I can finally get my old mail back. :)
I just want it so that I can move my domain, which was registered with a nerdshack.com account.
Lavabit Reloaded
191–200 of 240 posts
Re: Lavabit Reloaded
#192this smells funny.
Re: Lavabit Reloaded
#193Re: Lavabit Reloaded
#194If you really want secure email, having it hosted and owned by a U.S. company is a recipe for disaster. Since we know that the U.S. gov't will gladly issue gag orders and blackmail, why even bother? It's great that Lavabit is innovating but Protonmail is already ahead by simply not being in the U.S..
> Protonmail is already ahead by simply not being in the U.S.
Protonmail is not ahead in terms of technology. Lavabit is developing new email protocols, Protonmail is just a centralized service, and only its client is open-source: https://github.com/ProtonMail/WebClient
Re: Lavabit Reloaded
#195Earlier quoted context omitted.
If Edward Snowden started a mail service, I'd probably trust it more. If you want to talk about "going to the mat" for people, I think Snowden has made the bigger sacrifice. Moxie and Whisper Systems probably would get my nod too. Perhaps even DJB or Bruce Schnier.
Moxie is not impressed with lavabit as lavabit's entire security model relied on "we totally promise we won't look at your private key." https://moxie.org/blog/lavabit-critique/ >Unlike the design of most secure servers, which are ciphertext in and ciphertext out, this is the inverse: plaintext in and plaintext out. The server stores your password for authentication, uses that same password for an encryption key, and…
This one is about old Lavabit. It equals "trustful mode" of the new Lavabit.
Re: Lavabit Reloaded
#196Earlier quoted context omitted.
It is smart to not speculate on patents. You have now possibly poisoned everyone reading this thread.
If patent law worked like coodies that comment would be awesome.
Willful infringement allows the court to give judgements for up to triple compensatory damages in the US, so sometimes not knowing can be valuable.
Re: Lavabit Reloaded
#197Earlier quoted context omitted.
If patent law worked like coodies that comment would be awesome.
The interpretation of IP law, at least internally at many big software companies, does in fact work like coodies. Hence things like "clean room implementations" of algorithms, modules, API interfaces etc.
Clean room matters for copyright. It doesn't help for patents, as patents protects the idea, not the expression of it so expressing the same idea in a different way doesn't help. With a patent you want to know the specifics of the original to ensure you make yours sufficiently different to sidestep the claims.
Where not knowing helps with patents it is in that if you infringe, wilfull infringement increases damages up to threefold.
Re: Lavabit Reloaded
#198Earlier quoted context omitted.
he has said that he used pgp in his emails with poitras and greenwald because he knew from personal experience that, properly implemented, nsa was unable to decrypt messages protected with it
Are you saying he didn't use Lavabit and Cryptocat?
He used PGP over Lavabit. So even though Lavabit was compromised, content of his emails is secure.
Re: Lavabit Reloaded
#199Earlier quoted context omitted.
> > Search isn't possible > It absolutely is, in both theory and practice. The server stores an encrypted index, and the client walks it (requesting parts as needed). It's going to little slower, and a lot more complex but it's doable. Are you suggesting that to search your mailbox, the client should download every single encrypted message in the entire mailbox and decrypt them all locally to search them? If not, how…
> > Encrypted Index This is not the same as the content.
Well, the client has to fetch message once, decrypt it, and upload updates to the index (kept on server).
I guess, it is a reasonable sacrifice for privacy, unless you want searches to be able to search within attachments including documents in big archives.
Re: Lavabit Reloaded
#200If you NEED encryption, don't use email. From: https://blog.fastmail.com/2016/12/10/why-we-dont-offer-pgp/ What's the tradeoff? If the server doesn't have access to the content of emails, then it reverts to a featureless blob store: Search isn't possible Previews can't be calculated If you lose your private key, we can't recover your email Spam checking on content isn't possible To access mail on multiple devices, th…
I'm downloading my mail from POP3 servers, so I'm searching locally. I'm copying access password to my tablet and phone (K9 client) and I don't keep more than a few dozen of messages there because the POP3 mailboxes are cleaned up when I download from the laptop. I backup my mail to a remote server, encrypted with duplicity.
I understand that this is not acceptable for 99.99+% of people, even the technical ones, but I think I could use a fully encrypted mail store. No problem with the mail provider ending up as a blob store: privacy-wise it's what they should be anyway. No harm to their business, if all the money they make are from users and they're not selling data.
The only problem is centralized spam checking. Running an antispam engine locally wasn't very effective years ago and Thunderbird was sub par. Is there anything that's on par with email providers right now?