Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

71–80 of 321 posts

Re: Lavabit SSL Cert Revoked

#71

Post by thangalin »

l33tbro wrote: post #68
thangalin wrote: post #51

Earlier quoted context omitted.

I have mocked-up a system for policy creation. The project is open; please contribute your thoughts. People say "it has flaws" but never explain the flaws, nor how to address them. https://bitbucket.org/djarvis/world-politics/ Would greatly appreciate constructive criticism. The system serves to educate everyone (openly and transparently) on implications of existing and upcoming policies. If the idea intrigues you, c…

I agree with what you say about self-governing. By mobilizing, I simply meant forming something more cohesive than clicktivist petitions which most often go nowhere. Your wiki addresses this perfectly. I think you should continue pursuing and refining. The concept is fantastic.

That was one of my frustrations -- tens of thousands of clicktivists sending the same form letter to politicians is pointless. Especially when those same tens of thousands are not fully educated on the benefits and drawbacks about the policies they ardently clicktivise.

Re: Lavabit SSL Cert Revoked

#72

Post by fantnn »

thangalin wrote: post #51
l33tbro wrote: post #37

I'm so sick of being sickened. I hate that this is becoming the norm and we can't do anything about it. I hate to spit cliches, but is this where my tax dollars go? For me, govt and internet should almost be like church and state. Where is the data around foiled terrorist plots? I just can't stomach the obtuse logic that we need to pay our taxes to employ these virtual minders. This is not what the internet is about.…

I have mocked-up a system for policy creation. The project is open; please contribute your thoughts. People say "it has flaws" but never explain the flaws, nor how to address them. https://bitbucket.org/djarvis/world-politics/ Would greatly appreciate constructive criticism. The system serves to educate everyone (openly and transparently) on implications of existing and upcoming policies. If the idea intrigues you, c…

Opinions vs. Facts The community should be encouraged to favour facts over opinions.

Er, this is one of the largest problems facing Democracy since it was invented millenia ago. Look at the current American government shutdown, and the way Republicans have managed to frame the debate using empty rhetoric, when in reality both the debt ceiling and government spending are currently not an issue http://delong.typepad.com/sdj/2013/10/whiskey-tango-foxtrot-...

Re: Lavabit SSL Cert Revoked

#73

Post by Buttons840 »

thangalin wrote: post #64
Buttons840 wrote: post #55

Earlier quoted context omitted.

I like the ideas you present. Does this site exist? If not, what existing sites do you think are closest to your vision?

The site I have mocked-up does not exist. I want to work on it, but it does not pay, and I need to eat. :-) I am working on a side-project (yes, a start-up) that will provide the income I need to work full-time on the World Politics idea. The closest idea is probably: https://canada.yrpri.org/ It has a number of issues, though.

I've had similar ideas, mainly focused on holding legislators and their contributors accountable.

It should be really easy to see how legislators voted, and also to see which companies contributed most to those on either side of the vote.

Also, I would include a "I approve/disapprove of this legislation" button. This way, the site could tell something like "You current Senator voted for the bills you support 15% of the time." In which case, you vote for someone else.

Re: Lavabit SSL Cert Revoked

#74

Post by pkteison »

7402 wrote: post #60

I wondered why Safari (running on an older OS X 10.6 system) didn't report the certificate as revoked, although Firefox on the same system did. The answer appears to be as described here: http://www.intego.com/mac-security-blog/protect-safari-from-... After setting the proper options in Keychain Access, Safari reported the revocation correctly.

FYI, this was enabled by default in Lion (10.7.2).

Re: Lavabit SSL Cert Revoked

#75

Post by anologwintermut »

Anyone using Safari or IE apparently isn't getting a forward secure connection to https://Lavabit.com . They end up with TLS_RSA_WITH_AES_256_CBC_SHA according to SSLLabs[0].

Since things escalated to the point where Lavabit had to hand over it's key rather than the data on one account the FBI obtained an initial court order for [1], anyone with a transcript of those sessions and access to the key can read them.

The resulting cipher suites:

IE 6 / XP No FS * SSL 3 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) No FS 168

IE 7 / Vista TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

IE 8 / XP No FS * TLS 1.0 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) No FS 168

IE 8-10 / Win 7 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

IE 11 / Win 8.1 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

Safari 5.1.9 / OS X 10.6.8 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

Safari 6 / iOS 6.0.1 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

Safari 6.0.4 / OS X 10.8.4 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

Safari 7 / OS X 10.9 TLS 1.0 TLS_RSA_WITH_AES_256_CBC_SHA (0x35) No FS 256

[0]https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2... [1]http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/

Re: Lavabit SSL Cert Revoked

#77

Post by harshreality »

sillysaurus2 wrote: post #57
jamesaguilar wrote: post #50

Earlier quoted context omitted.

Presumably if you care about security you are using a browser that does PFS and have personally verified that it is working.

You mean browsers actually fall back to non-perfect-forward-secrecy? They even have the option of doing that? That's interesting if true. Ideally it should be enforced by the server, and if the browser can't support it, then the browser can't see the webpage.

They have to, because many sites don't support any PFS ciphersuites. For instance, banks.

https://www.ssllabs.com/ssltest/analyze.html?d=www.bankofame...

https://www.ssllabs.com/ssltest/analyze.html?d=chaseonline.c...

https://www.ssllabs.com/ssltest/analyze.html?d=online.citiba...

https://www.ssllabs.com/ssltest/analyze.html?d=us.hsbc.com&s...

https://www.ssllabs.com/ssltest/analyze.html?d=online.wellsf...

Ideally, Microsoft, Google, Apple, and Firefox would gang up and all disable ciphersuites lacking DHE/ECDHE in their current browsers. Short of that, one browser disabling them would be viewed as "broken" and would lose marketshare.

Re: Lavabit SSL Cert Revoked

#79

Post by jmillikin »

sillysaurus2 wrote: post #57
jamesaguilar wrote: post #50

Earlier quoted context omitted.

Presumably if you care about security you are using a browser that does PFS and have personally verified that it is working.

You mean browsers actually fall back to non-perfect-forward-secrecy? They even have the option of doing that? That's interesting if true. Ideally it should be enforced by the server, and if the browser can't support it, then the browser can't see the webpage.

The browser and the server both have lists of ciphers they will permit. Any cipher shared between both endpoints can be used.

Browsers permit connecting with non-FS ciphers because there are many many servers out there with cipher lists based on older versions of SSL/TLS, and users would complain if they upgraded Firefox and couldn't connect to their bank.

Servers permit connecting with non-FS ciphers because excluding them would block users with older browsers from accessing the server, and give them a confusing unhelpful error page.

It is possible for the server owner to permit only FS ciphers (and therefore impose a strict version requirement on browssers).

Re: Lavabit SSL Cert Revoked

#80

Post by jonlucc »

scott_karana wrote: post #45
interstitial wrote: post #40

Earlier quoted context omitted.

And our contribution becomes part of our "permanent record" with the NSA? So glad I'm a US citizen and need not fear about such things.

That just sounds like fearmongering. I can't see any way that helping to fund someone's court case can be considering a crime, even if he were completely in the wrong. I strongly suspect that there are favourable legal precedents, even.

David house was. http://www.nytimes.com/2013/09/10/business/the-border-is-a-b...
Post reply on HN