4 ms·

> Lavabit intentionally structured their service such that there were only two ways to get at a criminal's email: obtain a copy of the suspect's private key or

by jules 13y ago

> Lavabit intentionally structured their service such that there were only two ways to get at a criminal's email: obtain a copy of the suspect's private key or compromise the entire service. This is a very disingenuous way of phrasing this. A far more accurate way of phrasing this is: lavabit did not implement a feature that would allow you to compromise a specific user's emails. They simply implemented the most secure option. Of course you can compromise any user of a service by compromising the whole service. That is not something they did "intentionally", that is simply how the world works. If it were possible to make it completely impossible to compromise a user's emails, I'm sure they would have done so.

pflats 13y ago
If you're offering encryption as a service, you need to consider technological and legal best practices[1]. If, at any point, you have the technological ability to see a client's plaintext, that's something you need to strongly address. The most secure technological option is not always the most secure option. If you don't trust the government, then you have to choose one of 3 options: 1. Consider a system that's resilient against rubber-hose techniques (aka warrants and contempt of court). You'll probably want one where you are technologically incapable of seeing the plaintext. Perhaps offer your paying customers the option of using an open-source program or browser extension. 2. Consider a less technologically secure system where you have access to private keys so that you can fold on one client but not every one. 3. Consider never visiting that country again. I'm not sure what other choices you really have. Obviously, we can all campaign for better privacy. We can support the EFF and the ACLU, as I do. But we have to work within the laws of our countries, or they'll come down very hard on us. [1]After this incident, the only way I see Encryption as a Service as being sustainable is an open-source suite with consultation contracts.
- jules 13y ago
  The thing is, you can't design a web based system where you can't read the plaintext. If you have to give up your SSL key all bets are off. The FBI can perform a MITM attack to your users. The best you can do in that case is shut down the service, which is what they did.

by jules 13y ago

pflats 13y ago

If you're offering encryption as a service, you need to consider technological and legal best practices[1]. If, at any point, you have the technological ability to see a client's plaintext, that's something you need to strongly address. The most secure technological option is not always the most secure option. If you don't trust the government, then you have to choose one of 3 options: 1. Consider a system that's resilient against rubber-hose techniques (aka warrants and contempt of court). You'll probably want one where you are technologically incapable of seeing the plaintext. Perhaps offer your paying customers the option of using an open-source program or browser extension. 2. Consider a less technologically secure system where you have access to private keys so that you can fold on one client but not every one. 3. Consider never visiting that country again. I'm not sure what other choices you really have. Obviously, we can all campaign for better privacy. We can support the EFF and the ACLU, as I do. But we have to work within the laws of our countries, or they'll come down very hard on us. [1]After this incident, the only way I see Encryption as a Service as being sustainable is an open-source suite with consultation contracts.

jules 13y ago
The thing is, you can't design a web based system where you can't read the plaintext. If you have to give up your SSL key all bets are off. The FBI can perform a MITM attack to your users. The best you can do in that case is shut down the service, which is what they did.