7 ms·

Lavabit to Briefly Reinstate Services for Data Recovery

51 points by welder 13y ago

bennyg 13y ago
I know it goes to another website, but is the database connecting to the new website, or is the new website connecting to the old website that connects to the DB? I feel like this matters for SSL reasons.
lm741 13y ago
This is sketchy. The new server no longer attempts to provide any forward security. For the old (now revoked) site, Chrome would use: TLS_DHE_RSA_WITH_AES_256_CBC_SHA. For the new liberty.lavabit.com site, Chrome will pick TLS_RSA_WITH_AES_256_CBC_SHA with the new server. This means that instead of having to factor a 1024 bit dh parameter for each session, the FBI/NSA/etc will be able to be able to decrypt traffic to this server when they get the private key. https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavabit.com https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavab... https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com
- lm741 13y ago
  Follow up: I emailed support@lavabit.com asking them to update their configuration and linking them to https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS (Thanks for posting that, jvehent)
lurkinggrue 13y ago
Wait! Didn't he erase the servers? Wasn't that the point? <Akbar> It's a Trap! </Akbar>
- inigoesdr 13y ago
  If he had erased them he wouldn't have needed to give up the encryption key and he wouldn't have had as much of a problem giving it up unless he used it elsewhere.
  - Karunamon 13y ago
    I'd assume that the bad guys with guns would have attempted to spin that into a "destruction of evidence" charge or similar too.
svag 13y ago
Here is the announcement https://liberty.lavabit.com/ https://liberty.lavabit.com/
Mithrandir 13y ago
He mentioned this in an interview with CNET: http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-predicts-long-fight-with-feds-q-a/ http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-p... "What happens to your customer's e-mails and data? Levison: I'm looking into setting up a site where users can download their data and set up a forwarding [e-mail] address, but that may take a week or two to set up. That's all I can do until I feel confident that I can resume the service without having to compromise its integrity. I will make it clear that I don't plan to use any encryption for that site. [People] should only use it if they feel comfortable with the information being intercepted. And yes, I do plan to have that disclaimer on the site. Unfortunately, what's become clear is that there's no protections in our current body of law to keep the government from compelling us to provide the information necessary to decrypt those communications in secret. I'm still looking at seeing if that's even logistically feasible -- there's half a billion messages [sent in the 10 years Lavabit operated]. By shutting down the service, I will be losing the infrastructure that I used to support all those people. There's stuff that I can't share with my own lawyer. This is going to be a long fight."
- spc476 13y ago
  "There's stuff that I can't share with my own lawyer." That right there says to me that he can bring that issue up as a violation of his Constitutional rights (Amendment VI---"and to have the Assistance of Counsel for his defense."). It's insane that he can't talk to his lawyers.
  - eli 13y ago
    Who said he's the defendant?
    - jlgreco 13y ago
      If he cannot talk with a lawyer, how can he even be sure that he isn't a defendant? Is he suppose to learn law himself? How can he even know if such a restriction is even legal and enforceable, if he cannot talk with a lawyer? How can he challenge their questionable interpretation of whatever laws may make this legal, if he cannot talk with a lawyer? How can he be sure that, by complying with whatever requests they make, he isn't inadvertently committing crimes that he can later be charged for? Nobody should ever be forbidden from consulting a lawyer, particularly when dealing with other lawyers. These gag orders are a minefields designed to dismember anyone who finds themselves in them; they have absolutely no place in a free society.
sneak 13y ago
Wait, isn't this the service that encrypted all the user's data to a key encrypted with the user's passphrase? And now the NSA wants his users' keys, and presumably has the encrypted versions (and the data encrypted to them, too). Now we're all going to log in and give them the missing puzzle piece so that they can decrypt the keys and then decrypt the messages? That doesn't make much sense now, does it?
- MichaelGG 13y ago
  Yeah, why don't they expose a way to download your encrypted data, along with source code to show how to decrypt it?
- tomphoolery 13y ago
  Yeah if I had a Lavabit account I'd just stay far far away from the data. Who knows who's watching, and what puzzle pieces they can now put together..
- n09n 13y ago
  Not only does it make sense, that's the whole point.

51 points by welder 13y ago

I know it goes to another website, but is the database connecting to the new website, or is the new website connecting to the old website that connects to the DB? I feel like this matters for SSL reasons.

lm741 13y ago

This is sketchy. The new server no longer attempts to provide any forward security. For the old (now revoked) site, Chrome would use: TLS_DHE_RSA_WITH_AES_256_CBC_SHA. For the new liberty.lavabit.com site, Chrome will pick TLS_RSA_WITH_AES_256_CBC_SHA with the new server. This means that instead of having to factor a 1024 bit dh parameter for each session, the FBI/NSA/etc will be able to be able to decrypt traffic to this server when they get the private key. https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavabit.com https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavab... https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com

lm741 13y ago
Follow up: I emailed support@lavabit.com asking them to update their configuration and linking them to https://wiki.mozilla.org/Security/Server_Side_TLS https://wiki.mozilla.org/Security/Server_Side_TLS (Thanks for posting that, jvehent)

lurkinggrue 13y ago

Wait! Didn't he erase the servers? Wasn't that the point? <Akbar> It's a Trap! </Akbar>

inigoesdr 13y ago
If he had erased them he wouldn't have needed to give up the encryption key and he wouldn't have had as much of a problem giving it up unless he used it elsewhere.
- Karunamon 13y ago
  I'd assume that the bad guys with guns would have attempted to spin that into a "destruction of evidence" charge or similar too.

svag 13y ago

Here is the announcement https://liberty.lavabit.com/ https://liberty.lavabit.com/

Mithrandir 13y ago

He mentioned this in an interview with CNET: http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-predicts-long-fight-with-feds-q-a/ http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-p... "What happens to your customer's e-mails and data? Levison: I'm looking into setting up a site where users can download their data and set up a forwarding [e-mail] address, but that may take a week or two to set up. That's all I can do until I feel confident that I can resume the service without having to compromise its integrity. I will make it clear that I don't plan to use any encryption for that site. [People] should only use it if they feel comfortable with the information being intercepted. And yes, I do plan to have that disclaimer on the site. Unfortunately, what's become clear is that there's no protections in our current body of law to keep the government from compelling us to provide the information necessary to decrypt those communications in secret. I'm still looking at seeing if that's even logistically feasible -- there's half a billion messages [sent in the 10 years Lavabit operated]. By shutting down the service, I will be losing the infrastructure that I used to support all those people. There's stuff that I can't share with my own lawyer. This is going to be a long fight."

spc476 13y ago
"There's stuff that I can't share with my own lawyer." That right there says to me that he can bring that issue up as a violation of his Constitutional rights (Amendment VI---"and to have the Assistance of Counsel for his defense."). It's insane that he can't talk to his lawyers.
- eli 13y ago
  Who said he's the defendant?
  - jlgreco 13y ago
    If he cannot talk with a lawyer, how can he even be sure that he isn't a defendant? Is he suppose to learn law himself? How can he even know if such a restriction is even legal and enforceable, if he cannot talk with a lawyer? How can he challenge their questionable interpretation of whatever laws may make this legal, if he cannot talk with a lawyer? How can he be sure that, by complying with whatever requests they make, he isn't inadvertently committing crimes that he can later be charged for? Nobody should ever be forbidden from consulting a lawyer, particularly when dealing with other lawyers. These gag orders are a minefields designed to dismember anyone who finds themselves in them; they have absolutely no place in a free society.

sneak 13y ago

Wait, isn't this the service that encrypted all the user's data to a key encrypted with the user's passphrase? And now the NSA wants his users' keys, and presumably has the encrypted versions (and the data encrypted to them, too). Now we're all going to log in and give them the missing puzzle piece so that they can decrypt the keys and then decrypt the messages? That doesn't make much sense now, does it?

MichaelGG 13y ago
Yeah, why don't they expose a way to download your encrypted data, along with source code to show how to decrypt it?
tomphoolery 13y ago
Yeah if I had a Lavabit account I'd just stay far far away from the data. Who knows who's watching, and what puzzle pieces they can now put together..
n09n 13y ago
Not only does it make sense, that's the whole point.