4 ms·

Perhaps I'm being daft, but I'm struggling to see the connection between SSL certs ( per the Lavabit scenario ) and a VPN service. Didn't they have an IPSec ce

Perhaps I'm being daft, but I'm struggling to see the connection between SSL certs ( per the Lavabit scenario ) and a VPN service. Didn't they have an IPSec cert for each individual subscriber? If not.. I wouldn't have wanted to go anywhere near them if they were using one keypair for all traffic. Public-facing websites are usually dependent on a single server cert because they can't easily provide a separate client cert for everyone who visits. A private, subscription-based service should not be using that model and thus should not have encountered the 'Lavabit Paradox'. Neither should Lavabit, but I digress.

Udo 13y ago
The prospect of the government demanding all your encryption keys is probably just one of the threats. Apparently they shut down CS because they simply don't want to enable the security apparatus spying on their customers.
rdl 13y ago
The problem is a pen trap order, which is a very low legal bar, far lower than probable cause, can be applied to any single customer. Since we couldn't implement that effectively, we would be forced to give all of that customer's raw traffic to the government. It's entirely likely they would also compel an entire node or even the entire system if they felt that was more effective for their purposes in any way. If the bar set to do this were at search warrant level (probable cause of criminal activity), that would still kind of suck, but the bar for pen traps being so low by comparison totally invalidates our security model. All US providers (including "foreign" providers with US principals or US operations) are vulnerable to this specific problem right now. There are technical ways to deal with this, but it would take months to implement, and no one has done it before. I've got a bunch of talks scheduled for conferences over the next year on how to implement exactly this (and am working on the tech for it), but it's not going to be instantaneous. We didn't want to be in the position of screwing over even one customer in the interim. Until that stuff is in place, my recommendation is to use a non-US VPN provider. There, you're still at risk to local search warrants, but those are a relatively high legal standard in some jurisdictions. The problem in the US is that the lavabit case implies a much lower legal standard to effectively compel all traffic. It'll probably be a year or two before this plays itself out in the courts. Hopefully 6-9 months for a much stronger technical solution. I'm actually working with some pretty kickass legal people on v2. (as always, I Am Not A Lawyer; I Am Not Your Lawyer; This is not legal advice; Consult an attorney licensed in your jurisdiction for specific legal advice in your particular case.)
- erichocean 13y ago
  I'm actually working with some pretty kickass legal people on v2. Can you say who they are? I'm looking for legal advice in this area as well (and I'm not a competitor to CrytoSeal in any way). Our service is currently in Australia (only), but I'm an owner, based in the US, and by design we also aren't able to support a pen trap order without the same problems you've encountered. It's sucks when crypto best-practices are, effectively, either illegal or useless.
  - rdl 13y ago
    Law students and their professors; I don't think my "bro deal" with them is transferable, sadly. (we're trying to get law review and/or conference papers out of it, too) The whole thing is quite unsettled right now, and unique to every case. I'd probably contact EFF. If I were looking for someone to pay, Marcia Hofmann is now a commercial option, and she's probably the best in the world.
    - agwa 13y ago
      Please consider also looking for a criminal defense attorney with significant experience defending people in federal court. When it hits the fan and you get a court order and are being threatened by federal prosecutors, lawprofs don't do you much good. You need someone who has experience fighting back. Here's a criminal defense attorney who makes the case for this better than I could: http://blog.simplejustice.us/2013/10/03/lavabits-levisons-really-bad-call/ http://blog.simplejustice.us/2013/10/03/lavabits-levisons-re... http://blog.simplejustice.us/2013/08/31/why-hackers-dont-win-too-often/ http://blog.simplejustice.us/2013/08/31/why-hackers-dont-win...
      - jessaustin 13y ago
        Ouch. The first post seems especially unfair. ...they are screwing up the world for the rest of us, for everyone.. Choices being made by the tech-savvy and law ignorant are creating the precedents, while destroying themselves, that form the foundation for computer law going forward. We may be saddled with bad law for decades... The point seems to be: when a random computer person provides a service, and that service is targeted by federal prosecutors, and idiotic judges use the opportunity to cripple civil society, it's the random computer person's fault. Are lawyers and judges simply vengeful automatons, whom any citizen should expect to destroy civilization if given any opportunity? Maybe others in the jurisprudential profession could help defend society from their colleagues?

Udo 13y ago

The prospect of the government demanding all your encryption keys is probably just one of the threats. Apparently they shut down CS because they simply don't want to enable the security apparatus spying on their customers.

rdl 13y ago

The problem is a pen trap order, which is a very low legal bar, far lower than probable cause, can be applied to any single customer. Since we couldn't implement that effectively, we would be forced to give all of that customer's raw traffic to the government. It's entirely likely they would also compel an entire node or even the entire system if they felt that was more effective for their purposes in any way. If the bar set to do this were at search warrant level (probable cause of criminal activity), that would still kind of suck, but the bar for pen traps being so low by comparison totally invalidates our security model. All US providers (including "foreign" providers with US principals or US operations) are vulnerable to this specific problem right now. There are technical ways to deal with this, but it would take months to implement, and no one has done it before. I've got a bunch of talks scheduled for conferences over the next year on how to implement exactly this (and am working on the tech for it), but it's not going to be instantaneous. We didn't want to be in the position of screwing over even one customer in the interim. Until that stuff is in place, my recommendation is to use a non-US VPN provider. There, you're still at risk to local search warrants, but those are a relatively high legal standard in some jurisdictions. The problem in the US is that the lavabit case implies a much lower legal standard to effectively compel all traffic. It'll probably be a year or two before this plays itself out in the courts. Hopefully 6-9 months for a much stronger technical solution. I'm actually working with some pretty kickass legal people on v2. (as always, I Am Not A Lawyer; I Am Not Your Lawyer; This is not legal advice; Consult an attorney licensed in your jurisdiction for specific legal advice in your particular case.)

erichocean 13y ago
I'm actually working with some pretty kickass legal people on v2. Can you say who they are? I'm looking for legal advice in this area as well (and I'm not a competitor to CrytoSeal in any way). Our service is currently in Australia (only), but I'm an owner, based in the US, and by design we also aren't able to support a pen trap order without the same problems you've encountered. It's sucks when crypto best-practices are, effectively, either illegal or useless.
- rdl 13y ago
  Law students and their professors; I don't think my "bro deal" with them is transferable, sadly. (we're trying to get law review and/or conference papers out of it, too) The whole thing is quite unsettled right now, and unique to every case. I'd probably contact EFF. If I were looking for someone to pay, Marcia Hofmann is now a commercial option, and she's probably the best in the world.
  - agwa 13y ago
    Please consider also looking for a criminal defense attorney with significant experience defending people in federal court. When it hits the fan and you get a court order and are being threatened by federal prosecutors, lawprofs don't do you much good. You need someone who has experience fighting back. Here's a criminal defense attorney who makes the case for this better than I could: http://blog.simplejustice.us/2013/10/03/lavabits-levisons-really-bad-call/ http://blog.simplejustice.us/2013/10/03/lavabits-levisons-re... http://blog.simplejustice.us/2013/08/31/why-hackers-dont-win-too-often/ http://blog.simplejustice.us/2013/08/31/why-hackers-dont-win...
    - jessaustin 13y ago
      Ouch. The first post seems especially unfair. ...they are screwing up the world for the rest of us, for everyone.. Choices being made by the tech-savvy and law ignorant are creating the precedents, while destroying themselves, that form the foundation for computer law going forward. We may be saddled with bad law for decades... The point seems to be: when a random computer person provides a service, and that service is targeted by federal prosecutors, and idiotic judges use the opportunity to cripple civil society, it's the random computer person's fault. Are lawyers and judges simply vengeful automatons, whom any citizen should expect to destroy civilization if given any opportunity? Maybe others in the jurisprudential profession could help defend society from their colleagues?