Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit Reloaded

lavabit.com

Post reply on HN
Print view View original

51–60 of 240 posts

Re: Lavabit Reloaded

#51

Post by ycmbntrthrwaway »

pvg wrote: post #45
ycmbntrthrwaway wrote: post #39

Earlier quoted context omitted.

> The completely pointless escalation forced him to compromise all of his users How has he compromised all of his users? The service was shut down and emails kept encrypted. Am I missing something?

He gave up the cert, there was no PFS-only configuration, plus, presumably the FBI got to do their surveillance except instead of the target's email, they could read everyone's. So no, you are not right.

I was not aware he gave up the cert in the end. Thought he just closed website without disclosing TLS cert. Now it looks way worse than I imagined.

Anyway, I really hope that it leads to adoption of backward-compatible and secure email protocols. Server encryption can't be trusted anymore anyway, we need end-to-end encryption.

Re: Lavabit Reloaded

#52

Post by codazoda »

chuckdries wrote: post #31
tptacek wrote: post #30

In August 2013, I was forced to make a difficult decision: violate the rights of the American people and my global customers or shut down. I chose Freedom. Shouldn't that "or" be an "and"?

what do you mean?

My understanding is that he was legally forced to hand over the encryption key and all the data. The FBI, then, could have read all messages that were available on the server.

He shut down so that no additional mail could be sent and read.

It's unclear to me how much mail was kept on the server. Only unread mail? Anything in your inbox? Everything?

Re: Lavabit Reloaded

#54

Post by imglorp »

bigbrooklyn wrote: post #15

If you NEED encryption, don't use email. From: https://blog.fastmail.com/2016/12/10/why-we-dont-offer-pgp/ What's the tradeoff? If the server doesn't have access to the content of emails, then it reverts to a featureless blob store: Search isn't possible Previews can't be calculated If you lose your private key, we can't recover your email Spam checking on content isn't possible To access mail on multiple devices, th…

I would argue the biggest downside to encrypted email is the sender, recipient, date, and size are known to all intermediaries.

First of all, sometimes knowing who you talk to is more important than knowing what you say. Traffic analysis lets you draw all kinds of conclusions.

Secondly, there are two parties, so double the chances for rubber hose cryptography. An opponent can approach either party and ask for details, so both parties are trusting the other can't be broken by the opponent.

Of course, we should all be encrypting everything anyway, no point in giving out free message bodies.

Re: Lavabit Reloaded

#55

Post by revelation »

bigbrooklyn wrote: post #15

If you NEED encryption, don't use email. From: https://blog.fastmail.com/2016/12/10/why-we-dont-offer-pgp/ What's the tradeoff? If the server doesn't have access to the content of emails, then it reverts to a featureless blob store: Search isn't possible Previews can't be calculated If you lose your private key, we can't recover your email Spam checking on content isn't possible To access mail on multiple devices, th…

Gee, if only we could execute code on the client! That would be very empowering in this situation.

I guess it's not possible, then.

Re: Lavabit Reloaded

#57

Post by kobeya »

bigbrooklyn wrote: post #15

If you NEED encryption, don't use email. From: https://blog.fastmail.com/2016/12/10/why-we-dont-offer-pgp/ What's the tradeoff? If the server doesn't have access to the content of emails, then it reverts to a featureless blob store: Search isn't possible Previews can't be calculated If you lose your private key, we can't recover your email Spam checking on content isn't possible To access mail on multiple devices, th…

This is all ridiculous. Download, index, and process your mail locally. Problem solved.

Re: Lavabit Reloaded

#58

Post by dandelion_lover »

zymhan wrote: post #9

Any reason I shouldn't sign up right now? edit: Signed up. Half off for life is a sweet deal.

As written in another comment (https://news.ycombinator.com/item?id=13447493), one has to give away too much personal information without clear reason.

I would suggest to use https://posteo.de instead. They offer anonymous payment by post (I'm just a happy user).

Re: Lavabit Reloaded

#59

Post by pvg »

ycmbntrthrwaway wrote: post #51
pvg wrote: post #45

Earlier quoted context omitted.

He gave up the cert, there was no PFS-only configuration, plus, presumably the FBI got to do their surveillance except instead of the target's email, they could read everyone's. So no, you are not right.

I was not aware he gave up the cert in the end. Thought he just closed website without disclosing TLS cert. Now it looks way worse than I imagined. Anyway, I really hope that it leads to adoption of backward-compatible and secure email protocols. Server encryption can't be trusted anymore anyway, we need end-to-end encryption.

The business with the cert was just the final outcome. The initial mistake was making and selling snake oil. It is possible for someone to innocently do this, out of inexperience and ignorance.

Over time, though, it's become increasingly clear Ladar Levison is just a snakeoil salesman who misled his users. He's never acknowledged he did anything wrong. Don't fall for his posturing about 'Freedom'.

Re: Lavabit Reloaded

#60

Post by ycmbntrthrwaway »

pvg wrote: post #29
ycmbntrthrwaway wrote: post #10

Earlier quoted context omitted.

> Former Lavabit users will be able to access their accounts in “Trustful” mode Looks like Trustful mode is how the old lavabit operated. > If you're going to operate in "trustful" mode, lavabit isny offering any real security wins over any other mail host. This level of security apparently was enough to protect email contents against FBI. The reason this "insecure" mode is kept is to allow users to continue using th…

How did it protect email contents from the FBI? They got warrants and got the emails.

Well, if you have not logged in since they started recording traffic and until shutdown, chances are your password is not compromised and emails are still encrypted. But no way to be sure.
Post reply on HN