6 ms·

I think it's important that we separate our support for Ladar's legal problems from our support from his technical decisions. I think we should support Ladar a

by moxie 13y ago

I think it's important that we separate our support for Ladar's legal problems from our support from his technical decisions. I think we should support Ladar as a person for bravely deciding not to comply with the government's request, but that we should be extremely critical of the technical decisions that lead to his ability to have complied. LavaBit was a service offering "secure" email using a mechanism known to be insecure, which unnecessarily put a lot of users at risk. It seems injudicious to fund its redeployment, and even a little bit strange to fund the same person to develop something new.

zxlk21e 13y ago
Agree, but then again, most of the parroting that has taken place with respect to this entire debacle has served to expose people to many of the issues and practices around online privacy, so there is that (albeit under poor circumstances, but lemons -> lemonade). What's with the weird goal amount though? Is there some significance there that I'm not aware of?
- hkmurakami 13y ago
  >What's with the weird goal amount though? Is there some significance there that I'm not aware of? It seems to be 2^16 * 3 No idea what that means.
  - GhotiFish 13y ago
    I'm impressed you worked that out.
  - selmnoo 13y ago
    It's a regular Hamming number. The 363th. Yeah, not sure what's the significance either.
    - davidsong 13y ago
      Maybe the three of them working on it want 64k each because they like round numbers.
asdfs 13y ago
>using a mechanism known to be insecure Can you elaborate? I'm not sure what you're referring to.
- socillion 13y ago
  Lavabit had the capability and will to share information with law enforcement in the past; it was only in Snowden's case that Levison refused. > Levison isn’t an privacy absolutist. He has cooperated in the past with government investigations. He says he’s received “two dozen” requests over the last ten years, and in cases where he had information, he would turn over what he had. > “I’m not trying to protect people from law enforcement,” he said. “If information is unencrypted and law enforcement has a court order, I hand it over.” http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/ http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-...
  - jedbrown 13y ago
    Lavabit's encrypted storage was a paid feature that was used by less than 10% of users. From the wording, it sounds like he never stored passwords for those accounts. It's possible that Snowden was the first premium customer for which Lavabit was issued a warrant.
    - socillion 13y ago
      Thanks for the clarification.
guelo 13y ago
I dont understand. Lavabit's full process, including the last resort off switch, worked. Snowden was well served to rely on it, his emails were not read by the government.
- jedbrown 13y ago
  He had the keys and encrypted messages on the server. Everything but passwords (to unlock the private key), which he received from users and chose not to store. There is no way for users to audit that the passwords are not stored or intercepted (with or without Ladar's consent). He took a commendable stand, but had he built the technology differently, he never would have been in a position of having to choose and users would not have to trust his integrity and endpoint security. The technical challenge is in designing a system in which the server does not have to be trusted, but that integrates well with existing protocols. I'm not aware of a proposal that offers the desired level of security while transparently integrating with SMTP, but perhaps Moxie has ideas. One can get part way if the users generate their own key pair and only provide the server the public key, then either use a PGP-capable mail client or perhaps run a local (open source and audited) IMAP proxy to decrypt. You'd still have to trust the server not to store a clear copy of incoming mail, but once it is encrypted, only the client would be able to decrypt.
  - bigiain 13y ago
    FWIW, I think there's a disconnect between what people expect/need from their email hosting provider and the "obvious" security solutions. Especially these days with many many people relying on IMAP to provide server-side search when using mobile devices. If you need the server to be able to text search through your mail archive (and I do that a _lot_ on my phone), you need to "trust" the server with your clear text. If you don't want to run and secure your own server - you need to choose what level of compromise you're prepared to accept. My current project is a mail server on a RaspberryPi, hidden behind my home NAT gateway and firewall, that opens reverse ssh tunnels for ports 25 and 465 to inexpensive VPSes configured to not log anything - with IMAP (and webmail) access limited to my local network (and to my phone and iPad via vpn). It uses Vagrant and Ansible to provision and configure VPSes on the fly, and DNS hosting with APIs that Ansible can update MX records for as my receiving mail server moves around different VPS vendors in different jurisdictions.
tlrobinson 13y ago
Are there any other projects with similar goals that you would support?
mknits 13y ago
Well tried NSA, but I'll try to fund the campaign.

by moxie 13y ago

zxlk21e 13y ago

Agree, but then again, most of the parroting that has taken place with respect to this entire debacle has served to expose people to many of the issues and practices around online privacy, so there is that (albeit under poor circumstances, but lemons -> lemonade). What's with the weird goal amount though? Is there some significance there that I'm not aware of?

hkmurakami 13y ago
>What's with the weird goal amount though? Is there some significance there that I'm not aware of? It seems to be 2^16 * 3 No idea what that means.
- GhotiFish 13y ago
  I'm impressed you worked that out.
- selmnoo 13y ago
  It's a regular Hamming number. The 363th. Yeah, not sure what's the significance either.
  - davidsong 13y ago
    Maybe the three of them working on it want 64k each because they like round numbers.

asdfs 13y ago

>using a mechanism known to be insecure Can you elaborate? I'm not sure what you're referring to.

socillion 13y ago
Lavabit had the capability and will to share information with law enforcement in the past; it was only in Snowden's case that Levison refused. > Levison isn’t an privacy absolutist. He has cooperated in the past with government investigations. He says he’s received “two dozen” requests over the last ten years, and in cases where he had information, he would turn over what he had. > “I’m not trying to protect people from law enforcement,” he said. “If information is unencrypted and law enforcement has a court order, I hand it over.” http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/ http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-...
- jedbrown 13y ago
  Lavabit's encrypted storage was a paid feature that was used by less than 10% of users. From the wording, it sounds like he never stored passwords for those accounts. It's possible that Snowden was the first premium customer for which Lavabit was issued a warrant.
  - socillion 13y ago
    Thanks for the clarification.

guelo 13y ago

I dont understand. Lavabit's full process, including the last resort off switch, worked. Snowden was well served to rely on it, his emails were not read by the government.

jedbrown 13y ago
He had the keys and encrypted messages on the server. Everything but passwords (to unlock the private key), which he received from users and chose not to store. There is no way for users to audit that the passwords are not stored or intercepted (with or without Ladar's consent). He took a commendable stand, but had he built the technology differently, he never would have been in a position of having to choose and users would not have to trust his integrity and endpoint security. The technical challenge is in designing a system in which the server does not have to be trusted, but that integrates well with existing protocols. I'm not aware of a proposal that offers the desired level of security while transparently integrating with SMTP, but perhaps Moxie has ideas. One can get part way if the users generate their own key pair and only provide the server the public key, then either use a PGP-capable mail client or perhaps run a local (open source and audited) IMAP proxy to decrypt. You'd still have to trust the server not to store a clear copy of incoming mail, but once it is encrypted, only the client would be able to decrypt.
- bigiain 13y ago
  FWIW, I think there's a disconnect between what people expect/need from their email hosting provider and the "obvious" security solutions. Especially these days with many many people relying on IMAP to provide server-side search when using mobile devices. If you need the server to be able to text search through your mail archive (and I do that a _lot_ on my phone), you need to "trust" the server with your clear text. If you don't want to run and secure your own server - you need to choose what level of compromise you're prepared to accept. My current project is a mail server on a RaspberryPi, hidden behind my home NAT gateway and firewall, that opens reverse ssh tunnels for ports 25 and 465 to inexpensive VPSes configured to not log anything - with IMAP (and webmail) access limited to my local network (and to my phone and iPad via vpn). It uses Vagrant and Ansible to provision and configure VPSes on the fly, and DNS hosting with APIs that Ansible can update MX records for as my receiving mail server moves around different VPS vendors in different jurisdictions.

tlrobinson 13y ago

Are there any other projects with similar goals that you would support?

mknits 13y ago

Well tried NSA, but I'll try to fund the campaign.