40 ms·

Levinson is a hero. He went to bat for his users, sacrificed his livelihood and his resources to defend the principles he, and many of us, believe in. Yes, the

by guelo 12y ago

Levinson is a hero. He went to bat for his users, sacrificed his livelihood and his resources to defend the principles he, and many of us, believe in. Yes, the government has repulsive legal tools like the Stored Communications Act on their side. Civil rights are not going to be won by fighting head-on on those legalistic grounds, that field has been corrupted and is under complete control of the autocrats.

tptacek 12y ago
Levison ran a for-profit service that made security claims to its users that the system couldn't possibly back up. Other people, like Moxie Marlinspike, the OpenPGP team, and the OTR developers build systems that can provide meaningful security for their users. Perhaps they don't end up in the news because their services actually work; regrettably, this means they may never become "heroes" the way Levison did.
- zzzeek 12y ago
  I have great respect for your writing, but as I am not in the security field I often have difficulty understanding some of the points you make in threads like these. When you say Levison's system made claims it couldn't possibly backup, do you mean that from a technical perspective, or from a legal perspective? I assume you mean from a legal perspective; as his service was a central point at which all messages traveled, he had access to both the encrypted content as well as the decryption keys which the government could then obtain access to via legal means. The advantage afforded by personal systems like PGP keys is obvious in that no third party is involved, but at the same time, PGP or anything else doesn't do any better from a legal perspective - the government can coerce you to give up your encryption keys just the same, no? edit: I think you explained this in your reply at https://news.ycombinator.com/item?id=7775232 https://news.ycombinator.com/item?id=7775232. but still, if the idea is, "you can't claim that system X protects you, because the government can compel that system to give up its keys", that would appear to apply to any encryption system. OpenPGP can't make the claim, "now you can send any message with absolutely zero chance of the government ever reading them!", one subpoena (edit again: search warrant) for your laptop and your passphrase (or a covertly installed snooping device) is all it takes.
  - scott_s 12y ago
    He is distinguishing between what the service provider can or cannot be compelled to do.
  - dublinben 12y ago
    >the government can coerce you to give up your encryption keys just the same, no? No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. You cannot claim similar protections for information that would get another person in trouble though. This is why Levison was risking a contempt charge by refusing to turn over evidence about someone else.
    - zzzeek 12y ago
      OK, do you mean, I can be compelled to give up all my equipment via search warrant, but they have no legal means of making me tell them what my passphrase is? that would be an important distinction. Though at the same time, the government can just as well have covertly installed a keylogger on my system. Which may be illegal but it seems to be happening regardless.
      - e12e 12y ago
        > [the US government] have no legal means of making me tell them what my passphrase is? Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison... If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...). At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not. The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing. And as long as we don't have secure "web" crypto, the situation won't change.
- enraged_camel 12y ago
  >>Perhaps they don't end up in the news because their services actually work Or because they willingly comply with every government request, unbeknownst to their users, which is not really news-worthy (unlike Levison standing his ground for principles in which he believes).
  - cvwright 12y ago
    How would they do this, assuming they wanted to? If they built their tools correctly, nobody knows how to comply with such a request. Or are you suggesting that they maintain a secret list of unknown vulnerabilities in their own code, just so they can help people spy on their own users?
    - enraged_camel 12y ago
      Consider this a response to both your comment and tptacek's (rather rude) comment. >>How would they do this, assuming they wanted to? If they built their tools correctly If they built their tools correctly. I think that's a big assumption. We know for a fact that the NSA has infiltrated and/or influenced various organizations to knowingly implement vulnerabilities in commonly used protocols so that systems that use those protocols can be exploited later. This was all over the news. Some experts even speculate that this may be how the Heartbleed bug originated. Considering the fact that OpenSSL has been around for a long time and no one discovered the vulnerability until very recently seriously brings to question how much faith can be placed in systems like GnuPG and OTR. Again, consider who you are up against: the NSA has the capability to tap underwater cables, intercept shipments of routers to plant bugs on them, to force airplanes of foreign presidents to land on allied territory so they can be searched for a fugitive, and who knows what else. And that is the "who knows what else" part that should worry you. We are against an enemy of unknown power and influence, and it is silly to expect technology -- any technology -- to provide sufficient protection. Suggesting that "[GnuPG and OTR] don't end up in the news because they work" is asinine.
      - tptacek 12y ago
        The NSA can tap all the cables they want, intercept all the router shipments they want, detour every plane they want; that won't make the discrete log problem any easier for them to solve.
- absherwin 12y ago
  "Other people... build systems that can provide meaningful security for their users." Do all of the implementations, particularly on mobile, actually provide such security? If a court is willing to order TLS keys to be turned over in order to enable the government to access information, why couldn't they order the developer to release a backdoored version through the relevant App Store or other update mechanism? If the author refuses to comply, then they will demand the codesigning keys so they can backdoor it themselves. To quote your critique of another's security proposal: "Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure."
  - danielweber 12y ago
    As 'rayiner points out repeatedly, there is plenty of precedent for people being forced to turn over information in their possession to comply with government investigations going back centuries. This is much different than requiring that arbitrary third-parties to be compelled to take arbitrary action to assist in a government investigation. Where they are required, it is a power granted by statute with limited scope. (Phone companies are required to assist in wiretaps via things like Communications Assistance for Law Enforcement Act; I forget that was in effect before that. And they get to bill the government for it.)
    - absherwin 12y ago
      Lavabit didn't actually have the information in a format that was readable. In order to get it, they needed to change the way their system operated to decrypt the information the next time a particular user logged in. If one can force a person to modify the source code running on his servers, why can't one force a person to modify a binary distributed to clients? From reading the arguments in this case, it's not clear to me that the judges would have been impressed by that distinction. Their focus was on whether Lavabit had the technical capability to provide the information the government demanded. In both cases, the answer is yes. We won't know the actual answer until this has been litigated. If it has and I've missed it, I'd love to see the case in question.
- guelo 12y ago
  Levinson's system did work because it had a fail-safe which was to self-destruct when faced with certain legal threats. And as a bonus it acted as a canary letting the whole world know about the government's secret activity. I think it was very well designed. I would trust my private communication with him again.
  - sroerick 12y ago
    You know, I've read easily a dozen articles on Levison, and I realised just now that to this very day, I've never read his warrant canary, nor did I know that it was his warrant canary that first broke the warrant request to the public. You don't happen to have a link to either of those, do you?
    - zaroth 12y ago
      There was no canary. The system was the canary. Although, almost certainly not by design.
- sroerick 12y ago
  Your comment led me to Matasanto's website. I just want to commend you for your hiring practices and wish you the best.
- bionsuba 12y ago
  "for profit" The horror.
- dgroves 12y ago
  With all due respect: Levinson DID backup his security claims by pulling the plug. Dennis's Law: The very best security controls are practices not products. :) I believe the bigger problem is that people no longer know what security is. We are indoctrinated to think it is tools and technology if we can only find that elusive 0-day then we can be secure! The only security is OPSEC - it has always been OPSEC. But the new kids aboard the money-train of security don't know this. And so we get developers turning out more and more buggy software, each a security tool that maybe the elusive magic bullet that will save us all. It is a Utopian dream that doesn't exist - and that is perfect if you want to sell snake-oil! (And to be clear: I am not of the opinion that Matasano is one of the security snake-oil salesmen!) Tools can only be useful if you know what and how to use them? And how do we know how and what to use them for? OPSEC. Products fail, tools fail, mistakes can and will be made - what keeps us safe is not the products, tools and pursuit of perfection: rather it is our detection, response and adaptation to the change. Again that is OPSEC.

by guelo 12y ago

tptacek 12y ago

Levison ran a for-profit service that made security claims to its users that the system couldn't possibly back up. Other people, like Moxie Marlinspike, the OpenPGP team, and the OTR developers build systems that can provide meaningful security for their users. Perhaps they don't end up in the news because their services actually work; regrettably, this means they may never become "heroes" the way Levison did.

zzzeek 12y ago
I have great respect for your writing, but as I am not in the security field I often have difficulty understanding some of the points you make in threads like these. When you say Levison's system made claims it couldn't possibly backup, do you mean that from a technical perspective, or from a legal perspective? I assume you mean from a legal perspective; as his service was a central point at which all messages traveled, he had access to both the encrypted content as well as the decryption keys which the government could then obtain access to via legal means. The advantage afforded by personal systems like PGP keys is obvious in that no third party is involved, but at the same time, PGP or anything else doesn't do any better from a legal perspective - the government can coerce you to give up your encryption keys just the same, no? edit: I think you explained this in your reply at https://news.ycombinator.com/item?id=7775232 https://news.ycombinator.com/item?id=7775232. but still, if the idea is, "you can't claim that system X protects you, because the government can compel that system to give up its keys", that would appear to apply to any encryption system. OpenPGP can't make the claim, "now you can send any message with absolutely zero chance of the government ever reading them!", one subpoena (edit again: search warrant) for your laptop and your passphrase (or a covertly installed snooping device) is all it takes.
- scott_s 12y ago
  He is distinguishing between what the service provider can or cannot be compelled to do.
- dublinben 12y ago
  >the government can coerce you to give up your encryption keys just the same, no? No they can't. In general, such an act would be a breach of the Fifth Amendment protection against self-incrimination. You cannot claim similar protections for information that would get another person in trouble though. This is why Levison was risking a contempt charge by refusing to turn over evidence about someone else.
  - zzzeek 12y ago
    OK, do you mean, I can be compelled to give up all my equipment via search warrant, but they have no legal means of making me tell them what my passphrase is? that would be an important distinction. Though at the same time, the government can just as well have covertly installed a keylogger on my system. Which may be illegal but it seems to be happening regardless.
    - e12e 12y ago
      > [the US government] have no legal means of making me tell them what my passphrase is? Exactly. There was a lot of back and forth about legislation in the UK that basically considered it contempt of court (or worse: impeding an investigation) to not provide encryption keys/pass phrases. Problem was, the government didn't have to prove that you actually had (access to) the keys in question -- effectively being caught with a usb key filled with random data could get you a year in prison... If you think about it it's entirely unreasonable to demand encryption keys (to say nothing of how you would prove/disprove that the right keys have been provided, specially with stuff like hidden encryption partitions available...). At any rate the (technical) problem with lavabit was that lavabit could technically sabotage their product in such a was as to gain/give access to user data -- a secure system would not. The viability of both private (data) and private meta-data messaging have been debated a few times, but basically it's currently hard to beat regular email+gpg+mixmaster routing. And as long as we don't have secure "web" crypto, the situation won't change.
enraged_camel 12y ago
>>Perhaps they don't end up in the news because their services actually work Or because they willingly comply with every government request, unbeknownst to their users, which is not really news-worthy (unlike Levison standing his ground for principles in which he believes).
- cvwright 12y ago
  How would they do this, assuming they wanted to? If they built their tools correctly, nobody knows how to comply with such a request. Or are you suggesting that they maintain a secret list of unknown vulnerabilities in their own code, just so they can help people spy on their own users?
  - enraged_camel 12y ago
    Consider this a response to both your comment and tptacek's (rather rude) comment. >>How would they do this, assuming they wanted to? If they built their tools correctly If they built their tools correctly. I think that's a big assumption. We know for a fact that the NSA has infiltrated and/or influenced various organizations to knowingly implement vulnerabilities in commonly used protocols so that systems that use those protocols can be exploited later. This was all over the news. Some experts even speculate that this may be how the Heartbleed bug originated. Considering the fact that OpenSSL has been around for a long time and no one discovered the vulnerability until very recently seriously brings to question how much faith can be placed in systems like GnuPG and OTR. Again, consider who you are up against: the NSA has the capability to tap underwater cables, intercept shipments of routers to plant bugs on them, to force airplanes of foreign presidents to land on allied territory so they can be searched for a fugitive, and who knows what else. And that is the "who knows what else" part that should worry you. We are against an enemy of unknown power and influence, and it is silly to expect technology -- any technology -- to provide sufficient protection. Suggesting that "[GnuPG and OTR] don't end up in the news because they work" is asinine.
    - tptacek 12y ago
      The NSA can tap all the cables they want, intercept all the router shipments they want, detour every plane they want; that won't make the discrete log problem any easier for them to solve.
absherwin 12y ago
"Other people... build systems that can provide meaningful security for their users." Do all of the implementations, particularly on mobile, actually provide such security? If a court is willing to order TLS keys to be turned over in order to enable the government to access information, why couldn't they order the developer to release a backdoored version through the relevant App Store or other update mechanism? If the author refuses to comply, then they will demand the codesigning keys so they can backdoor it themselves. To quote your critique of another's security proposal: "Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure."
- danielweber 12y ago
  As 'rayiner points out repeatedly, there is plenty of precedent for people being forced to turn over information in their possession to comply with government investigations going back centuries. This is much different than requiring that arbitrary third-parties to be compelled to take arbitrary action to assist in a government investigation. Where they are required, it is a power granted by statute with limited scope. (Phone companies are required to assist in wiretaps via things like Communications Assistance for Law Enforcement Act; I forget that was in effect before that. And they get to bill the government for it.)
  - absherwin 12y ago
    Lavabit didn't actually have the information in a format that was readable. In order to get it, they needed to change the way their system operated to decrypt the information the next time a particular user logged in. If one can force a person to modify the source code running on his servers, why can't one force a person to modify a binary distributed to clients? From reading the arguments in this case, it's not clear to me that the judges would have been impressed by that distinction. Their focus was on whether Lavabit had the technical capability to provide the information the government demanded. In both cases, the answer is yes. We won't know the actual answer until this has been litigated. If it has and I've missed it, I'd love to see the case in question.
guelo 12y ago
Levinson's system did work because it had a fail-safe which was to self-destruct when faced with certain legal threats. And as a bonus it acted as a canary letting the whole world know about the government's secret activity. I think it was very well designed. I would trust my private communication with him again.
- sroerick 12y ago
  You know, I've read easily a dozen articles on Levison, and I realised just now that to this very day, I've never read his warrant canary, nor did I know that it was his warrant canary that first broke the warrant request to the public. You don't happen to have a link to either of those, do you?
  - zaroth 12y ago
    There was no canary. The system was the canary. Although, almost certainly not by design.
sroerick 12y ago
Your comment led me to Matasanto's website. I just want to commend you for your hiring practices and wish you the best.
bionsuba 12y ago
"for profit" The horror.
dgroves 12y ago
With all due respect: Levinson DID backup his security claims by pulling the plug. Dennis's Law: The very best security controls are practices not products. :) I believe the bigger problem is that people no longer know what security is. We are indoctrinated to think it is tools and technology if we can only find that elusive 0-day then we can be secure! The only security is OPSEC - it has always been OPSEC. But the new kids aboard the money-train of security don't know this. And so we get developers turning out more and more buggy software, each a security tool that maybe the elusive magic bullet that will save us all. It is a Utopian dream that doesn't exist - and that is perfect if you want to sell snake-oil! (And to be clear: I am not of the opinion that Matasano is one of the security snake-oil salesmen!) Tools can only be useful if you know what and how to use them? And how do we know how and what to use them for? OPSEC. Products fail, tools fail, mistakes can and will be made - what keeps us safe is not the products, tools and pursuit of perfection: rather it is our detection, response and adaptation to the change. Again that is OPSEC.