5 ms·

Thanks to Lavabit’s design, Levison could not simply offer a tap of a particular user’s communications if that user had paid for a secure, encrypted account. T

Thanks to Lavabit’s design, Levison could not simply offer a tap of a particular user’s communications if that user had paid for a secure, encrypted account. That line really bothered me. The government demanded access to all user's data and this line places the responsibility for that onto Lavabit. The government wants all of our data, all of the time. They are the responsible party not Lavabit.

rtpg 13y ago
While the government might want all of our data, the NSL in question (at least according to the New Yorker piece ) requested only the data on one user(presumably Snowden). Levison was unwilling to put the software into place to tap into this single person's communcation. There was a warrant, but he wanted to charge $3.5k for the effort. I don't know how I feel about that. In any case the Judge then said to just hand over the SSL keys so that they could do it "the old fashioned way" (listening to everything on the line). Anyways, the point is that the original intent was not to get everyone's data, yet this is the point everyone keeps on parroting. The original intent was always to specifically get this single user's information, not some sort of power play by the FBI. Maybe things changed down the line but I feel like none of us are in a position to know that (although who knows, Mulder might spend his time trolling HN)
- uxp 13y ago
  > There was a warrant, but he wanted to charge $3.5k for the effort. I don't know how I feel about that. How would you feel if the police/FBI came to you with a warrant that requested all video footage from outside your home so they could spy on your neighbor's comings and goings. Oh, and by the way, you don't have a security camera system, and they aren't going to reimburse you to install one. If you do not produce video evidence, you are then disobeying the warrant and are in contempt of court. Lavabit's system was not designed to listen in to one persons communications. It would cost money to implement that system. He requested he be compensated for his effort ($3500 is a piddly amount of money anyways), and they came back and said that was too much effort, so they'll take the entire thing. Back to the analogy, should the cops/FBI be able to possess your home in order to spy on your neighbor because you don't have a security system installed?
  - cstejerean 13y ago
    Apparently yes, the police have commandeered a home to spy on the neighbors. https://www.courthousenews.com/2013/07/03/59061.htm https://www.courthousenews.com/2013/07/03/59061.htm
  - rtpg 13y ago
    your analogy is wrong, it'd be more like "should the cops be able to get keys to your house". In fact , it isn't even that, it's "should the cops be able to see who is coming in and out of your house, and searching them when they come in". How did Lavabit's system work? I mean at one point there's an entry point, and the FBI wanted the info for the metadata, so just checking at the entry point for who's logging in would do it. You're going to have to convince me that it's non-trivial to implement something to scrape the metadata at the door (as in more than a couple hours work at most). I don't know how to feel about it because $3500 is way too much money for what is asked, if this were a contracting job, and I think that if the police have a warrant for something they are reasonably entitled to what they're looking for. But asking people to do work without compensation.... I feel like there must be a precedent somewhere. At one point things become obstruction. I don't know what we should consider to be reasonable in these situations.
    - rpedroso 13y ago
      Remember that Levinson was not just a private contractor looking for work; taking time to build a whole new wiretapping system into his product wouldn't just cost him development time, but it's an opportunity cost as well, since he could have spent that time otherwise developing his business. As for the triviality of implementing a metadata tap, I don't think the FBI was looking just for Snowden's IP address and browser. IIRC, they wanted metadata from his communications: email titles, recipient email addresses, time of transmission, etc. Lavabit was designed in a way that this was impossible. Levinson would have had to implement a system that flagged particular users and then saved metadata before encryption. In a production, business environment, this isn't just a one-liner. Especially given the security-focused nature of Lavabit, the required development time and effort makes $3500 appropriate for the task.
Bahamut 13y ago
That line bothers me too, but for a different reason - isn't the onus on a business owner to offer a reasonable avenue for obtaining information on email records when presented with a warrant? I suspect that the architecture of the service would make an appeal all the way up to the Supreme Court extraordinarily difficult to win, since there is plenty to question, and that it is not a clear example of being compliant & being penalized unrightfully given the circumstance. I would not expect much to come from this appeal - looking in from the outside, the case doesn't appear terribly strong.
betterunix 13y ago
That line bothers me for a different reason: it is not true. Nothing in Lavabit's design prevented Ladar from tapping any one user's communications. In fact, the entire design of Lavabit makes it possible, since all cryptographic operations are performed server-side. What the line should say is, "Thanks to Lavabit's design, Ladar would have had to spend half an hour coding a wiretapping solutoin."
- swalkergibson 13y ago
  Regardless of how long it would take to implement such a solution, the fact that he took such a principled stand against the entire might of the US government is extraordinarily commendable. The ire around this case should be directed exclusively at the agencies and parties involved in creating this rapidly growing police state, not at the people who are involved in making the story public. The world needs more people like Ladar Levison.
  - betterunix 13y ago
    Yes, it is comendable that Ladar took a stand. That does not change the fact that Lavabit did not provide its users with the kind of security that people claim. If Ladar had been less principled, then what? We need people who will take stands, but we also need systems that are inherently hard to wiretap.
    - swalkergibson 13y ago
      I agree that crypto is no doubt the best way to go. However, it seems clear that in the case they do not get what they want initially, the next step is, "Okay, we'll just take it all." God bless the USA...

rtpg 13y ago

While the government might want all of our data, the NSL in question (at least according to the New Yorker piece ) requested only the data on one user(presumably Snowden). Levison was unwilling to put the software into place to tap into this single person's communcation. There was a warrant, but he wanted to charge $3.5k for the effort. I don't know how I feel about that. In any case the Judge then said to just hand over the SSL keys so that they could do it "the old fashioned way" (listening to everything on the line). Anyways, the point is that the original intent was not to get everyone's data, yet this is the point everyone keeps on parroting. The original intent was always to specifically get this single user's information, not some sort of power play by the FBI. Maybe things changed down the line but I feel like none of us are in a position to know that (although who knows, Mulder might spend his time trolling HN)

uxp 13y ago
> There was a warrant, but he wanted to charge $3.5k for the effort. I don't know how I feel about that. How would you feel if the police/FBI came to you with a warrant that requested all video footage from outside your home so they could spy on your neighbor's comings and goings. Oh, and by the way, you don't have a security camera system, and they aren't going to reimburse you to install one. If you do not produce video evidence, you are then disobeying the warrant and are in contempt of court. Lavabit's system was not designed to listen in to one persons communications. It would cost money to implement that system. He requested he be compensated for his effort ($3500 is a piddly amount of money anyways), and they came back and said that was too much effort, so they'll take the entire thing. Back to the analogy, should the cops/FBI be able to possess your home in order to spy on your neighbor because you don't have a security system installed?
- cstejerean 13y ago
  Apparently yes, the police have commandeered a home to spy on the neighbors. https://www.courthousenews.com/2013/07/03/59061.htm https://www.courthousenews.com/2013/07/03/59061.htm
- rtpg 13y ago
  your analogy is wrong, it'd be more like "should the cops be able to get keys to your house". In fact , it isn't even that, it's "should the cops be able to see who is coming in and out of your house, and searching them when they come in". How did Lavabit's system work? I mean at one point there's an entry point, and the FBI wanted the info for the metadata, so just checking at the entry point for who's logging in would do it. You're going to have to convince me that it's non-trivial to implement something to scrape the metadata at the door (as in more than a couple hours work at most). I don't know how to feel about it because $3500 is way too much money for what is asked, if this were a contracting job, and I think that if the police have a warrant for something they are reasonably entitled to what they're looking for. But asking people to do work without compensation.... I feel like there must be a precedent somewhere. At one point things become obstruction. I don't know what we should consider to be reasonable in these situations.
  - rpedroso 13y ago
    Remember that Levinson was not just a private contractor looking for work; taking time to build a whole new wiretapping system into his product wouldn't just cost him development time, but it's an opportunity cost as well, since he could have spent that time otherwise developing his business. As for the triviality of implementing a metadata tap, I don't think the FBI was looking just for Snowden's IP address and browser. IIRC, they wanted metadata from his communications: email titles, recipient email addresses, time of transmission, etc. Lavabit was designed in a way that this was impossible. Levinson would have had to implement a system that flagged particular users and then saved metadata before encryption. In a production, business environment, this isn't just a one-liner. Especially given the security-focused nature of Lavabit, the required development time and effort makes $3500 appropriate for the task.

Bahamut 13y ago

That line bothers me too, but for a different reason - isn't the onus on a business owner to offer a reasonable avenue for obtaining information on email records when presented with a warrant? I suspect that the architecture of the service would make an appeal all the way up to the Supreme Court extraordinarily difficult to win, since there is plenty to question, and that it is not a clear example of being compliant & being penalized unrightfully given the circumstance. I would not expect much to come from this appeal - looking in from the outside, the case doesn't appear terribly strong.

betterunix 13y ago

That line bothers me for a different reason: it is not true. Nothing in Lavabit's design prevented Ladar from tapping any one user's communications. In fact, the entire design of Lavabit makes it possible, since all cryptographic operations are performed server-side. What the line should say is, "Thanks to Lavabit's design, Ladar would have had to spend half an hour coding a wiretapping solutoin."

swalkergibson 13y ago
Regardless of how long it would take to implement such a solution, the fact that he took such a principled stand against the entire might of the US government is extraordinarily commendable. The ire around this case should be directed exclusively at the agencies and parties involved in creating this rapidly growing police state, not at the people who are involved in making the story public. The world needs more people like Ladar Levison.
- betterunix 13y ago
  Yes, it is comendable that Ladar took a stand. That does not change the fact that Lavabit did not provide its users with the kind of security that people claim. If Ladar had been less principled, then what? We need people who will take stands, but we also need systems that are inherently hard to wiretap.
  - swalkergibson 13y ago
    I agree that crypto is no doubt the best way to go. However, it seems clear that in the case they do not get what they want initially, the next step is, "Okay, we'll just take it all." God bless the USA...