Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

11–20 of 321 posts

Re: Lavabit SSL Cert Revoked

#12

Post by powertower »

Can this be classified as - http://en.wikipedia.org/wiki/Obstruction_of_justice ?

That is, I'm sure he understands that this action might be interfering with an investigation, and that it's reasonable to believe it was a willful act on his part.

Can you get into trouble for doing something like this?

Re: Lavabit SSL Cert Revoked

#14

Post by koudi »

powertower wrote: post #12

Can this be classified as - http://en.wikipedia.org/wiki/Obstruction_of_justice ? That is, I'm sure he understands that this action might be interfering with an investigation, and that it's reasonable to believe it was a willful act on his part. Can you get into trouble for doing something like this?

No. This does not affect their ability to use it. This certificate is simply no longer trusted by other parties (rightfully, because it was compromised). As matter of fact, this may not even be his doing.

Re: Lavabit SSL Cert Revoked

#16

Post by shmerl »

powertower wrote: post #12

Can this be classified as - http://en.wikipedia.org/wiki/Obstruction_of_justice ? That is, I'm sure he understands that this action might be interfering with an investigation, and that it's reasonable to believe it was a willful act on his part. Can you get into trouble for doing something like this?

When did unconstitutional massive surveillance become justice?

Re: Lavabit SSL Cert Revoked

#18

Post by powertower »

koudi wrote: post #14
powertower wrote: post #12

Can this be classified as - http://en.wikipedia.org/wiki/Obstruction_of_justice ? That is, I'm sure he understands that this action might be interfering with an investigation, and that it's reasonable to believe it was a willful act on his part. Can you get into trouble for doing something like this?

No. This does not affect their ability to use it. This certificate is simply no longer trusted by other parties (rightfully, because it was compromised). As matter of fact, this may not even be his doing.

What if the 3rd party the FBI wanted to intercept via this Cert has now been 1) notified that there is a problem and 2) can no longer be intercepted (unless their browser does no CRL or OCSP checks on the domain's cert)?

Re: Lavabit SSL Cert Revoked

#19

Post by bcoates »

ihsw wrote: post #7

It would be interesting to see it be re-instated at the behest of the FBI.

They'd have to go after GoDaddy to do that:

  $ curl http://crl.godaddy.com/gds1-64.crl | 
  > openssl crl -text -noout -inform DER | 
  > grep -A 6 2771FD5D73A8BB
    Serial Number: 2771FD5D73A8BB
        Revocation Date: Oct  3 22:57:44 2013 GMT
        CRL entry extensions:
            X509v3 CRL Reason Code:
                Key Compromise
            Invalidity Date:
                Feb 16 07:00:00 2012 GMT

Re: Lavabit SSL Cert Revoked

#20

Post by michaelmior »

recursive wrote: post #17
jevinskie wrote: post #11

Earlier quoted context omitted.

It would be pointless, everyone knows by now that it is burned.

Perhaps there is some automated robot that uses it that doesn't follow the news headlines.

Hopefully if such a robot really cares about security, it is checking for revoked certificates. Although this is admittedly a pain to set up.
Post reply on HN