5 ms·

I'm no longer sure that is enough. Considering what happened to Lavabit, just offering end-to-end encryption is only going to work until the government decides

I'm no longer sure that is enough. Considering what happened to Lavabit, just offering end-to-end encryption is only going to work until the government decides they want what you have hidden. I doubt that Microsoft will put up as much of a fight, or take the high road out, like the Lavabit founder did. Fighting them on the legal front to stop such practices from starting may well be the best option right now. Even though Microsoft may be doing this for business reasons, it'll still help everyone.

morsch 12y ago
Lavabit wasn't end-to-end encrypted.
Kalium 12y ago
If memory serves, the feds had probable cause and a warrant when they want after Lavabit. Lavabit tried to fight it. Lavabit lost. So they shut down instead and tried to spin it as the feds shutting them down.
- me1010 12y ago
  I believe they were told to hand over the SSL private key. I'm not sure everyone using the Lavabit service was a criminal... So, my thought is that probable cause for handing over the master key to the hotel should be a bit more than probable cause to hand over the room key...
  - Kalium 12y ago
    That's my understanding as well. Unfortunately, Lavabit used one SSL certificate for every incoming user, rendering it impossible to use anything lesser. So to continue your analogy, the hotel only had one key - the master.
- TheCraiggers 12y ago
  They did indeed have a warrant for the info. The problem was how they chose to pursue obtaining the info- that is, installing a MitM black box that could read all customer email going through it, not just the citizen for whom they had the warrant. I'm not sure if they promised or not to only snoop on that one individual, but even if they did you would have no way of knowing if they're telling the truth or not. From what I read, he wasn't necessarily trying to protect Snowden, but protect the rest of his userbase.
  - Kalium 12y ago
    What other options were there? There was only one SSL key. Once you can MitM one user in that scenario, you can MitM them all. To my understanding Lavabit didn't have a system in place for separating out one user like that, and the feds would likely have been disinclined to wait for the development of one. So perhaps we should take this as a lesson in designing systems to be as secure as possible even with legitimate warrants rather than as a sign of warrants being abused.
    - TheCraiggers 12y ago
      My understanding was that he offered them his programming services to create a method to do exactly what they wanted- pull the email info out for just one user. True, he was going to charge them for it, but it was only $2000. A laughably small sum for the people he was dealing with. Supposedly, they denied this offer because they couldn't control it. From my perspective, $2k and a couple day wait is a paltry sum to pay to not trample over the constitution. According to Wikipedia, just one month prior, Lavabit had complied with a search order for one user suspected of child pornography. I'm not exactly sure what the difference was between these two cases, but it does show he had at least some capability to do what they asked. I do agree that "one SSL key to rule them all" is perhaps not the best practice. That said, the design of the system doesn't matter as much to me. Reality is that the system was designed in the way it was, and when offered two methods of getting their data, the feds decided to take the wrong one. (In my opinion.)
      - Kalium 12y ago
        It wouldn't surprise me if the feds are sharply limited in what they can pay for warrant-wise. There's a good chance they simply didn't legally have the option of waiting and paying $2k. Understandably, the government does not want "I have a warrant" to become the sound of a cash cow begging to be milked. If I were to guess, I would say control is actually a huge issue. If it's their equipment and software that's certified for this use, it probably satisfied chain of custody and certification requirements. If it's someone else's, who knows? It's almost certainly not certified and so it might not stand up in court at all. Certification is a big deal in the government and a court is likely to be skeptical about the use of an unproven and uncertified magic software black box in executing a warrant. So what it comes down it is that the feds may not have actually had a choice of how they got that data.
me1010 12y ago
End users need to and can take control over their own email privacy. GPG. Ten minutes to download, install, and generate a key pair is all you need to secure your email. Perhaps the willingness to do so will increase when the government successfully argues that non-encrypted mail posted through an email server is the same as posting your thoughts on a public peg board... If you want full compatibility, you can pay a small yearly [extortion] fee to the Verisign gatekeepers... but I prefer not to...
- mahyarm 12y ago
  Pffft, GPG doesn't work if you want to communicate with other people. It's very difficult to get people to use it, and the UX is horrible for it. On top of that it's even harder to use on mobile platforms. GPG also doesn't have forward secrecy.
  - me1010 12y ago
    GPG works fine. It's difficult to get people to use encryption regardless of the implementation... I used to work for an organization that required, by written policy, all email to be encrypted. Everyone had an S/MIME cert with a short pin... the number of encrypted emails I received over a 7 year period was precisely - without exaggeration - '2.' People do not care about encrypted email, and don't want to bother with even the slightest inconvenience. This is by far the largest problem with encryption, much more so than any 'it's too difficult to use' excuse.
  - marcosdumay 12y ago
    Email can not have forward secrecy. You receive it in a time, and want to read it later.
marcosdumay 12y ago
End-to-end means that Microsoft has no capability of reading the emails, or share them with anybody, as they are not in any end of the communication.

morsch 12y ago

Lavabit wasn't end-to-end encrypted.

Kalium 12y ago

If memory serves, the feds had probable cause and a warrant when they want after Lavabit. Lavabit tried to fight it. Lavabit lost. So they shut down instead and tried to spin it as the feds shutting them down.

me1010 12y ago
I believe they were told to hand over the SSL private key. I'm not sure everyone using the Lavabit service was a criminal... So, my thought is that probable cause for handing over the master key to the hotel should be a bit more than probable cause to hand over the room key...
- Kalium 12y ago
  That's my understanding as well. Unfortunately, Lavabit used one SSL certificate for every incoming user, rendering it impossible to use anything lesser. So to continue your analogy, the hotel only had one key - the master.
TheCraiggers 12y ago
They did indeed have a warrant for the info. The problem was how they chose to pursue obtaining the info- that is, installing a MitM black box that could read all customer email going through it, not just the citizen for whom they had the warrant. I'm not sure if they promised or not to only snoop on that one individual, but even if they did you would have no way of knowing if they're telling the truth or not. From what I read, he wasn't necessarily trying to protect Snowden, but protect the rest of his userbase.
- Kalium 12y ago
  What other options were there? There was only one SSL key. Once you can MitM one user in that scenario, you can MitM them all. To my understanding Lavabit didn't have a system in place for separating out one user like that, and the feds would likely have been disinclined to wait for the development of one. So perhaps we should take this as a lesson in designing systems to be as secure as possible even with legitimate warrants rather than as a sign of warrants being abused.
  - TheCraiggers 12y ago
    My understanding was that he offered them his programming services to create a method to do exactly what they wanted- pull the email info out for just one user. True, he was going to charge them for it, but it was only $2000. A laughably small sum for the people he was dealing with. Supposedly, they denied this offer because they couldn't control it. From my perspective, $2k and a couple day wait is a paltry sum to pay to not trample over the constitution. According to Wikipedia, just one month prior, Lavabit had complied with a search order for one user suspected of child pornography. I'm not exactly sure what the difference was between these two cases, but it does show he had at least some capability to do what they asked. I do agree that "one SSL key to rule them all" is perhaps not the best practice. That said, the design of the system doesn't matter as much to me. Reality is that the system was designed in the way it was, and when offered two methods of getting their data, the feds decided to take the wrong one. (In my opinion.)
    - Kalium 12y ago
      It wouldn't surprise me if the feds are sharply limited in what they can pay for warrant-wise. There's a good chance they simply didn't legally have the option of waiting and paying $2k. Understandably, the government does not want "I have a warrant" to become the sound of a cash cow begging to be milked. If I were to guess, I would say control is actually a huge issue. If it's their equipment and software that's certified for this use, it probably satisfied chain of custody and certification requirements. If it's someone else's, who knows? It's almost certainly not certified and so it might not stand up in court at all. Certification is a big deal in the government and a court is likely to be skeptical about the use of an unproven and uncertified magic software black box in executing a warrant. So what it comes down it is that the feds may not have actually had a choice of how they got that data.

me1010 12y ago

End users need to and can take control over their own email privacy. GPG. Ten minutes to download, install, and generate a key pair is all you need to secure your email. Perhaps the willingness to do so will increase when the government successfully argues that non-encrypted mail posted through an email server is the same as posting your thoughts on a public peg board... If you want full compatibility, you can pay a small yearly [extortion] fee to the Verisign gatekeepers... but I prefer not to...

mahyarm 12y ago
Pffft, GPG doesn't work if you want to communicate with other people. It's very difficult to get people to use it, and the UX is horrible for it. On top of that it's even harder to use on mobile platforms. GPG also doesn't have forward secrecy.
- me1010 12y ago
  GPG works fine. It's difficult to get people to use encryption regardless of the implementation... I used to work for an organization that required, by written policy, all email to be encrypted. Everyone had an S/MIME cert with a short pin... the number of encrypted emails I received over a 7 year period was precisely - without exaggeration - '2.' People do not care about encrypted email, and don't want to bother with even the slightest inconvenience. This is by far the largest problem with encryption, much more so than any 'it's too difficult to use' excuse.
- marcosdumay 12y ago
  Email can not have forward secrecy. You receive it in a time, and want to read it later.

marcosdumay 12y ago

End-to-end means that Microsoft has no capability of reading the emails, or share them with anybody, as they are not in any end of the communication.