4 ms·

I am blown away by the bravery, I know I'd never be so bold. Also confused why he didn't end up in prison on mysterious "pervert" charges out of the blue or ev

by ck2 13y ago

I am blown away by the bravery, I know I'd never be so bold. Also confused why he didn't end up in prison on mysterious "pervert" charges out of the blue or even dead. And don't lecture me that is far fetched after this past year.

tomp 13y ago
Well, if they killed him, they probably wouldn't be able to get the keys. And they probably had to keep the bigger "punishment", imprisonment, looming over his head in case he reveals confidential information about the case.
- jobu 13y ago
  It wouldn't surprise me if they had some sort of back door with Verisign or other certificate companies for this.
  - bigiain 13y ago
    I'm 100% sure they do, but if you're careful when setting p your SSL/TLS keys, verisign (or any other CA) never sees your private keys, they just sign your CSR. If the FBI had wanted to, they could have seized the servers, and either broken into them and replaced the private key with their own, or replaced the servers with ones they'd built with their own ssl key pairs. But, as the article points out - what they were trying _very_ hard to get was complete infiltration of the entire Lavanit operation without any of the 400,000 paying customers of the supposedly secure email provider knowing about it. Kudos to Levinson for not allowing that to happen, to his great personal cost. (I doubt I'd have the courage to do the same)
  - alexwright 13y ago
    CA like Verisign don't have the key though, this misconception is too common. If you're doing it right the CA is just signing a cert you've generated, they never see the key.
    - nitrogen 13y ago
      Having CA access does allow them to create a silent MITM in the absence of certificate pinning.
      - alexwright 13y ago
        With a different key though. Once you've got this new cert. you can MITM, but you can't use it to decrypt the traffic already captured. Also anyone paying attention sees the cert. fingerprint change out of the blue.
        delinka 13y ago
        A) Law enforcement doesn't need to decrypt previously-captured traffic; they either want to fish for criminal activity or they'll allow their target to build up new incriminating evidence. B) Who pays attention?
        alexwright 13y ago
        A) That's what they were after though: “all information necessary to decrypt data stored in or otherwise associated with [the account].” A rogue cert and MITM would get the password for the account though, unless B. B) Anyone who knows what they're doing and has something they really want to keep secret? Maybe if someone had such a secret they'd learn to check the cert, maybe even install an extension that would highlight unexpected changes.
    - renata 13y ago
      Most people aren't verifying that the cert doesn't change every time they visit a site though - if they have Verisign sign a new cert and replace the old one 99% of users will never notice, because their browsers won't yell at them.
- 3327 13y ago
  The guardian said Snowden is to release US gov't assassination program documentation in a weeks time. So perhaps we will get insight on the in inner workings of systematic killing.
  - hobolobo 13y ago
    I believe the preferred nomenclature is 'targeted killing'.
    - gknoy 13y ago
      I'll be surprised if it doesn't have some whitewashed name like "Citzenship Revocation Program" that lets people talk about it without saying "killing".
      - sigkill 13y ago
        More like "Citizen Revocation Program". Wouldn't want citizenship reduced and people earning and paying taxes to other countries.
annnnd 13y ago
Maybe they read 1984 as a manual: don't destroy him, convert him. Or at least make an example of him.
JshWright 13y ago
It didn't happen because that sort of thing doesn't generally happen. Simply raising the specter of 'this past year' doesn't prove some vast conspiracy on the part of the government (or maybe it's the puppetmasters who control the 'real' government?).

by ck2 13y ago

tomp 13y ago

Well, if they killed him, they probably wouldn't be able to get the keys. And they probably had to keep the bigger "punishment", imprisonment, looming over his head in case he reveals confidential information about the case.

jobu 13y ago
It wouldn't surprise me if they had some sort of back door with Verisign or other certificate companies for this.
- bigiain 13y ago
  I'm 100% sure they do, but if you're careful when setting p your SSL/TLS keys, verisign (or any other CA) never sees your private keys, they just sign your CSR. If the FBI had wanted to, they could have seized the servers, and either broken into them and replaced the private key with their own, or replaced the servers with ones they'd built with their own ssl key pairs. But, as the article points out - what they were trying _very_ hard to get was complete infiltration of the entire Lavanit operation without any of the 400,000 paying customers of the supposedly secure email provider knowing about it. Kudos to Levinson for not allowing that to happen, to his great personal cost. (I doubt I'd have the courage to do the same)
- alexwright 13y ago
  CA like Verisign don't have the key though, this misconception is too common. If you're doing it right the CA is just signing a cert you've generated, they never see the key.
  - nitrogen 13y ago
    Having CA access does allow them to create a silent MITM in the absence of certificate pinning.
    - alexwright 13y ago
      With a different key though. Once you've got this new cert. you can MITM, but you can't use it to decrypt the traffic already captured. Also anyone paying attention sees the cert. fingerprint change out of the blue.
      - delinka 13y ago
        A) Law enforcement doesn't need to decrypt previously-captured traffic; they either want to fish for criminal activity or they'll allow their target to build up new incriminating evidence. B) Who pays attention?
        alexwright 13y ago
        A) That's what they were after though: “all information necessary to decrypt data stored in or otherwise associated with [the account].” A rogue cert and MITM would get the password for the account though, unless B. B) Anyone who knows what they're doing and has something they really want to keep secret? Maybe if someone had such a secret they'd learn to check the cert, maybe even install an extension that would highlight unexpected changes.
  - renata 13y ago
    Most people aren't verifying that the cert doesn't change every time they visit a site though - if they have Verisign sign a new cert and replace the old one 99% of users will never notice, because their browsers won't yell at them.
3327 13y ago
The guardian said Snowden is to release US gov't assassination program documentation in a weeks time. So perhaps we will get insight on the in inner workings of systematic killing.
- hobolobo 13y ago
  I believe the preferred nomenclature is 'targeted killing'.
  - gknoy 13y ago
    I'll be surprised if it doesn't have some whitewashed name like "Citzenship Revocation Program" that lets people talk about it without saying "killing".
    - sigkill 13y ago
      More like "Citizen Revocation Program". Wouldn't want citizenship reduced and people earning and paying taxes to other countries.

annnnd 13y ago

Maybe they read 1984 as a manual: don't destroy him, convert him. Or at least make an example of him.

JshWright 13y ago

It didn't happen because that sort of thing doesn't generally happen. Simply raising the specter of 'this past year' doesn't prove some vast conspiracy on the part of the government (or maybe it's the puppetmasters who control the 'real' government?).