Is anyone else thinking that their systems should include a self-destruct button? (for LavaBit I'd imagine a process that e-mailed each user the SSL key used to encrypt their mailbox, then deleted the key from the system. A user could still decrypt their mailbox by downloading it and using the key).
How Lavabit Melted Down
31–40 of 177 posts
Re: How Lavabit Melted Down
#32Is anyone else thinking that their systems should include a self-destruct button? (for LavaBit I'd imagine a process that e-mailed each user the SSL key used to encrypt their mailbox, then deleted the key from the system. A user could still decrypt their mailbox by downloading it and using the key).
The problem is that services like Lavabit want to do something that is technically not possible: give you access to your encrypted mail from any computer i.e. the convenience of webmail. If I can just download a key and keep it on my computer, why would I not just generate the key on my computer by e.g. using PGP or S/MIME?
Re: How Lavabit Melted Down
#33The more I read the more sympathy I have for the government here. They had a (presumably lawfully obtained) warrant against a specific user; it's not they who designed lavabit such that it was impossible to execute this without obtaining access to every other user. The proposal that Levison would extract the information himself rather than turning over the keys strikes me as completely unrealistic - any information s…
> it's not [the government] who designed lavabit such that it was impossible to execute this without obtaining access to every other user. That's true, but they're still essentially implying that services which are explicitly designed to omit backdoor capabilities for the government to spy on you -- that is, services offering actual cryptographically guaranteed privacy, not just "no one has looked yet, and if they di…
CALEA requires that all telephone companies (and now mobile phone and cable companies) provide a means of "tapping" a phone line. To my knowledge, there's nothing similar that says a data service has to provide the ability to retrieve unencrypted data.
Re: How Lavabit Melted Down
#34Earlier quoted context omitted.
It has always been illegal to not comply with search warrants. Why would search warrants for digital data be any different?
It's also always been legal to say "sorry, we never record any of that information". You can get a warrant asking a bartender to provide you with names, addresses, and arrival and departure times, and transcripts of every conversation of every patron of his bar, and he can stand up in court and say "sorry, I don't have that information, and I'm not prepared to start collecting it.". Would you be happy for the FBI to…
[deleted]
Re: How Lavabit Melted Down
#35The fact the government wanted the SSL keys is obvious they wanted to get at all his customers, not just the one they were targeting.
Levison offered multiple times to write a specific script for the single user that would do what they wanted and at a minimal cost to the government - and they refused. A pretty clear indication they wanted unfettered access to his client base and his network.
Then you add in the lack of ANY oversight on either Lavabit's or the government's, and you have to praise him for what he did.
Re: How Lavabit Melted Down
#36News outlets keep repeating "11 pages of 4-point type totaling 2560 characters", which just doesn't match up since that number of characters fits on one page in a fairly normal font size. Also, RSA keys just aren't that big, so the 11 pages must have either been many keys or some other data. As I understand Lavabit's architecture, there is no "master" key. Instead, incoming mail is encrypted using an asymmetric per-u…
>News outlets keep repeating "11 pages of 4-point type totaling 2560 characters", which just doesn't match up since that number of characters fits on one page in a fairly normal font size. Also, RSA keys just aren't that big, so the 11 pages must have either been many keys or some other data.
You're making assumptions about the encoding...
Re: How Lavabit Melted Down
#37The integrity and bravery he has shown in this fight is impressive. He has definitely earned enough "cred" to restart this business outside the US and be very successful.
We really need more companies (and those in control of those companies) that stand up for their customers this same way. A public company would not have been able to make this play, so keep that in mind when you are making decisions about where to put your data.
> A public company would not have been able to make this play,
Isnt it funny to hear that a public company would not have been able to do something when it is about something good for its consumers and ultimately its country and citizens, but when it is something extremely bad like compliance, obedience and evilness then they suddenly can and are free to do it.
There is nothing stopping Google, Facebook or Microsoft to act as Lavabit did. Nothing at all except for their own cowardice, malicious intents and disregard for laws and their costumers.
It is like Obama, when it comes to do something good then his hands are tied, when it comes to break laws and shit on constitution to extend mass surveillance or to wage war and drone kill civilians then his hands are not tied.
Now, lets hear some more excuses for the way the most successful tech-companies have acted, their hands were tied, they would face huge repercussions, they didnt know better, they only meant to comply with law and so on.
The truth is, they dont have democracy in interest, or their consumers best in interest, in fact you as consumer and user for their services and these companies are diametrically opposed and for your best you should consider them enemies.
Re: How Lavabit Melted Down
#38Earlier quoted context omitted.
It has always been illegal to not comply with search warrants. Why would search warrants for digital data be any different?
It's also always been legal to say "sorry, we never record any of that information". You can get a warrant asking a bartender to provide you with names, addresses, and arrival and departure times, and transcripts of every conversation of every patron of his bar, and he can stand up in court and say "sorry, I don't have that information, and I'm not prepared to start collecting it.". Would you be happy for the FBI to…
It's also always been legal to say "sorry, we never record any of that information"
Only if it is true. He has the data, the article says he has worked with law enforcement before in a kiddie porn case.
Re: How Lavabit Melted Down
#39The more I read the more sympathy I have for the government here. They had a (presumably lawfully obtained) warrant against a specific user; it's not they who designed lavabit such that it was impossible to execute this without obtaining access to every other user. The proposal that Levison would extract the information himself rather than turning over the keys strikes me as completely unrealistic - any information s…
I have not reviewed the documents in question, so forgive me if I'm wasting your time, but I suspect it was not, in fact, a warrant. Generally requests for so-called 'metadata' don't require the same amount of supporting evidence as search warrants (the theory being that you shouldn't have an expectation of privacy for that data).
Lavabit was a service that explicitly provided a secure and private email to its paying customers. In my opinion, an expectation of privacy _did_ in fact exist for its user's 'metadata'.
Re: How Lavabit Melted Down
#40Earlier quoted context omitted.
We really need more companies (and those in control of those companies) that stand up for their customers this same way. A public company would not have been able to make this play, so keep that in mind when you are making decisions about where to put your data.
> A public company would not have been able to make this play, Isnt it funny to hear that a public company would not have been able to do something when it is about something good for its consumers and ultimately its country and citizens, but when it is something extremely bad like compliance, obedience and evilness then they suddenly can and are free to do it. There is nothing stopping Google, Facebook or Microsoft…
> There is nothing stopping Google, Facebook or Microsoft to act as Lavabit did. Nothing at all except for their own cowardice, malicious intents and disregard for laws and their costumers.
Try being CEO of Google, Facebook, or Microsoft, and suddenly deciding to close the entire business, and see how far you get before being removed.