3 ms·

>Levison was simply opportunistic and inept Actually, by far the simplest explanation in this case is that Levison supported Snowden's actions and wanted to ba

by jnbiche 12y ago

>Levison was simply opportunistic and inept Actually, by far the simplest explanation in this case is that Levison supported Snowden's actions and wanted to back him up. I mean, he sacrificed his company -- his baby -- for this case, even though he had complied with multiple prior government requests (usually relating to child porn, from what I recall). Clearly, Levinson went through a period of fear and doubt, but the only consistency was his refusal to give up keys that would reveal Snowden's communications. Can you explain why you are convinced it's opportunism and not idealism? Because unless you know something we don't, Occam's Razor in this case says that Levison was simply being a Snowden supporter, to the point of sacrificing his livelihood. In my book, that makes him a patriot. Sillysaurus: yes, he knew the court order was for Snowden, since it specifically mentioned him by name. Also, I believe that an edsnowden@lavabit address (or something similar) was on GPG keyservers everywhere. So it wasn't hard to guess. And in fact, that address was soon revealed to be Snowden's in a public document from his lawyer sent by Wikileaks (accidentally).

sillysaurus3 12y ago
Was Snowden public knowledge when Levison was first served a warrant? I can't remember. Levison was served with a warrant very quickly. Are you sure his actions were to protect Snowden? EDIT: I meant, were Snowden's actions public knowledge when Levison was served the warrant? Not merely Snowden's name, but the extent of what he did?
tptacek 12y ago
The opportunism I'm referring to was setting up Lavabit in the first place, as a web-based email provider that made expansive claims about security that it couldn't possibly back up. It's easy for me to understand why people think Levison is a hero. They think Lavabit was a noble, useful offering, and that government intervention is the only reason it failed. To understand my position, you need to know that Lavabit's architecture was almost comically unsound; it claimed to protect the privacy of thousands of users, but all the weight of that claim was borne by a set of keys Lavabit's operators had total control over. Online privacy tools don't need to work like this. They often do, though, because transcending this pitiful security model requires that users install software. Nobody wants to install software. Not to mention, most of the people who want to build and offer these tools don't really know how to build locally-installable software. There's nothing wrong with lacking the competence required to build secure messaging software. Most people do. Observe that for all the nitpicking about crypto that I do on HN, I haven't launched a tool like this either! But there's something very wrong with lacking competence but then going ahead and releasing something that users will stake their freedom on anyways.
- sillysaurus3 12y ago
  Thank you for the insights. Why would Levison refuse to comply with the government order and shut down his company? If he was an opportunist, the opportunistic action would've been to comply with the secret order while keeping his compliance secret. Users would've continued to trust Lavabit.
  - tptacek 12y ago
    Because "opportunism" and "principle" exist on spectrums. Opportunism prompted Levison to release a dangerously flawed privacy tool. But once that flaw threatened to compromise Snowden, circumstances crossed the threshold where principle required him to contain the damage he'd done.
    - jmathai 12y ago
      Are there NO alternatives to what Lavabit provided? Even if it required software installation on the client? I have to assume Snowden understood the architecture of a "secure" webmail provider but still went with it. Better than Gmail I'm sure but far from something to rely on.
      - tptacek 12y ago
        There are lots of alternatives, but none of them involve signing up for a web service and not installing any software. And no, I don't think Lavabit was likely to have been safer than Gmail. Lavabit doesn't have one of the industry's best security teams and largest software security budgets trying to make sure there aren't horrible vulnerabilities in it.

by jnbiche 12y ago

sillysaurus3 12y ago

Was Snowden public knowledge when Levison was first served a warrant? I can't remember. Levison was served with a warrant very quickly. Are you sure his actions were to protect Snowden? EDIT: I meant, were Snowden's actions public knowledge when Levison was served the warrant? Not merely Snowden's name, but the extent of what he did?

tptacek 12y ago

The opportunism I'm referring to was setting up Lavabit in the first place, as a web-based email provider that made expansive claims about security that it couldn't possibly back up. It's easy for me to understand why people think Levison is a hero. They think Lavabit was a noble, useful offering, and that government intervention is the only reason it failed. To understand my position, you need to know that Lavabit's architecture was almost comically unsound; it claimed to protect the privacy of thousands of users, but all the weight of that claim was borne by a set of keys Lavabit's operators had total control over. Online privacy tools don't need to work like this. They often do, though, because transcending this pitiful security model requires that users install software. Nobody wants to install software. Not to mention, most of the people who want to build and offer these tools don't really know how to build locally-installable software. There's nothing wrong with lacking the competence required to build secure messaging software. Most people do. Observe that for all the nitpicking about crypto that I do on HN, I haven't launched a tool like this either! But there's something very wrong with lacking competence but then going ahead and releasing something that users will stake their freedom on anyways.

sillysaurus3 12y ago
Thank you for the insights. Why would Levison refuse to comply with the government order and shut down his company? If he was an opportunist, the opportunistic action would've been to comply with the secret order while keeping his compliance secret. Users would've continued to trust Lavabit.
- tptacek 12y ago
  Because "opportunism" and "principle" exist on spectrums. Opportunism prompted Levison to release a dangerously flawed privacy tool. But once that flaw threatened to compromise Snowden, circumstances crossed the threshold where principle required him to contain the damage he'd done.
  - jmathai 12y ago
    Are there NO alternatives to what Lavabit provided? Even if it required software installation on the client? I have to assume Snowden understood the architecture of a "secure" webmail provider but still went with it. Better than Gmail I'm sure but far from something to rely on.
    - tptacek 12y ago
      There are lots of alternatives, but none of them involve signing up for a web service and not installing any software. And no, I don't think Lavabit was likely to have been safer than Gmail. Lavabit doesn't have one of the industry's best security teams and largest software security budgets trying to make sure there aren't horrible vulnerabilities in it.