Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Exactly Did The US Government Ask Lavabit to Do?

xato.net

Post reply on HN
Print view View original

31–40 of 46 posts

Re: What Exactly Did The US Government Ask Lavabit to Do?

#31

Post by chris_mahan »

zokier wrote: post #12
sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

This gets asked a lot currently. The sentiment seems to be that email is doomed from a security viewpoint. You'll be leaking metadata no matter what. Even if your email provider was somehow secure, you have no way of knowing if the person (and their provider) you are communicating with is secure. If it's not (which is very likely) then all your efforts to secure your end are almost for nothing. So yeah, my suggestion…

Probably postcards are more secure.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#32

Post by mrb »

sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

Yes: run your own mail server.

This raises the barrier enough so that the NSA/FBI can't just request access to your mail. Instead now they would have to either physically access the mail server, or use extremely offensive techniques (backdoor your computer, take control of your mail server via a software vulnerability, etc).

Re: What Exactly Did The US Government Ask Lavabit to Do?

#33

Post by darrylb42 »

mrb wrote: post #32
sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

Yes: run your own mail server. This raises the barrier enough so that the NSA/FBI can't just request access to your mail. Instead now they would have to either physically access the mail server, or use extremely offensive techniques (backdoor your computer, take control of your mail server via a software vulnerability, etc).

If only running your own mail server, spam detection etc was a trivial exercise. I did this for many years running sendmail on OpenBSD, but it is so much nicer having Gmail now.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#34

Post by mpyne »

Buttons840 wrote: post #28
jauer wrote: post #23

So long as uninformed speculation is running loose... Lavabit's comment that "If you knew what I know about e-mail, you might not use it either." points in a email specific direction as opposed to simple sniffing of traffic. Perhaps he is referring to the Stored Communications Act ( http://en.wikipedia.org/wiki/Stored_Communications_Act ). I haven't seen it referenced in coverage of this but the gist is under the rig…

Had it been because of the Stored Communications Act, would that explain why he couldn't talk about it?

The concept of a gag order is orthogonal to specific laws. But I believe it was the Patriot Act that gave the Executive the power to make NSLs with a similar effect.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#35

Post by mpyne »

backprojection wrote: post #10
sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

Could you trust any that remain operating, after the Lavabit fiasco?

It simply depends on who is in your threat model.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#36

Post by coldcode »

frank_boyd wrote: post #3

As long as we don't have a statement from either the government or Lavabit, we can only speculate. The most reasonable thing is then of course to assume the worst - complete surveillance of all customers. The rest is pretty much details.

Until we get someone to risk going open with this we won't ever know. You can't fight a secret law in secret very well. But only people served with a secret demand has standing to challenge it. The barriers are too high as long as the Government can keep the secret. Once it's out of the bag you have more options in court. But you also risk everything they can do to you in secret.

Secrets have no place in a "democracy".

Re: What Exactly Did The US Government Ask Lavabit to Do?

#37

Post by bradleyjg »

sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

It depends on what you are trying to prevent.

If you run your own MTA/IMAP server and lock down the OS and BIOS sufficiently -- including encrypting the hard drive -- you can be fairly confident that your at rest emails, including metadata, will not be accessed without your knowledge. But there's not much at all you can do to prevent mail sent to or from your machine from being intercepted. Configuring your MTA to only converse over TLS will help, but ultimately you have no good reason to trust the other mail server.

You can encrypt all your message bodies using either PGP or S/MAIL, but that requires the people you are conversing with the have key pairs, and doesn't protect metadata.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#38

Post by bigiain »

zokier wrote: post #21
danrik wrote: post #17

Earlier quoted context omitted.

The entire email transation between a sender and a recipient usually looks like this: Sending Client [--A---> Sender SMTP Server [--B---> Recipient SMTP Server [--C--> Recipient IMAP/POP server Connections A and D are easily possible to encrypt, provided your provider provides SSL/TLS on their SMTP and IMAP/POP servers. Most usually do. Connection C is usually local to a single machine, or for large email providers w…

> That is almost always in clear text, as most of this infrastructure was designed 30 years ago and hasn't evolved much since then Email has definitely evolved since it's inception. STARTTLS (RFC3207) is the relevant standard here.

I don't suppose anyone has any stats (or even educated guesses) about how many mail servers you'd not be able to connect/send to if you enforced TLS connections from your outgoing SMTP server (as in, refused to send data to servers that didn't respond appropriately to a STARTTLS command)?

Re: What Exactly Did The US Government Ask Lavabit to Do?

#39

Post by bigiain »

darrylb42 wrote: post #33
mrb wrote: post #32

Earlier quoted context omitted.

Yes: run your own mail server. This raises the barrier enough so that the NSA/FBI can't just request access to your mail. Instead now they would have to either physically access the mail server, or use extremely offensive techniques (backdoor your computer, take control of your mail server via a software vulnerability, etc).

If only running your own mail server, spam detection etc was a trivial exercise. I did this for many years running sendmail on OpenBSD, but it is so much nicer having Gmail now.

"Those who would trade security for convenience deserve neither" (with apologies to Mr Franklin)

Having said that, I'm in exactly the same position.

(Though I'm very seriously considering going back to running a mail server myself - probably on a RaspberryPi inside a locked cabinet at home…)

Re: What Exactly Did The US Government Ask Lavabit to Do?

#40

Post by vinceguidry »

kyboren wrote: post #14
sudocw wrote: post #6

Are there currently any alternatives, in terms of secure email providers? I never even knew it was a thing before the lavabit fiasco.

Lavabit's closure highlights the fact that third-party email providers cannot be trusted to keep your email private. Even running your own mailserver (on a computer in your home, for example) won't save you from dragnet NSA surveillance or targeted attacks, but at least you'll know if the government sends you a National Security Letter or obtains a FISA court order for your email.

> Even running your own mailserver (on a computer in your home, for example) won't save you from dragnet NSA surveillance or targeted attacks, but at least you'll know if the government sends you a National Security Letter or obtains a FISA court order for your email.

At which point you could disconnect your mail store from the server, stick it somewhere safe, and claim that you don't store mail, you just read it then delete it. They'd have to get a warrant to search your home, they'd probably decide it isn't worth it.

Post reply on HN