9 ms·

CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant

163 points by atlantic 13y ago

billpg 13y ago
My eyes!
- yoran 13y ago
  Same here. I'm sure the content is really interesting but the design is awful! Plus the logo doesn't fit at all the topic of computer security.
lnanek2 13y ago
Wow, shows a lot of integrity closing the product instead of still keeping it up in a compromised state to comply with the warrant. We've seen some other providers here in the US even changed functionality to retain keys used in web clients of secure email at the behest of government orders. This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though.
- jabbernotty 13y ago
  The article also mentions this company's new product where additional security is possible because decryption requires data kept only by the customer. Perhaps that is the new way to go?
  - arethuza 13y ago
    I was wondering about that, it is described as: "where rather than hold the data, it is split in two so CertiVox has one half and the user has the other, and law enforcement would need both to access the data." By data here, do they mean encryption key? If so then I'm not sure what splitting it in two does as you presumably have to join them together somewhere and GCHQ would presumably just attack wherever the complete key is available. [Edit: Product details here, it appears to be Open Source: http://www.certivox.com/m-pin/ http://www.certivox.com/m-pin/]
    - jabbernotty 13y ago
      I don't know anything about the implementation, but I would assume that the idea is to avoid having the service provider be a single point where complete failure can occur. Perhaps this new system offloads that risk to the customer. But then I get confused, what service is the service provider providing if the customer still needs to carry around half of 'the data'?
      - JonnieCache 13y ago
        Splitting it in two does not mean splitting it in half.
        Eifrig 13y ago
        Found some detail of "splitting in two" to assure no single point of failure here https://certivox.org/pages/viewpage.action?pageId=10420248 https://certivox.org/pages/viewpage.action?pageId=10420248 "Distributed Trust Authority"
    - DanBC 13y ago
      Defining some terms: Alice, Bob, the company, and GCHQ (Eve). Alice sends Bob stuff, via the company. GCHQ sends RIPA requests to the company, which means that GCHQ get Alice's communications. Neither Alice nor Bob are aware. So, a new scheme where Alice and the company need keys to decrypt means that GCHQ send RIPA requests to the company, and to Alice. Now Alice, and the company, are aware of the RIPA request. Bob isn't. But at least Alice can stop sending things to Bob.
- gambiting 13y ago
  I think most people completely missed the part of Snowden leaks that directly said that GCHQ is not any better than NSA.
  - josephlord 13y ago
    GCHQ are both better and worse than the NSA. I would argue that it seems they are if anything even less restrained than the NSA in over broad surveillance. However it is less clear whether GCHQ have actually broken the rules (and certainly not the constitution) which the NSA may have done. My view is that everyone (in the world) should be pissed off at both the NSA and GCHQ and that Americans should be additionally angry that the NSA seems to have broken the limits placed on them in terms of domestic surveilance.
    - deleted 13y ago
      [deleted]
    - mcintyre1994 13y ago
      For those unaware it may be worth pointing out that the UK constitution has a principle of parliamentary sovereignty [1] - basically parliament can pass/amend/remove any law and no current law can bind future parliaments (they can always amend/remove it). Fundamentally if they say it's legal it is, so rules can be changed at any time such that GCHQ isn't technically breaking any rules. [1] http://www.parliament.uk/about/how/sovereignty/ http://www.parliament.uk/about/how/sovereignty/
- rayiner 13y ago
  > This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though. I can think of very few developed countries that, when the rubber hits the road, will let you do what you want. Taking measures to aid official police or court investigations is simply an implied obligation in most countries with developed legal systems. Very few countries will tolerate service providers whose raison d'etre is "we won't cooperate with the authorities" except in limited situations like off-shore banking when the primary purpose is to hide assets or information from people in other countries. This isn't specific to crypto or police investigations either. Say you want to start an accounting firm that guarantees it will never share your records if subpoenaed in a civil lawsuit. This would never fly in the U.S., not now or one hundred years ago, and while I'm not super familiar with European law, I can't imagine it would fly in any western European country either.
  - rdl 13y ago
    I think it falls into three groups for communications providers: 1) Laws like CALEA, which (if applicable) require a provider to develop and expose backdoors to the government in advance of a request 2) Building systems where an operator doesn't have access, but where a court order can compel changes to the system, including ultimately shutting it down. 3) Being able to build a system where operator doesn't have access to data, and upon a request, if no data can be turned over, continues operating. Must turn over any data which you do have. 4) No requirement to cooperate, or something equiv to 4th/5th A protections for the end user being extended to service providers. I used to think the US was #3. I don't believe #4 exists anywhere, at least outside specific kinds of data (medical, legal). The US is at least #2 now, and might actually be #1 in more and more domains.
7952 13y ago
There are some details of the legislation in question here[1]. It allows the UK to monitor "in the interests of the economic well-being of the United Kingdom" which seems a little broad! It would be interesting to know if this warrant targeted all users or a specific subset? I wonder how they decide whether to issue a warrant or just break into the site in question. A warrant could imply that they are unable to attack the provider, or that they want to have a chilling effect. [1]http://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_I http://wiki.openrightsgroup.org/wiki/Regulation_of_Investiga...
- salient 13y ago
  "In the name of the People, shut down this facility!" Well, that sounds familiar. It seems the more governments change over the decades, the more they stay the same.
  - arethuza 13y ago
    In a case of "Just because you're paranoid Don't mean they're not after you" Harold Wilson, who was paranoid about lots of things but particularly being bugged by MI5, was in No 10 at a time when there were bugs in cabinet room and PM's study - whether the bugs were actually used or not isn't known: http://en.wikipedia.org/wiki/Harold_Wilson_conspiracy_theories http://en.wikipedia.org/wiki/Harold_Wilson_conspiracy_theori... Edit: If anyone is interested in this stuff, I can strongly recommend Dominic Sandbrook's histories of the UK in the 60s and 70s: http://www.amazon.co.uk/Dominic-Sandbrook/e/B001HCWSSW/ref=ntt_athr_dp_pel_1 http://www.amazon.co.uk/Dominic-Sandbrook/e/B001HCWSSW/ref=n...
- dingaling 13y ago
  RIPA was strongly opposed by the IT and communications community during its 'consultation' period, but was passed largely intact. It was so intrusive a proposal that even people like me who often say 'I'll write and complain' actually did write a letter. Predictions of its misuse have been borne out, particularly as the authorized users of communication data were never enumerated or restricted. So we have the situation today where local Councils use RIPA to obtain communication data regarding individual citizens' activities.
jackgavigan 13y ago
The headline attached to this submission is sensationalist and misleading. GCHQ did not force CertiVox to shut down PrivateSky. CertiVox decided to close PrivateSky after they were served with a notice issued under section 49 of the Regulation of Investigatory Powers Act (RIPA) which required that they hand over the key(s) required to decrypt one (or more) of their customer's data. The underlying legislation can be found here: http://www.legislation.gov.uk/ukpga/2000/23/contents http://www.legislation.gov.uk/ukpga/2000/23/contents The relevant section is 49 but sections 53 (Failure to comply with a notice) and 54 (Tipping off) are also of particular interest.
- kintamanimatt 13y ago
  I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
  - Bahamut 13y ago
    Arguably it is a problem they created by the architecture they chose, in which this is a fatal flaw of design that was almost certainly something that could be anticipated.
    - kintamanimatt 13y ago
      I do agree, but historically we've been able to write software in an environment we didn't foresee being hostile. We've been too trusting and blasé when it comes to privacy and security. For example, look at the original SMTP implementation: the designers didn't take into account there might be governments or other bad actors that would snoop wholesale on such messages as they bounced around the infrastructure. If the original designers had known, the specification would have undoubtedly been different. It's also hard to create a system that's private and secure, and it's vastly less convenient to use which increases friction and drives down adoption. PGP, for example, is very good but extremely inconvenient to use all the time. As an outsider, I think I understand the rationale behind their design decisions. Just saying it should have been more carefully created with privacy in mind glosses over the many complexities and difficulties that design goal entails. We, as creators of software, have problems that are more political than technical, no matter where we are in the world.
jzzskijj 13y ago
"or spend £500,000 building a backdoor into the system" A nice round number... They had good motive to protect their customers and close the service. Why start talking about this kind of ridiculous development costs, that sound like it got pulled out of the air? At least I'd be more sympathetic, if they sticked to the facts. I could even support their cause by posting and tweeting that this is terrible. Now I just feel, that cut the BS already, even they apparently were treated wrong and intimidated to shut down their business. </rant>
- bribriinlondon2 13y ago
  This is Brian, the CEO. Yea, it was a nice round number out of the air. But it probably wasn't far off the mark. For all the other comments, below is a blog post on the matter which is going to go live shortly: With the story about our PrivateSky takedown now public, I want to take the opportunity to clarify a few points in various articles that have appeared since yesterday covering the story. The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash. In fact, the headline contradicts the article, which becomes clear as you read it. Secondly, a very important point wasn’t printed. GCHQ couldn’t, by law, request a blanket back door on the system. There are a very rigid set of controls that mean only specific individuals can come under surveillance. The legal request for such surveillance has a due process that must be stridently followed. At no time did I or anyone at CertiVox talk about CertiVox in relation to any RIPA warrant, only the generic process by which these warrants are served. By saying “our friends at GCHQ”, there is no facetiousness intended. The team at CertiVox have the upmost respect for the folks we interacted with at GCHQ. They took the due process I outlined in the previous point very seriously. We found that as an organisation, and every individual involved there, were as worried about a breach of public trust as much as we are. Finally, I believe very strongly the following should be a larger part of the public discourse of these subjects. What everyone needs to understand is that every developed democracy in the world, even where privacy rights are enshrined to the maximum efficacy by statute, has laws on the books that mandate that Internet Service Providers have facilities to work with law enforcement for the purposes of legal intercept, to enforce public safety and security. Being L.I. capable is a very important set features and functions that must be in place for any credible, commercial service on the Internet. In endeavouring to make PrivateSky as secure as possible, we overlooked this critical requirement when we built PrivateSky. When CertiVox positioned PrivateSky as the easiest to use and most secure encrypted messaging service, we really had two significant points of differentiation. First, even though we held the root encryption keys to the system, it was architected in such as way that it would have been all but impossible for our internal staff to snoop on our customer’s communications, or for the service to leak any of our customer’s data. Secondly, our possession of the root keys, and our use of identity based encryption, made the system incredibly easy to use. For the user, there were no private or public keys to manage, every workflow was handled for the user in an easy to grasp pure HTML5 interface, no hardware or software required, just an HTML5 browser. We boxed ourselves into a feature set and market position that when called upon to comply with legal statues, we simply had no alternative but to shut the service down. We built it, but we couldn’t host it. Why? Because as you can probably surmise, there is an inherent impedance mismatch between being able to host a commercial communications service that gives the upmost in privacy to its users, against any breach, whilst at the same time being able to operate safely within the confines of the law as it is on the books in most countries on the planet. Is this wrong? Actually, I don’t think it is. This may be an unpopular viewpoint, but I cannot argue against having a well regulated legal intercept function as being necessary to have in place for a society that prizes law and order and the safety of its citizens. This is speaking as someone who lived in NYC during 9/11. In summary, it’s the abuse of the communications interception in the Snowden revelations that has everyone up in arms, as so it should. But that’s not what happened with PrivateSky. What is our next move? Watch this space.
pistle 13y ago
Drop shadows in all the directions! I like the idea obfuscating the location of the containers of the data as well as the content. Shred, encrypt, disperse. You send a token to the recipient and they are able to use that to build location requests for the containers. Once they have the parts, they can assemble and decrypt. So, in which country can this be developed?
spindritf 13y ago
we had the choice to make - either architect the world's most secure encryption system on the planet, so secure that CertiVox cannot see your data, or spend £500,000 building a backdoor into the system So, just like Lavabit as 'moxie keeps pointing out[1][2], it wasn't actually secure. Still, I like the principled stand they took. [1] https://news.ycombinator.com/item?id=6672442 https://news.ycombinator.com/item?id=6672442 [2] http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/
- _mhp_ 13y ago
  There is no actually secure - that's the problem. The best you can do is secure against specific threat models. Up until recently, most people didn't necessarily view government intrusion as a particularly credible threat, so didn't spend the extra time/effort/money mitigating against it. One of the best things to come out of all these revelations, in my opinion, is a revised view of what threats we should consider which were previously dismissed as paranoid ramblings.
  - spindritf 13y ago
    Sure, but they don't seem any more (technically) secure than any other decent webmail provider.
  - maffydub 13y ago
    You're right that we may have been naive about trusting our governments. What I don't understand is why anyone trusted businesses (such as CertiVox and Lavabit) to keep their emails secure? If the businesses themselves couldn't decrypt these emails, there's nothing the government could usefully ask them for.
    - bribriinlondon2 13y ago
      That's a complete misunderstanding of the law and on whose shoulders it falls on to provide data in the clear to the relevant authorities upon legal request.
    - 13y ago
wavefunction 13y ago
So now our legal economic activities depend on the say-so of a shadowy, unelected cabal. I guess we're "destroying the village to save it."
at-fates-hands 13y ago
Just confirmation of another vendor who said no to the government intrusions on their customer data. I"ll say it again since it bears repeating. How many more companies are complying and giving their keys to the government so they can track people that we won't hear about?? Makes me sketchy on using any "encrypted" email service right now.
deleted 13y ago
[deleted]
create28 13y ago
CertiVox have released a blog on their site explaining more about PrivateSky shut down: http://www.certivox.com/blog/bid/359788/The-real-story-on-the-PrivateSky-takedown http://www.certivox.com/blog/bid/359788/The-real-story-on-th...

163 points by atlantic 13y ago

billpg 13y ago

My eyes!

yoran 13y ago
Same here. I'm sure the content is really interesting but the design is awful! Plus the logo doesn't fit at all the topic of computer security.

lnanek2 13y ago

Wow, shows a lot of integrity closing the product instead of still keeping it up in a compromised state to comply with the warrant. We've seen some other providers here in the US even changed functionality to retain keys used in web clients of secure email at the behest of government orders. This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though.

jabbernotty 13y ago
The article also mentions this company's new product where additional security is possible because decryption requires data kept only by the customer. Perhaps that is the new way to go?
- arethuza 13y ago
  I was wondering about that, it is described as: "where rather than hold the data, it is split in two so CertiVox has one half and the user has the other, and law enforcement would need both to access the data." By data here, do they mean encryption key? If so then I'm not sure what splitting it in two does as you presumably have to join them together somewhere and GCHQ would presumably just attack wherever the complete key is available. [Edit: Product details here, it appears to be Open Source: http://www.certivox.com/m-pin/ http://www.certivox.com/m-pin/]
  - jabbernotty 13y ago
    I don't know anything about the implementation, but I would assume that the idea is to avoid having the service provider be a single point where complete failure can occur. Perhaps this new system offloads that risk to the customer. But then I get confused, what service is the service provider providing if the customer still needs to carry around half of 'the data'?
    - JonnieCache 13y ago
      Splitting it in two does not mean splitting it in half.
      - Eifrig 13y ago
        Found some detail of "splitting in two" to assure no single point of failure here https://certivox.org/pages/viewpage.action?pageId=10420248 https://certivox.org/pages/viewpage.action?pageId=10420248 "Distributed Trust Authority"
  - DanBC 13y ago
    Defining some terms: Alice, Bob, the company, and GCHQ (Eve). Alice sends Bob stuff, via the company. GCHQ sends RIPA requests to the company, which means that GCHQ get Alice's communications. Neither Alice nor Bob are aware. So, a new scheme where Alice and the company need keys to decrypt means that GCHQ send RIPA requests to the company, and to Alice. Now Alice, and the company, are aware of the RIPA request. Bob isn't. But at least Alice can stop sending things to Bob.
gambiting 13y ago
I think most people completely missed the part of Snowden leaks that directly said that GCHQ is not any better than NSA.
- josephlord 13y ago
  GCHQ are both better and worse than the NSA. I would argue that it seems they are if anything even less restrained than the NSA in over broad surveillance. However it is less clear whether GCHQ have actually broken the rules (and certainly not the constitution) which the NSA may have done. My view is that everyone (in the world) should be pissed off at both the NSA and GCHQ and that Americans should be additionally angry that the NSA seems to have broken the limits placed on them in terms of domestic surveilance.
  - deleted 13y ago
    [deleted]
  - mcintyre1994 13y ago
    For those unaware it may be worth pointing out that the UK constitution has a principle of parliamentary sovereignty [1] - basically parliament can pass/amend/remove any law and no current law can bind future parliaments (they can always amend/remove it). Fundamentally if they say it's legal it is, so rules can be changed at any time such that GCHQ isn't technically breaking any rules. [1] http://www.parliament.uk/about/how/sovereignty/ http://www.parliament.uk/about/how/sovereignty/
rayiner 13y ago
> This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though. I can think of very few developed countries that, when the rubber hits the road, will let you do what you want. Taking measures to aid official police or court investigations is simply an implied obligation in most countries with developed legal systems. Very few countries will tolerate service providers whose raison d'etre is "we won't cooperate with the authorities" except in limited situations like off-shore banking when the primary purpose is to hide assets or information from people in other countries. This isn't specific to crypto or police investigations either. Say you want to start an accounting firm that guarantees it will never share your records if subpoenaed in a civil lawsuit. This would never fly in the U.S., not now or one hundred years ago, and while I'm not super familiar with European law, I can't imagine it would fly in any western European country either.
- rdl 13y ago
  I think it falls into three groups for communications providers: 1) Laws like CALEA, which (if applicable) require a provider to develop and expose backdoors to the government in advance of a request 2) Building systems where an operator doesn't have access, but where a court order can compel changes to the system, including ultimately shutting it down. 3) Being able to build a system where operator doesn't have access to data, and upon a request, if no data can be turned over, continues operating. Must turn over any data which you do have. 4) No requirement to cooperate, or something equiv to 4th/5th A protections for the end user being extended to service providers. I used to think the US was #3. I don't believe #4 exists anywhere, at least outside specific kinds of data (medical, legal). The US is at least #2 now, and might actually be #1 in more and more domains.

7952 13y ago

There are some details of the legislation in question here[1]. It allows the UK to monitor "in the interests of the economic well-being of the United Kingdom" which seems a little broad! It would be interesting to know if this warrant targeted all users or a specific subset? I wonder how they decide whether to issue a warrant or just break into the site in question. A warrant could imply that they are unable to attack the provider, or that they want to have a chilling effect. [1]http://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_I http://wiki.openrightsgroup.org/wiki/Regulation_of_Investiga...

salient 13y ago
"In the name of the People, shut down this facility!" Well, that sounds familiar. It seems the more governments change over the decades, the more they stay the same.
- arethuza 13y ago
  In a case of "Just because you're paranoid Don't mean they're not after you" Harold Wilson, who was paranoid about lots of things but particularly being bugged by MI5, was in No 10 at a time when there were bugs in cabinet room and PM's study - whether the bugs were actually used or not isn't known: http://en.wikipedia.org/wiki/Harold_Wilson_conspiracy_theories http://en.wikipedia.org/wiki/Harold_Wilson_conspiracy_theori... Edit: If anyone is interested in this stuff, I can strongly recommend Dominic Sandbrook's histories of the UK in the 60s and 70s: http://www.amazon.co.uk/Dominic-Sandbrook/e/B001HCWSSW/ref=ntt_athr_dp_pel_1 http://www.amazon.co.uk/Dominic-Sandbrook/e/B001HCWSSW/ref=n...
dingaling 13y ago
RIPA was strongly opposed by the IT and communications community during its 'consultation' period, but was passed largely intact. It was so intrusive a proposal that even people like me who often say 'I'll write and complain' actually did write a letter. Predictions of its misuse have been borne out, particularly as the authorized users of communication data were never enumerated or restricted. So we have the situation today where local Councils use RIPA to obtain communication data regarding individual citizens' activities.

jackgavigan 13y ago

The headline attached to this submission is sensationalist and misleading. GCHQ did not force CertiVox to shut down PrivateSky. CertiVox decided to close PrivateSky after they were served with a notice issued under section 49 of the Regulation of Investigatory Powers Act (RIPA) which required that they hand over the key(s) required to decrypt one (or more) of their customer's data. The underlying legislation can be found here: http://www.legislation.gov.uk/ukpga/2000/23/contents http://www.legislation.gov.uk/ukpga/2000/23/contents The relevant section is 49 but sections 53 (Failure to comply with a notice) and 54 (Tipping off) are also of particular interest.

kintamanimatt 13y ago
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
- Bahamut 13y ago
  Arguably it is a problem they created by the architecture they chose, in which this is a fatal flaw of design that was almost certainly something that could be anticipated.
  - kintamanimatt 13y ago
    I do agree, but historically we've been able to write software in an environment we didn't foresee being hostile. We've been too trusting and blasé when it comes to privacy and security. For example, look at the original SMTP implementation: the designers didn't take into account there might be governments or other bad actors that would snoop wholesale on such messages as they bounced around the infrastructure. If the original designers had known, the specification would have undoubtedly been different. It's also hard to create a system that's private and secure, and it's vastly less convenient to use which increases friction and drives down adoption. PGP, for example, is very good but extremely inconvenient to use all the time. As an outsider, I think I understand the rationale behind their design decisions. Just saying it should have been more carefully created with privacy in mind glosses over the many complexities and difficulties that design goal entails. We, as creators of software, have problems that are more political than technical, no matter where we are in the world.

jzzskijj 13y ago

"or spend £500,000 building a backdoor into the system" A nice round number... They had good motive to protect their customers and close the service. Why start talking about this kind of ridiculous development costs, that sound like it got pulled out of the air? At least I'd be more sympathetic, if they sticked to the facts. I could even support their cause by posting and tweeting that this is terrible. Now I just feel, that cut the BS already, even they apparently were treated wrong and intimidated to shut down their business. </rant>

bribriinlondon2 13y ago
This is Brian, the CEO. Yea, it was a nice round number out of the air. But it probably wasn't far off the mark. For all the other comments, below is a blog post on the matter which is going to go live shortly: With the story about our PrivateSky takedown now public, I want to take the opportunity to clarify a few points in various articles that have appeared since yesterday covering the story. The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash. In fact, the headline contradicts the article, which becomes clear as you read it. Secondly, a very important point wasn’t printed. GCHQ couldn’t, by law, request a blanket back door on the system. There are a very rigid set of controls that mean only specific individuals can come under surveillance. The legal request for such surveillance has a due process that must be stridently followed. At no time did I or anyone at CertiVox talk about CertiVox in relation to any RIPA warrant, only the generic process by which these warrants are served. By saying “our friends at GCHQ”, there is no facetiousness intended. The team at CertiVox have the upmost respect for the folks we interacted with at GCHQ. They took the due process I outlined in the previous point very seriously. We found that as an organisation, and every individual involved there, were as worried about a breach of public trust as much as we are. Finally, I believe very strongly the following should be a larger part of the public discourse of these subjects. What everyone needs to understand is that every developed democracy in the world, even where privacy rights are enshrined to the maximum efficacy by statute, has laws on the books that mandate that Internet Service Providers have facilities to work with law enforcement for the purposes of legal intercept, to enforce public safety and security. Being L.I. capable is a very important set features and functions that must be in place for any credible, commercial service on the Internet. In endeavouring to make PrivateSky as secure as possible, we overlooked this critical requirement when we built PrivateSky. When CertiVox positioned PrivateSky as the easiest to use and most secure encrypted messaging service, we really had two significant points of differentiation. First, even though we held the root encryption keys to the system, it was architected in such as way that it would have been all but impossible for our internal staff to snoop on our customer’s communications, or for the service to leak any of our customer’s data. Secondly, our possession of the root keys, and our use of identity based encryption, made the system incredibly easy to use. For the user, there were no private or public keys to manage, every workflow was handled for the user in an easy to grasp pure HTML5 interface, no hardware or software required, just an HTML5 browser. We boxed ourselves into a feature set and market position that when called upon to comply with legal statues, we simply had no alternative but to shut the service down. We built it, but we couldn’t host it. Why? Because as you can probably surmise, there is an inherent impedance mismatch between being able to host a commercial communications service that gives the upmost in privacy to its users, against any breach, whilst at the same time being able to operate safely within the confines of the law as it is on the books in most countries on the planet. Is this wrong? Actually, I don’t think it is. This may be an unpopular viewpoint, but I cannot argue against having a well regulated legal intercept function as being necessary to have in place for a society that prizes law and order and the safety of its citizens. This is speaking as someone who lived in NYC during 9/11. In summary, it’s the abuse of the communications interception in the Snowden revelations that has everyone up in arms, as so it should. But that’s not what happened with PrivateSky. What is our next move? Watch this space.

pistle 13y ago

Drop shadows in all the directions! I like the idea obfuscating the location of the containers of the data as well as the content. Shred, encrypt, disperse. You send a token to the recipient and they are able to use that to build location requests for the containers. Once they have the parts, they can assemble and decrypt. So, in which country can this be developed?

spindritf 13y ago

we had the choice to make - either architect the world's most secure encryption system on the planet, so secure that CertiVox cannot see your data, or spend £500,000 building a backdoor into the system So, just like Lavabit as 'moxie keeps pointing out[1][2], it wasn't actually secure. Still, I like the principled stand they took. [1] https://news.ycombinator.com/item?id=6672442 https://news.ycombinator.com/item?id=6672442 [2] http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/

_mhp_ 13y ago
There is no actually secure - that's the problem. The best you can do is secure against specific threat models. Up until recently, most people didn't necessarily view government intrusion as a particularly credible threat, so didn't spend the extra time/effort/money mitigating against it. One of the best things to come out of all these revelations, in my opinion, is a revised view of what threats we should consider which were previously dismissed as paranoid ramblings.
- spindritf 13y ago
  Sure, but they don't seem any more (technically) secure than any other decent webmail provider.
- maffydub 13y ago
  You're right that we may have been naive about trusting our governments. What I don't understand is why anyone trusted businesses (such as CertiVox and Lavabit) to keep their emails secure? If the businesses themselves couldn't decrypt these emails, there's nothing the government could usefully ask them for.
  - bribriinlondon2 13y ago
    That's a complete misunderstanding of the law and on whose shoulders it falls on to provide data in the clear to the relevant authorities upon legal request.
  - 13y ago

wavefunction 13y ago

So now our legal economic activities depend on the say-so of a shadowy, unelected cabal. I guess we're "destroying the village to save it."

at-fates-hands 13y ago

Just confirmation of another vendor who said no to the government intrusions on their customer data. I"ll say it again since it bears repeating. How many more companies are complying and giving their keys to the government so they can track people that we won't hear about?? Makes me sketchy on using any "encrypted" email service right now.

deleted 13y ago

[deleted]

create28 13y ago

CertiVox have released a blog on their site explaining more about PrivateSky shut down: http://www.certivox.com/blog/bid/359788/The-real-story-on-the-PrivateSky-takedown http://www.certivox.com/blog/bid/359788/The-real-story-on-th...