Lavabit abruptly shuts down • Hacker News Board

Re: Lavabit abruptly shuts down

#481

Post by jaekwon » Fri, Aug 09, 2013, 1:38 AM UTC

greendata wrote: post #476

jaekwon wrote: post #451

Earlier quoted context omitted.

Should I still use Golang? Would making crypto-software in Golang make it less secure? Would the irony be worth it? Is it a worthy language?

Obviously you're being somewhat facetious. If you're good/confident enough to write your own crypto, go seems fine as it's open source so you can inspect it. I don't trust myself to write my own crypt for important things, so obviously I would not use Golang for that and I would pause before using the Golang crypto module, but that's probably a bit paranoid. In general, I would probably use Golang on projects. I use…

Good analysis, I largely agree.

Then again, you hear about Microsoft or Sun/Oracle passing notes to the NSA about insecurities in the OS or JVM so that they can go about their stealthy ways. I wouldn't be surprised if the same happened with Go. But good point, it's open source.

There is also an issue with Go dependencies that may make it easier to introduce vulnerabilities. The solutions are discussed here: http://kylelemons.net/blog/2012/04/22-rx-for-go-headaches.ar...

Re: Lavabit abruptly shuts down

#482

Post by woah » Fri, Aug 09, 2013, 1:48 AM UTC

freshhawk wrote: post #422

wmboy wrote: post #403

Earlier quoted context omitted.

So... there would be market for a secure email service that ran on a ship/vessel that was permanently in the middle of international waters? (might have to have multiple vessel's for redundancy purposes)

So guarantee you will be regarded as a "terrorist" and then put yourself somewhere in the middle of international waters? At least when the ship disappeared off the face of the earth it would be easy to figure out what happened.

Pretty sad world we live in that this is entirely realistic.

Re: Lavabit abruptly shuts down

#483

Post by Draiken » Fri, Aug 09, 2013, 1:49 AM UTC

MrKurtz wrote: post #331

guelo wrote: post #183

The US government is destroying one of the few bright spots in the American economy with its out of control military. It is unconscionable. And the sad thing is it has been enabled by the betrayal by many of the web 2.0 giants, Facebook, Google etc. Google especially is sad to see since they were willing to forgo the Chinese market on principle, but then decided that taking on the authoritarian US government was too…

If you are seriously suggesting that abandoning the US market is a realistic option, especially for a multibillion dollar corporation, then you are (and I'm not using this word lightly) an idiot . Not to mention that there is no US equivalent to the rampant human rights violations and censorship in China.

I'd say that's exactly what they want everyone to think.

Of course we see more violations in china, but who's to say you don't have 10 times more of that from the US?

Just because they don't do it to US citizens (in most cases) it doesn't mean they don't do it.

Believing the other side is worse just cause you "see" more of that stuff, ends up being just blissful ignorance. Every party has it's faults and I have no doubt in my mind that the US has the most.

But we shouldn't worry... that's all to "protect the american citizens from terrorism" :D

Re: Lavabit abruptly shuts down

#484

Post by u2328 » Fri, Aug 09, 2013, 1:54 AM UTC

Any other Obama supporters out there so utterly disappointed in this administration? Call me naive, but good god this is depressing. Seems like the country at large is so much more willing to let this stuff slide because it's not Bush/Cheney doing it.

Congrats Democrats. Your complicity here has pretty much converted me to a third-party voter.

Re: Lavabit abruptly shuts down

#485

Post by patrickmay » Fri, Aug 09, 2013, 2:05 AM UTC

rexreed wrote: post #239

mortenjorck wrote: post #219

Earlier quoted context omitted.

He moves (or rather has already moved) to Russia.

Sounds like Bolivia or Venezuela would probably be a better first stop.

"Kid, the next time I say, 'Let's go someplace like Bolivia,' let's GO someplace like Bolivia."

Re: Lavabit abruptly shuts down

#486

Post by patrickmay » Fri, Aug 09, 2013, 2:08 AM UTC

jongraehl wrote: post #328

jlgreco wrote: post #167

Earlier quoted context omitted.

At this point, it is speculation that the judge would not be impressed. If anyone decided to test the theory, the public would be informed regardless.

I agree, but your analysis is missing something: the canary-threatener may be secretly, without a public ruling, within the refresh interval, be convinced that if he doesn't keep updating (falsely) the canary, he'll go to jail. In other words, the precommitment to stop producing the canary signal isn't fully credible (though it seems much more likely to get the message out than a promise to actively say if something…

The technical solution to that social problem (yeah, we know how well those work) is to set the refresh interval to be less than the time required to process a motion contesting the government's order to update the canary.

Re: Lavabit abruptly shuts down

#487

Post by patrickmay » Fri, Aug 09, 2013, 2:14 AM UTC

Karunamon wrote: post #47

Are there any countries, anywhere, where a person can store data outside the reach of the US government's illegal overreach? Any countries friendly to the US are right out. They can tap the lines, but there are ways around that. I just want to be able to park data where some twit with a piece of paper that says "NSA" on it can't get it retrieved or deleted. Any suggestions?

Nano-satellites with encrypted email servers? http://www.wired.co.uk/news/archive/2013-07/04/satellite-pla...

Re: Lavabit abruptly shuts down

#488

Post by GoodIntentions » Fri, Aug 09, 2013, 2:14 AM UTC

RyanZAG wrote: post #150

onli wrote: post #121

Earlier quoted context omitted.

Don't choose Germany. We may have strict privacy laws here, but we also have the BND cooperating with the NSA, tapping directly into the main internet nodes (Frankfurt). And don't forget that part of the method of the NSA is to use a mule inside the target company, which would be very easy in Germany given its status of being a wannabe ally of the USA and the longstanding sympathy of the german public for the USA. An…

"And Germany has also laws which force every mail provider to install an access point to the German authorities and intelligence agencies. I am not sure if also a generic saas platform would have to do it, but it is quite possible." Thanks for the heads up - as I said in the OP, it really is a difficult task. Those kind of laws are exactly what need to be avoided when choosing a country to host in. I don't believe th…

I was surprised to see Canada green on that map.

We have a great privacy commissioner ( http://www.priv.gc.ca/index_e.asp ) but the office holds no power so far as I can see, and the Canadian government has a pretty solid track record of being obsequiously cooperative with u.s. interests

Re: Lavabit abruptly shuts down

#489

Post by Spooky23 » Fri, Aug 09, 2013, 2:22 AM UTC

bennyg wrote: post #428

yajoe wrote: post #392

Earlier quoted context omitted.

(Forgive a 5-year-old memory of one of many cases -- I probably have the numbers wrong) It went something like this: The director of engineering approved a log retention plan that kept access logs for 7 days or something. They wanted to reduce costs and issues with log files were the top reasons for getting called to support the service. The government needed to demonstrate that someone had accessed the service 14 da…

Is there a legal precedent for minimum time that logs must be kept, say for an email service or messaging service? I'm talking about US policy, if that makes it more clear.

No, but you must follow your own policy.

You also need to take reasonable measures to preserve relevant data when you have reasonable cause to suspect that litigation or an investigation will begin.

Not having a policy can hurt you. If you have no deletion/retention policy, and happen to destroy data for some random reason when a litigation begins, you or your company may be in trouble.

Note: IANAL, and different industries or data categories have specific legal requirements or best practices for retaining things.

Re: Lavabit abruptly shuts down

#490

Post by vermontdevil » Fri, Aug 09, 2013, 2:23 AM UTC

Lavabit needs to contact their congress representative and raise stink. Explain to the representative that jobs and money is at stake. And explain to the local community how there will be jobs lost due to this behavior.

We need to start getting on both local communities and their representatives to emphasize the long term dangers of NSA's actions towards tax revenues, jobs, etc.

In other words speak their language and make them understand that inaction is not an option.

And yeah spare me the comments about how all Congress representatives are owned by corporations etc. It is still possible to get your representative to pay attention as they still need votes for the next election every two years.