14 ms·
Lavabit founder turned over the private SSL keys as an 11 page printout
- stedaniels 13y agoShould have put a typo in there. Can you imagine the double/tripple/etc checking going on!?
- devx 13y agoGoing 7 pages into it: "Wait...which line was I at again?!"
- velik_m 13y agoOr use one of those Xerox copiers that randomly change numbers...
- fnordfnordfnord 13y agoand a funky font that is difficult to OCR.
- mseebach 13y agoThis is what happens when you try to "hack" the legal system as if it was a simple, deterministic computer program (it comes up here frequently as the "FBI wasn't here"-sign-in-library hack). When a judge orders you to do something, you have to comply with the substance of the order, not evade it by sort-of technically complying while actually avoiding it. I have all the respect in the world for Levison, he did the right thing and it takes guts. But trying to "hack" a judge's order is just silly.
- devx 13y agoI don't know. It might've been worth a shot to send it in PDF format the second time, after he asked to deliver it digitally, just as a sign of protest. Didn't Twitter refuse to comply with a judge's order once, too?
- contextual 13y agoLevison's response was a courageous form of protest. Your response is smug and naive. You have no clue what he went through. It's easy to call the right game plays from your armchair.
- rjknight 13y agoI disagree. If the judge wanted an electronic copy then he or she could ask for that, which is indeed what the judge later did. Levison would have known that his initial 'compliance' wouldn't make the problem go away, but it did buy him some time while the judge figured out what to do next (or the FBI figured out that they needed to be more precise in what they were asking for). He didn't refuse to comply at any point - he complied with the original request, at which point the judge gave him fresh instructions and ordered him to comply with those or face a fine. Consider it from another perspective - people often request data from governments or large corporations and, when ordered or pressured into providing it they often do so in the least helpful format available. They are rarely punished for this because the law doesn't really have a position on whether CSV is a better document format than PDFs of scanned printouts, or whether a 50-page printout is more useful than a CD-ROM or USB stick. Why should the rules be any different for someone like Levison?
- xuhu 13y agoofftopic: scrolling through the printout by dragging the scrollbar handle slowly (~3 pages per sec) crashes the chrome renderer (tried on 2 win7-32 boxes)
- stedaniels 13y agoYeah, I got that too. Win 7 - 64bit. Chrome 29
- kevin-brown 13y agoOn Ubuntu x64, it's sluggish (as it's loading) but doesn't crash. It took up a solid 1GB of memory though, according to Chrome.
- rdl 13y agoThe irony would be using the same software/format for this as was used to export the PGP Source Code legally in the 1900s.
- troels 13y agoUpvoted for 1900s. That really makes me feel old.
- ghloto 13y agoThat's not what the upvote function is for, idiot.
- Osmium 13y agoWhat format was that? Edit: Thanks!
- rdl 13y agohttp://www.amazon.com/PGP-Internals-Philip-R-Zimmermann/dp/0262240394 http://www.amazon.com/PGP-Internals-Philip-R-Zimmermann/dp/0... http://www.pgpi.org/pgpi/project/scanning/ http://www.pgpi.org/pgpi/project/scanning/
- keeperofdakeys 13y agohttp://www.pgpi.org/pgpi/project/scanning/ http://www.pgpi.org/pgpi/project/scanning/
- Daniel_Newby 13y agoPerfect forward secrecy, bitches.
- lucian1900 13y agoThat does nothing for future intercepts.
- jlgreco 13y agoThat is what killing your business is for.
- ig1 13y agoDon't do this. If it's a clean print-out it's trivial to OCR at a five nines accuracy rate.
- dalore 13y agoYou would 100% accuracy though. One char difference would render the key useless.
- bcoates 13y agoNot really, you've leaked so much of the key that doing exhaustive search of possible OCR errors becomes trivial.
- tomaac 13y agoDepending on font he used, I believe for OCR some characters might be difficult: o01|IO And even one wrong character makes SSL key wrong.
- ig1 13y agoThere's OCR systems which work on the basis of internal font consistency. They break the page into a series of single character images, and because the same character repeated is close to identical it's trivial to match them up, so you can easily build a map of characters. You then just need a human to label each character once. With a pixel image comparison 0 looks completely different from o. If they're using a standard font then a regular OCR (you'd only need four nines accuracy to get it 100% correct) would be fine, even with a weird font it still be easy to get that level of accuracy.
- shabble 13y agoThe obvious solution to this would be to cycle randomly between fonts every few characters (or keep a running total of the font used for each particular symbol, and ensure it stays below some threshold). For bonus points you could convert the key from base64/ascii to unicode or similar.
- speeq 13y ago"At approximately 1:30p.m. eDT on August 2, 2013, Mr. Levison gave the FBI a printout of what he represented to be the encryption keys needed to operate the penregister. This printout, in what appears to be 4-point type, consists of 11 pages of largely illegible characters. Moreover, each of the five encryption keys contains 512 individual characters - or a total of 2560 characters. To make use of these keys, the FBI would have to manually input all 2560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data."
- drdaeman 13y ago> To make use of these keys, the FBI would have to manually input all 2560 characters They would probably have to OCR the thing.
- johnchristopher 13y agoWhat are interns for ? Or are they "non-essential" employees ?
- Colliwinks 13y agoShould have printed it out as images via ReCaptcha
- archangel_one 13y ago2560 characters isn't that many. You'd have to proofread the OCR'd version anyway, I'd say it'd be easier to just type it in.
- mbq 13y agoSo he did surrender the keys -- this makes his business shutdown move substantially less heroic that everyone thought.
- faceplanter 13y agoIt was ordered by a judge. What do you suggest he would do otherwise?
- markeganfuller 13y agoDelete them before he was ordered to hand them over?
- mbq 13y agoI'm only pointing out that this _may_ mean that the archives were compromised regardless of the fact he heroically shut down the whole thing.
- throwwit 13y agolol... remember this?: http://www.theguardian.com/technology/blog/2012/aug/29/apple-samsung-trucks-nickels-fake http://www.theguardian.com/technology/blog/2012/aug/29/apple...
- jlebrech 13y agoshoulda put it on floppy disks, or minidisks
- rdl 13y agoI really don't get why dude didn't respond to the requests for information with a totally straightfaced, and factual, "we do not have the technical capability to recover messages for a user using the encryption software". Not "we could possibly defeat our own system, but we don't want to." Just the "we do not have the technical capability to do that, but we're happy to turn over any other information which we can provide, pursuant to lawful order or warrant." Be polite, totally responsive, completely honest, but don't go into the "yes, we could possibly build something which would possibly do what you want, but we don't want to."
- Terretta 13y agoSome of us don't like to lie.
- rdl 13y agoIt would be absolutely factual. There's a difference between "we could build x, given months of engineering effort, possibly including outside experts" and "we can do x in response to a court order in our current system, on demand." There is no prior requirement for an email provider to be CALEA compliant, so there doesn't need to be a particular LI function built into the system.
- fnordfnordfnord 13y ago>"we could build x, given months of engineering effort, possibly including outside experts" and "we can do x in response to a court order in our current system, on demand." That sounds almost like a solicitation for work, and I suspect that is the way that others (Google, MS, friendface, et al) replied.
- rdl 13y agoRight, which is why you just answer with "we do not have that facility." Turn over your billing records and other material you do have, but don't turn over anything you don't have, and be unfailingly polite, prompt, and not a dick. It was kind of game over once the search warrant for key came in, unless the keys were in an HSM. As long as you can prevent the search warrant from being issued, a regular pen register isn't going to be terribly onerous if it doesn't produce useful data due to everything being encrypted. If you don't have a system to do user logging, you can honestly respond "we do not have records of messages sent through our system". I don't know if they can even require you to turn logging on if it's not already on in that case; they could get a warrant for your whole system, possibly, but that's a much higher legal bar, and "fine, it's in fedex billed to USG account" might be a reasonable answer there. (IANAL)
- zenocon 13y agoHe should have printed one character per page, and put it in a 2,560 page 3-ring binder.
- aw3c2 13y ago* unnumbered
- ikusalic 13y agoEven if futile, beautiful example of civil disobedience. If only there were more people that at least tried as he did. I'm supporting his rally[1] and hope more people will. [1] https://rally.org/lavabit https://rally.org/lavabit
- ballard 13y agoPassive aggressive ftw. I would have used an excessively decorative script font and not number the pages or identify which keys. Perhaps even a typo or two, that'd buy some time. On the size, 4 pt is generous. I remember printing an allowed note index card for high school final exams in 1 pt Times New Roman on a laser printer @ 600 dpi. At arm's length, it looked like a series of lines, but up-close the text was quite readable. Under magnification, the print quality was amazing.
- deleted 13y ago[deleted]
- wglb 13y agoSounds like an act of malicious obedience.
- jonahx 13y ago"In an attempt at dry humor" I think that is a little better than an "attempt"...
- eli 13y agoSorry, but I'm not a fan. Either comply with the order or don't, but don't play games. This is the same nonsense the government pulls when they want to "technically" comply with a FOIA request, but want to make life as hard as possible for the requester.
- mpyne 13y agoApparently double standards are wrong when the government does it, but are OK when "we" do it. What I'm not a fan of, however, is that Levison had claimed that he's be willing to comply with (indeed, has complied with) specific warrants. He left the impression that the FBI was asking him to ruin his security in general. However the court filings show that the request for the SSL priv keys came only after Levison failed to comply with... a specific warrant relating to Snowden and Snowden alone. So if Levison wasn't lying, he was definitely leaving something major out of his story.
- eli 13y agoAgreed. Though considering there are gag orders in play here, I'm willing to give people the benefit of the doubt.
- anaphor 13y agoHe was probably still working on a way to compromise Snowden while leaving all of the users still secure, and the FBI was probably just impatient. But that's pure speculation on my part.
- mpyne 13y agoFrom what I can gather in the released order, the FBI didn't actually ask for Snowden's communications to be compromised anyways, they wanted the "connection information" (i.e. IP addresses, any metadata). I don't understand why Levison didn't think he could comply with that, unless it was completely impossible for him to implement. But he never told the FBI it was technically impossible, he told them that he would not (as opposed to "could not") do it.
- debacle 13y agoThis man is a hero. I don't know if he's a saint (he's probably not - no one is), but he's definitely a hero.
- bhauer 13y agoFYI, I would guess that Attachment A starting on page 144 is a reproduction of the keys in a very small font. If that is correct, they are indeed illegible.
- drucken 13y agoIsn't the key this sentence: "Wired reported the government as complaining that a Lavabit representative indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system."? If they used something like Perfect Forward Secrecy, could they not legitimately have claimed to be unable to defeat their own system (as it is currently configured)?
- jloughry 13y agoTHE POLICE HAVE REQUESTED ALL FILES UNDER DIRECTORY TITLE RAND. "Dump it for them at 300 baud." "Art! Are you sure?" "We cleaned Rand's directory first thing. Took out everything not routine, then we added a few files. Old engineering catalogs. Maintenance schedules. Ratings of TV shows. Makes a pretty big file---" MILLIE, what is the total stored in Rand's directory? 23,567,892 BYTES "Good Lord. Art, that will take hours to print out---" "Yeah, that gives the cops a hobby." [1] [1] Larry Niven and Jerry Pournelle. Oath of Fealty. New York: Pocket Books, 1981. ISBN 0-671-82802-9, pp. 287--8.
- Fuxy 13y agoTechnically speaking he did comply with the order. They never specified what format it should be in. Plus companies shouldn't be required to beautify data for the government. They got what they asked for it-s up to them to figure out how to use it. I know this is a bit sneaky this time but if they allow this to stand then soon companies will have to employ full time staff to beatify data for the government with pretty graphs and such because a database dump is incomprehensible. It's like a kid asking you how to make a website and then complaining that HTML, CSS, JavaScript,etc is incomprehensible.
- wellboy 13y agoBut you can simply scan 11 pages in and run a software over it that reads all characters. There´s lots of software like that. This would have taken the FBI 20 mins...
- lectrick 13y agoSmarter would have been to copyright the keys so that giving them a copy would violate DMCA. Take THAT!
- joelrunyon 13y agoThe worst part about this is that it's not even that hard to fix. If you wanted to - you could hire a VA for $5/hour to digitize it (and hire another to QA). Total cost probably less than $100. So intrusive AND lazy :).