically how the transcript reads. I particularly enjoyed this Freudian slip: MR. BINNALL: I would suggest that the government -- I 'm sorry -- that the Court can craft an order to say... The court here is more marionette than anything else, with the FBI on the strings.