4 ms·
This again? Lavabit was forced to shut because of the way it was implemented, and its proprietor has been cashing in on that design flaw ever since. There is no
by pekk 12y ago
This again? Lavabit was forced to shut because of the way it was implemented, and its proprietor has been cashing in on that design flaw ever since. There is no reason why complying with one search warrant should EVER require disclosure of the SSL cert for the whole domain, or any other disclosure sufficient to read data from customers other than the one covered by the warrant. But this is just what everyone claimed when Lavabit was closing.
If you build a business on selling security to people and you make such a mistake in the design of your software, you failed to deliver what you promised to your customers and you deserve to fail.
And not get bailed out because you thumped your chest about having to service search warrants when you chose to set up in US jurisdiction. If you don't want to be obligated to comply with lawful US requests like search warrants then don't set up in the US.
- lifeisstillgood 12y agoIt seems a little much to blame lavabit for sitting in the USA with its constitutional protections of free speech and privacy, and suggest it should set up in say a offshore banking haven, few of which have constitutions and a couple have dictatorial-like powers. Additionally can you explain how he got the architecture "wrong"? Edit: Précis of the architecture of Lavabit from http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/ Lavabit kept your private key on their server, but encrypted it with your plaintext password which you sent them if you wanted to read your mail. That's pretty rubbish in many ways as the article rather even handey points out. A sentiment I am agreeing with - we applaud him for standing up, not for being perfect.
- sandstrom 12y agoWhile I agree with your comment, one could note that there are non-US alternatives that are not offshore banking havens. I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment.
- ceejayoz 12y ago> I'd guess that Switzerland, Sweden and Germany would (probably) all have provided a better judicial environment. The downside, though, is the NSA having freer reign there.
- cynwoody 12y ago>Additionally can you explain how he got the architecture "wrong"? See Moxie Marlinspike's post from last November: http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/ You can't entrust a server with encryption / decryption, nor with supplying the tools to do it locally, e.g., via JS downloaded as part of a web interaction. Service providers can be subpoenaed, threatened, infiltrated, bribed, or hacked. Or they can just turn evil. All crypto must take place on the client, using carefully vetted tools.
- pera 12y agoWith this reasoning we can also blame Cisco for not delivering routers inside safes...