Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Lavabit Melted Down

newyorker.com

Post reply on HN
Print view View original

21–30 of 177 posts

Re: How Lavabit Melted Down

#21

Post by bigiain »

stonemetal wrote: post #15
fennecfoxen wrote: post #13

Earlier quoted context omitted.

> it's not [the government] who designed lavabit such that it was impossible to execute this without obtaining access to every other user. That's true, but they're still essentially implying that services which are explicitly designed to omit backdoor capabilities for the government to spy on you -- that is, services offering actual cryptographically guaranteed privacy, not just "no one has looked yet, and if they di…

It has always been illegal to not comply with search warrants. Why would search warrants for digital data be any different?

It's also always been legal to say "sorry, we never record any of that information". You can get a warrant asking a bartender to provide you with names, addresses, and arrival and departure times, and transcripts of every conversation of every patron of his bar, and he can stand up in court and say "sorry, I don't have that information, and I'm not prepared to start collecting it.". Would you be happy for the FBI to be able to compel a bar owner to start collecting those records for everybody who walks into his bar? Without letting either new patrons or regulars know he was doing so?

Re: How Lavabit Melted Down

#23

Post by Shivetya »

lmm wrote: post #10

The more I read the more sympathy I have for the government here. They had a (presumably lawfully obtained) warrant against a specific user; it's not they who designed lavabit such that it was impossible to execute this without obtaining access to every other user. The proposal that Levison would extract the information himself rather than turning over the keys strikes me as completely unrealistic - any information s…

The more I read the less I have. why? Because it is individuals within the government, who know that what they truly need it limited access, but rely on the backing of the US Government to just get everything in hopes something neat falls out.

Worded differently, far too many of these agents are willing to abuse the power of the courts, the secrecy of it all, to intimidate anyone because it makes the feel equally powerful.

there is NO justice when the courts are secret. Justice does not exist where the public is not allowed to go.

the issues he faced proved that there is nothing you can do because they will simply slap "secret" on anything and then threaten you with jail, which once there your stuck because no one was allowed to know.

Re: How Lavabit Melted Down

#24

Post by kbart »

I still don't get one thing about this story:

>> To make use of these keys, the F.B.I. would have to manually input all two thousand five hundred and sixty characters, and one incorrect keystroke in this laborious process would render the F.B.I. collection system incapable of collecting decrypted data

Don't FBI have some ultra DPI scanner with advanced OCR software? Let's say they live under a rock, it's still not so hard to manually type ~2k characters using magnifying glass. If so, what was the point to shut down Lavabit AFTER turning in printed keys?

P.S. I still highly respect Lavabit and people behind it, but this point in a story doesn't make sense at all.

Re: How Lavabit Melted Down

#25

Post by anologwintermut »

fennecfoxen wrote: post #13
lmm wrote: post #10

The more I read the more sympathy I have for the government here. They had a (presumably lawfully obtained) warrant against a specific user; it's not they who designed lavabit such that it was impossible to execute this without obtaining access to every other user. The proposal that Levison would extract the information himself rather than turning over the keys strikes me as completely unrealistic - any information s…

> it's not [the government] who designed lavabit such that it was impossible to execute this without obtaining access to every other user. That's true, but they're still essentially implying that services which are explicitly designed to omit backdoor capabilities for the government to spy on you -- that is, services offering actual cryptographically guaranteed privacy, not just "no one has looked yet, and if they di…

Lavabit had no such guarantees. First, the court order was for meta-data which wasn't encrypted. Second, encryption was done server side, so they did have access to the data the government requested.

The judge wasn't talking about end-to-end encryption. They were talking about Lavabit's assertion that it was difficult to get the data they admitted to having.

Re: How Lavabit Melted Down

#26

Post by gbin »

lmm wrote: post #10

The more I read the more sympathy I have for the government here. They had a (presumably lawfully obtained) warrant against a specific user; it's not they who designed lavabit such that it was impossible to execute this without obtaining access to every other user. The proposal that Levison would extract the information himself rather than turning over the keys strikes me as completely unrealistic - any information s…

I think you might make the piece of software reviewed by a digital forensics and make it somehow sign the captured document. It might stand in court.

Re: How Lavabit Melted Down

#27

Post by jedbrown »

News outlets keep repeating "11 pages of 4-point type totaling 2560 characters", which just doesn't match up since that number of characters fits on one page in a fairly normal font size. Also, RSA keys just aren't that big, so the 11 pages must have either been many keys or some other data.

As I understand Lavabit's architecture, there is no "master" key. Instead, incoming mail is encrypted using an asymmetric per-user key. All the key pairs were created by Lavabit and stored on-site, but locked by a password to be provided over TLS. Since Levison probably didn't compromise his system to store users' passwords, presumably the keys that he was handing over in 4-point type were still locked with a password.

Re: How Lavabit Melted Down

#28

Post by computer »

frenger wrote: post #22
selmnoo wrote: post #8

For the fortitude he has shown in fighting the good fight, please consider donating to his defense fund: http://lavabit.com/ (link at the end).

wtf? The site's [ https://lavabit.com ] SSL cert been revoked: http://d.pr/i/sc71 [IMG]

Great!

It's because the private certificate was forcibly supplied to the government. No longer secure => revoke it.

Re: How Lavabit Melted Down

#29

Post by eli »

frenger wrote: post #22
selmnoo wrote: post #8

For the fortitude he has shown in fighting the good fight, please consider donating to his defense fund: http://lavabit.com/ (link at the end).

wtf? The site's [ https://lavabit.com ] SSL cert been revoked: http://d.pr/i/sc71 [IMG]

Well, if it's the same cert that had its private key provided to the government, that would make sense.

Re: How Lavabit Melted Down

#30

Post by andylei »

kbart wrote: post #24

I still don't get one thing about this story: >> To make use of these keys, the F.B.I. would have to manually input all two thousand five hundred and sixty characters, and one incorrect keystroke in this laborious process would render the F.B.I. collection system incapable of collecting decrypted data Don't FBI have some ultra DPI scanner with advanced OCR software? Let's say they live under a rock, it's still not so…

what really happened is that the court then ordered him to turn over the key on a CD, or continue to face the $5k / day fine. so he eventually did turn over the key on a CD
Post reply on HN