Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

101–110 of 321 posts

Re: Lavabit SSL Cert Revoked

#101

Post by PeterisP »

kyboren wrote: post #47
scott_karana wrote: post #45

Earlier quoted context omitted.

That just sounds like fearmongering. I can't see any way that helping to fund someone's court case can be considering a crime, even if he were completely in the wrong. I strongly suspect that there are favourable legal precedents, even.

Non-citizens can be turned away at the US border for any reason, or no reason at all. Considering that a person's ability to travel to the US is so professionally important in this industry (for conferences, business meetings, etc.), I do not believe this is fearmongering. Remember the case of the man refused entry after a misinterpreted Tweet about 'destroying America'? [1] It seems clear NSA surveillance informs CB…

If such donations really cause problems at borders, then it will be a sign that the place is FUBAR and you (and everyone else) should avoid traveling there.

Re: Lavabit SSL Cert Revoked

#102

Post by interstitial »

sixothree wrote: post #91
notdonspaulding wrote: post #66

Earlier quoted context omitted.

The same day that everyone agreed "Roadside Safety Checks" (police looking for drunk drivers under the auspices of checking children's carseats at 1AM) was the lesser of two evils (Drunk drivers killing innocent people is a greater evil than everyone's 4th amendment rights being violated). To a lesser extent, anytime that politicians frame an issue with the two phrases "it's for the good of the public" and "it's not…

I'm hoping driverless cars begin to make people realize how intrusive these types of stops really are.

When it comes to public safety, the American people stand ready for intrusions of all kinds, it is truly for our own good. Government agents are privy to secret information unknown to the public, therefore we have no choice but to submit.

Re: Lavabit SSL Cert Revoked

#103

Post by thangalin »

gregw134 wrote: post #99
thangalin wrote: post #51

Earlier quoted context omitted.

I have mocked-up a system for policy creation. The project is open; please contribute your thoughts. People say "it has flaws" but never explain the flaws, nor how to address them. https://bitbucket.org/djarvis/world-politics/ Would greatly appreciate constructive criticism. The system serves to educate everyone (openly and transparently) on implications of existing and upcoming policies. If the idea intrigues you, c…

I love the idea, but I don't think people should be allowed to have unlimited up or down votes. That would encourage whimsical opinions, and would make the site reflect the opinions of the most active and opinionated users instead of the average person. I think there needs to be a way to limit the voice of each user so each person has the same amount of influence. One idea I like is to give each user 100 points to di…

I like this, especially because it means votes become more valuable.

Consider, too, that the system is self-referential. You could use the system to debate the relative merits of vote and comment limits, for example.

Re: Lavabit SSL Cert Revoked

#104

Post by shmerl »

interstitial wrote: post #102
sixothree wrote: post #91

Earlier quoted context omitted.

I'm hoping driverless cars begin to make people realize how intrusive these types of stops really are.

When it comes to public safety, the American people stand ready for intrusions of all kinds, it is truly for our own good. Government agents are privy to secret information unknown to the public, therefore we have no choice but to submit.

That's an excuse which can be abused for anything up to making a police state. It's all about how far is acceptable. Surely not "all kinds".

Re: Lavabit SSL Cert Revoked

#105

Post by gcb1 »

brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

something even more important... they do not tap email. or they are stuborn as hell and took that personally.

think about it... what does it even matter that lavabit exists?!? email is plain text. they already have ATT and verizon in their bed. they could tap that plain text anywhere.

unless all the parties ever only used decent MX i think...

Re: Lavabit SSL Cert Revoked

#106

Post by n09n »

joe_the_user wrote: post #98
brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

Well, we knew the US government didn't mind seizing whatever under some circumstances. What we know specifically now is that the government is inclined to "err" on the side of taking everything to the point that it would take your private SSL keys if it happen to get a warrant for your shopping list. The state has generally arrogated itself similar powers in physical searches so the news is that it just gets worse wi…

That doesn't seem like the right interpretation. They asked for this because Lavabit was unable, or possibly unwilling, to turn over Snowden's records, and impersonating Lavabit the next time he tried to check his email would have been the only way to get that info.

So yes, if your shopping list can't be recovered without your private SSL keys, they will take those when they have a warrant for your shopping list.

Re: Lavabit SSL Cert Revoked

#107

Post by gcb1 »

mpyne wrote: post #43
miketucker wrote: post #6

Earlier quoted context omitted.

Today the owner, Ladar Levison, had to hand over the SSL certificates by court order. It marks the ending of a long battle in court, with unfortunately it ending in the govenment's favor. I'm assuming the post is just a hacker way of acknowledging the event. Related article: http://www.newyorker.com/online/blogs/elements/2013/10/how-l...

Interesting link, and much more informative than the other Lavabit news articles. It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. The judge is correct in stating that if Levison…

no. no. no. the judge's trust talk was a falacy time waster.

- give me your bank password so i can get the $5 you own me.

- why dont i give you a check for $5?

- so i have to trust your check is good but you cant trust me with your bank password?

see? it is just crazy talk to push him around. the judge knows here his/her obedience rests. he is not even listening to the defense.

Re: Lavabit SSL Cert Revoked

#108

Post by gregw134 »

thangalin wrote: post #103
gregw134 wrote: post #99

Earlier quoted context omitted.

I love the idea, but I don't think people should be allowed to have unlimited up or down votes. That would encourage whimsical opinions, and would make the site reflect the opinions of the most active and opinionated users instead of the average person. I think there needs to be a way to limit the voice of each user so each person has the same amount of influence. One idea I like is to give each user 100 points to di…

I like this, especially because it means votes become more valuable. Consider, too, that the system is self-referential. You could use the system to debate the relative merits of vote and comment limits, for example.

I agree that there might be some issues with comment limits--you don't want to limit discussion too much.

On a different topic, why do you think this system should be anonymous? You can't limit votes unless you can authenticate someone's identity, and the best way to prove that users are real is to show who each user is.

Re: Lavabit SSL Cert Revoked

#109

Post by takluyver »

rayiner wrote: post #93
l33tbro wrote: post #37

I'm so sick of being sickened. I hate that this is becoming the norm and we can't do anything about it. I hate to spit cliches, but is this where my tax dollars go? For me, govt and internet should almost be like church and state. Where is the data around foiled terrorist plots? I just can't stomach the obtuse logic that we need to pay our taxes to employ these virtual minders. This is not what the internet is about.…

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

> Nobody complains that they can [force?] Public Storage to open storage units with a warrant

If they can get a warrant from a court under fair laws, personally I don't mind the government having equivalent powers in the online world. There are people doing bad things online, and I want there to be mechanisms to minimise that.

I don't know the specifics of the Lavabit case, but from the NSA revelations, it seems like the controls and oversight are much weaker in the online world than in the physical one.

Re: Lavabit SSL Cert Revoked

#110

Post by anologwintermut »

gcb1 wrote: post #105
brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

something even more important... they do not tap email. or they are stuborn as hell and took that personally. think about it... what does it even matter that lavabit exists?!? email is plain text. they already have ATT and verizon in their bed. they could tap that plain text anywhere. unless all the parties ever only used decent MX i think...

The original order wasn't for SSL keys or even Snowden's emails, it was for the envelope information and the IPs he was connecting from (see page 4 of http://cryptome.org/2013/10/lavabit-orders.pdf)

They wanted data on where Snowden was and who he was communicating with. Snowden uses PGP on top of Lavabit and presummably connecting to Lavabit securely. So at least to get his IP address, they needed Lavabit's cooperation or, baring that, the SSL keys.

It's a heavey handed approach, but not irrational.

Post reply on HN