4 ms·

Can someone weight in on what this means or why it is an issue?

conductor 13y ago
Ladar Levison was forced to give Lavabit's SSL private key to the feds, so it is no more secure. That's why he (or GaDaddy, the issuer) revoked the certificate.
- nly 13y ago
  If the Feds seized the server why would it be a surprise that the SSL certificate has been compromised? The server is where the private key lives...
  - conductor 13y ago
    They didn't seize the server.
miketucker 13y ago
Today the owner, Ladar Levison, had to hand over the SSL certificates by court order. It marks the ending of a long battle in court, with unfortunately it ending in the govenment's favor. I'm assuming the post is just a hacker way of acknowledging the event. Related article: http://www.newyorker.com/online/blogs/elements/2013/10/how-lavabit-edward-snowden-email-service-melted-down.html http://www.newyorker.com/online/blogs/elements/2013/10/how-l...
- dedward 13y ago
  More likely it's just the issuer doing what they need to do... it doens't matter that nobody will use it again anyway; from an issuer point of view, the certificate should no longer be valid. time to revoke it.
- mpyne 13y ago
  Interesting link, and much more informative than the other Lavabit news articles. It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. The judge is correct in stating that if Levison doesn't trust the government, then why should the government trust Levison, but Levison is clearly correct when he notes that giving up his SSL private keys would destroy the security of his whole infrastructure. The government would have been far better off by allowing a service like Lavabit to exist with the cooperation of an activist citizen than to force him to either harm all of his customers or shutdown the service. Somehow I don't think the D.A. here realized how serious many civil libertarians are. Props on Levison for trying to stick it out in the U.S. and make things better from within!
  - quadlock 13y ago
    > The judge is correct in stating that if Levison doesn't trust the government, then why should the government trust Levison The judge is incorrect. The U.S. Government was designed to not completely trust itself. That's why there are checks and balances. Giving the FBI the private key lets them have unchecked access to data encrypted with it. It is wrong to asked to not be checked. [edited for format]
    - Zoepfli 13y ago
      Also, we have ample proof that the US Government cannot be trusted period. An entity that cannot be trusted can still reflect on itself, realize it has done lots of wrongs, and trust others that are reaching for higher standards.
    - interstitial 13y ago
      Checks and balances are passe. They are the antiquated notions of dead men. With computers and the internet ensuring the proper administration of justice via self-appointed and self-reviewed secret committees, we can finally live in peace and security.
  - 13y ago
stonemetal 13y ago
If lavabit returns to operation, or someone tries to pretend to be lavabit by using the cert then any visitor to the site would get a cert error until they get a new cert.

Ladar Levison was forced to give Lavabit's SSL private key to the feds, so it is no more secure. That's why he (or GaDaddy, the issuer) revoked the certificate.

nly 13y ago
If the Feds seized the server why would it be a surprise that the SSL certificate has been compromised? The server is where the private key lives...
- conductor 13y ago
  They didn't seize the server.

miketucker 13y ago

Today the owner, Ladar Levison, had to hand over the SSL certificates by court order. It marks the ending of a long battle in court, with unfortunately it ending in the govenment's favor. I'm assuming the post is just a hacker way of acknowledging the event. Related article: http://www.newyorker.com/online/blogs/elements/2013/10/how-lavabit-edward-snowden-email-service-melted-down.html http://www.newyorker.com/online/blogs/elements/2013/10/how-l...

dedward 13y ago
More likely it's just the issuer doing what they need to do... it doens't matter that nobody will use it again anyway; from an issuer point of view, the certificate should no longer be valid. time to revoke it.
mpyne 13y ago
Interesting link, and much more informative than the other Lavabit news articles. It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. The judge is correct in stating that if Levison doesn't trust the government, then why should the government trust Levison, but Levison is clearly correct when he notes that giving up his SSL private keys would destroy the security of his whole infrastructure. The government would have been far better off by allowing a service like Lavabit to exist with the cooperation of an activist citizen than to force him to either harm all of his customers or shutdown the service. Somehow I don't think the D.A. here realized how serious many civil libertarians are. Props on Levison for trying to stick it out in the U.S. and make things better from within!
- quadlock 13y ago
  > The judge is correct in stating that if Levison doesn't trust the government, then why should the government trust Levison The judge is incorrect. The U.S. Government was designed to not completely trust itself. That's why there are checks and balances. Giving the FBI the private key lets them have unchecked access to data encrypted with it. It is wrong to asked to not be checked. [edited for format]
  - Zoepfli 13y ago
    Also, we have ample proof that the US Government cannot be trusted period. An entity that cannot be trusted can still reflect on itself, realize it has done lots of wrongs, and trust others that are reaching for higher standards.
  - interstitial 13y ago
    Checks and balances are passe. They are the antiquated notions of dead men. With computers and the internet ensuring the proper administration of justice via self-appointed and self-reviewed secret committees, we can finally live in peace and security.
- 13y ago

stonemetal 13y ago

If lavabit returns to operation, or someone tries to pretend to be lavabit by using the cert then any visitor to the site would get a cert error until they get a new cert.