Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Lavabit Melted Down

newyorker.com

Post reply on HN
Print view View original

51–60 of 177 posts

Re: How Lavabit Melted Down

#51

Post by adolph »

andylei wrote: post #30
kbart wrote: post #24

I still don't get one thing about this story: >> To make use of these keys, the F.B.I. would have to manually input all two thousand five hundred and sixty characters, and one incorrect keystroke in this laborious process would render the F.B.I. collection system incapable of collecting decrypted data Don't FBI have some ultra DPI scanner with advanced OCR software? Let's say they live under a rock, it's still not so…

what really happened is that the court then ordered him to turn over the key on a CD, or continue to face the $5k / day fine. so he eventually did turn over the key on a CD

Was it a bmp file on the CD?

I should read the article...

Re: How Lavabit Melted Down

#52

Post by nitrogen »

alexwright wrote: post #50
jobu wrote: post #5

Earlier quoted context omitted.

It wouldn't surprise me if they had some sort of back door with Verisign or other certificate companies for this.

CA like Verisign don't have the key though, this misconception is too common. If you're doing it right the CA is just signing a cert you've generated, they never see the key.

Having CA access does allow them to create a silent MITM in the absence of certificate pinning.

Re: How Lavabit Melted Down

#53

Post by CaptainZapp »

wyck wrote: post #18
redbeard0x0a wrote: post #9

Earlier quoted context omitted.

We really need more companies (and those in control of those companies) that stand up for their customers this same way. A public company would not have been able to make this play, so keep that in mind when you are making decisions about where to put your data.

I think Qwest Communications was a public company when they refused to comply with the NSA.

And if I recall correctly their ex-CEO is now in jail on allegedly trumped up charges.

If true this is utterly despicable by the government. Alas, I'm not surprised.

Re: How Lavabit Melted Down

#54

Post by lymie »

lnanek2 wrote: post #48
wyck wrote: post #18

Earlier quoted context omitted.

I think Qwest Communications was a public company when they refused to comply with the NSA.

Didn't they die after that due to the government canceling contracts with them?

Didn't Eric Schmidt lose his discount NASA airplane fuel when Google's lawyers started fighting their gag orders in court?

Re: How Lavabit Melted Down

#55

Post by lymie »

SideburnsOfDoom wrote: post #47
smoyer wrote: post #33

Earlier quoted context omitted.

CALEA requires that all telephone companies (and now mobile phone and cable companies) provide a means of "tapping" a phone line. To my knowledge, there's nothing similar that says a data service has to provide the ability to retrieve unencrypted data.

What they required was more like the means to tap all the phone lines simultaneously.

This is why phone companies are allowed to be a monopoly. No mom and pop shop would allow it.

Re: How Lavabit Melted Down

#56

Post by jessaustin »

lnanek2 wrote: post #48
wyck wrote: post #18

Earlier quoted context omitted.

I think Qwest Communications was a public company when they refused to comply with the NSA.

Didn't they die after that due to the government canceling contracts with them?

They've been merged into CenturyLink, but I doubt that's because of losing some government contracts. Those would be a drop in the bucket for an ILEC. USA telco consolidation is inexorable, for anti-consumer reasons. Actually it's only a matter of time before VZN acquires CenturyLink and then spins its less profitable/deadwood pieces back out to private equity firms. Much money will be made by executives, and much wailing to PUCs will be heard when service craters.

Re: How Lavabit Melted Down

#57

Post by sanderjd »

antocv wrote: post #41
misnome wrote: post #40

Earlier quoted context omitted.

> There is nothing stopping Google, Facebook or Microsoft to act as Lavabit did. Nothing at all except for their own cowardice, malicious intents and disregard for laws and their costumers. Try being CEO of Google, Facebook, or Microsoft, and suddenly deciding to close the entire business, and see how far you get before being removed.

There are some causes that are worth being removed as CEO for. Lavabit founder finally is allowed to speak about this. It is enough if you threaten to shut down the business to make it known to the G-men that you wont play (the totalitarian) ball. We stopped SOPA/PIPA just with a partial blackout. But these companies didnt make a squeek. They are accomplices.

> There are some causes that are worth being removed as CEO for.

Yeah, but not if it's an empty gesture that doesn't change anything. Any CEO of Google both wouldn't be able to shut it down rather than comply, and would be removed for trying. It would accomplish nothing.

Re: How Lavabit Melted Down

#58

Post by alexwright »

nitrogen wrote: post #52
alexwright wrote: post #50

Earlier quoted context omitted.

CA like Verisign don't have the key though, this misconception is too common. If you're doing it right the CA is just signing a cert you've generated, they never see the key.

Having CA access does allow them to create a silent MITM in the absence of certificate pinning.

With a different key though.

Once you've got this new cert. you can MITM, but you can't use it to decrypt the traffic already captured. Also anyone paying attention sees the cert. fingerprint change out of the blue.

Re: How Lavabit Melted Down

#59

Post by emhs »

lmm wrote: post #44
bigiain wrote: post #21

Earlier quoted context omitted.

It's also always been legal to say "sorry, we never record any of that information". You can get a warrant asking a bartender to provide you with names, addresses, and arrival and departure times, and transcripts of every conversation of every patron of his bar, and he can stand up in court and say "sorry, I don't have that information, and I'm not prepared to start collecting it.". Would you be happy for the FBI to…

>You can get a warrant asking a bartender to provide you with names, addresses, and arrival and departure times, and transcripts of every conversation of every patron of his bar No, you can't; the courts don't issue warrants like that. They'd issue a warrant for that information for one particular patron whom they already had reasonable suspicion of. If the FBI have a warrant to put a bug on one regular's table, that…

The nature of email is that the government's methods would simply collect all users' data, regardless of whether it was the target's or not. This would be true regardless of Lavabit being designed with user protection in mind or not, unless specialized methods such as those Levison offered to write were employed. Such methods would necessarily vary from provider to provider, because each provider is set up differently. The government simply defaults to massive collection in all cases so they don't have to write that or pay someone to write it. He offered to give them a means to get only the data they asked for, but they turned that down.

Re: How Lavabit Melted Down

#60

Post by 65_196_127_226 »

The amount of support for Levison and ire toward the government in this case is absurd. The FBI followed the Constitutional process of obtaining a warrant for the information of the "one user".

I suspect that the only reason anyone cares about this case is because Lord Snowden the Infallible deigned to grace Lavabit with his email traffic.

Would the internet outrage be the same if the targeted user was found out to be a Goldman Sachs executive or a Westboro Baptist Church minister?

Post reply on HN