Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

141–150 of 321 posts

Re: Lavabit SSL Cert Revoked

#141

Post by trippy_biscuits »

takluyver wrote: post #109
rayiner wrote: post #93

Earlier quoted context omitted.

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

> Nobody complains that they can [force?] Public Storage to open storage units with a warrant If they can get a warrant from a court under fair laws, personally I don't mind the government having equivalent powers in the online world. There are people doing bad things online, and I want there to be mechanisms to minimise that. I don't know the specifics of the Lavabit case, but from the NSA revelations, it seems like…

How do you defend yourself against a rogue government? Furthermore, who gets to define when a government becomes rogue? All definitions aside, how do you defend yourself from a large, well-funded organization that's determined to do what ever it wants to you? Fair laws? The fact that someone else decides what's right and wrong means we've already lost.

Re: Lavabit SSL Cert Revoked

#142

Post by trippy_biscuits »

thangalin wrote: post #51
l33tbro wrote: post #37

I'm so sick of being sickened. I hate that this is becoming the norm and we can't do anything about it. I hate to spit cliches, but is this where my tax dollars go? For me, govt and internet should almost be like church and state. Where is the data around foiled terrorist plots? I just can't stomach the obtuse logic that we need to pay our taxes to employ these virtual minders. This is not what the internet is about.…

I have mocked-up a system for policy creation. The project is open; please contribute your thoughts. People say "it has flaws" but never explain the flaws, nor how to address them. https://bitbucket.org/djarvis/world-politics/ Would greatly appreciate constructive criticism. The system serves to educate everyone (openly and transparently) on implications of existing and upcoming policies. If the idea intrigues you, c…

I like the idea of self-government and I'd like to extend the concept a bit further. We should be seeking to self-govern in such a way that the government is not necessary.

Re: Lavabit SSL Cert Revoked

#143

Post by zmmmmm »

So I wonder, if he has been banned from revealing that he has handed over the key, does revoking it count as such a revelation?

At this point, the authorities have Streisand'ed their own case - anybody they were interested in would have stopped using Lavabit months ago. So they seem to be pursuing it out of pure belligerence at this point.

Re: Lavabit SSL Cert Revoked

#144

Post by thangalin »

gregw134 wrote: post #127
thangalin wrote: post #122

Earlier quoted context omitted.

Corruption is only possible when you know who to bribe. By making the system completely anonymous, bribery becomes extraordinarily difficult, if not impossible. Further, all ideas should receive equal consideration. Attaching names allows for group-think and bribery. (Imagine if Neil deGrasse Tyson posted a policy, or Neil Patrick Harris, or Neil Young.) Ideas must stand on their own merit, not on the reputation or w…

I'm not sure I understand your point about bribery. Are you talking about bribing groups of people to vote a particular way, or about bribing coercing powerful individuals not to express their opinions? I disagree in practice that all ideas should have equal consideration. If an economist or other professional has a proposal, I think its practical to recognize that that person has extra credibility on a topic, and I…

You have some interesting ideas, and it would be rather helpful if you would add them to the wiki.

Your question poses an interesting problem. How do you give accreditation while still retaining anonymity? At some point you have to associate an account with a person.

I think optional anonymity would allow corruption into the system. (Televangelists, for example, would opt-out from anonymity so that their proposals might pass through randomized moderation by votes from their fan base.)

Much of this is putting the cart before the horse, though, as the system is probably best tested, at first, with politicians. See also: http://openparliament.ca/

Re: Lavabit SSL Cert Revoked

#145

Post by guelo »

rayiner wrote: post #93
l33tbro wrote: post #37

I'm so sick of being sickened. I hate that this is becoming the norm and we can't do anything about it. I hate to spit cliches, but is this where my tax dollars go? For me, govt and internet should almost be like church and state. Where is the data around foiled terrorist plots? I just can't stomach the obtuse logic that we need to pay our taxes to employ these virtual minders. This is not what the internet is about.…

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

The reason you are wrong is that you ignore the dragnet aspect. In meat space people would not accept their snail mail being read without probable cause. Recent polls show that people are more concerned about the spying than terrorism.

Re: Lavabit SSL Cert Revoked

#146

Post by rayiner »

AJ007 wrote: post #114
rayiner wrote: post #93

Earlier quoted context omitted.

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

As long as the engineers who design and build the internet care, we can do ok. If the protocols that run the web are so easily compromised, it raises all kinds of problems with the underlying, somewhat invisible, functions to how the world works. That manifests itself as a liability to for-profit corporations. It also is something that the cat pictures people care about -- how many of them want their webcams capturin…

> As long as the engineers who design and build the internet care, we can do ok.

If the engineers who designed and built the internet cared about privacy, internet protocols wouldn't completely ignore privacy. They designed a massive routed network that involves packet forwarding between random untrusted nodes and then built a bunch of plain-text protocols on top (SMTP, HTTP, etc).

> how many of them want their webcams capturing video of them walking around their rooms naked or wake up one morning and notice their brokerage account is empty?

Probably none, but the government wouldn't do that. That's not how abuse of power works in liberal democracies. Targeting the majority is a voter-loser. You have to target minorities: hacktivists, terrorists, etc.

> It is quite an irony that governments demand one set of standards for privacy and security while attempting to compromise them for their own benefit

Nothing ironic about it. The whole premise of liberal democracy is that government needs to exist as an entity with powers superior to those of individuals, but as a check on that power must be subject to majoritarian control. You don't have to agree with that premise, but it's consistent with different standards of privacy for individuals and the government.

Re: Lavabit SSL Cert Revoked

#147

Post by abalone »

brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals.

Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive.

But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the account holder to access their email. This is obviously why Snowden used the service. Duh. And this is why the government resorted to threatening to seize the keys and trying to impersonate the service.

What actually happened is, in the court proceedings Lavabit responded to this by offering to make modifications to the service to essentially wiretap an individual account without handing over the keys. Thus confirming the problem the government faced. But by this point the government didn't trust him to act as a spy on their behalf (which frankly is not an unreasonable assumption).

To be absolutely clear, I am taking no position on the justness of the government's targeting of Snowden. Personally I think he's a hero.

But surely we can all agree there exist circumstances under which some lawful intercepts are justified: child pornographers, terrorists actively planning murders, missing persons, etc.

The problem is Lavabit was not designed to facilitate intercepts under any circumstances. That is why the keys were seized.

Source: http://www.newyorker.com/online/blogs/elements/2013/10/how-l...

Re: Lavabit SSL Cert Revoked

#148

Post by benregenspan »

n09n wrote: post #106
joe_the_user wrote: post #98

Earlier quoted context omitted.

Well, we knew the US government didn't mind seizing whatever under some circumstances. What we know specifically now is that the government is inclined to "err" on the side of taking everything to the point that it would take your private SSL keys if it happen to get a warrant for your shopping list. The state has generally arrogated itself similar powers in physical searches so the news is that it just gets worse wi…

That doesn't seem like the right interpretation. They asked for this because Lavabit was unable, or possibly unwilling, to turn over Snowden's records, and impersonating Lavabit the next time he tried to check his email would have been the only way to get that info. So yes, if your shopping list can't be recovered without your private SSL keys, they will take those when they have a warrant for your shopping list.

According to the New Yorker piece on Lavabit yesterday (http://www.newyorker.com/online/blogs/elements/2013/10/how-l...), the owner was willing to add code tailored to tracing only Snowden's (or whoever it belonged to) account. The FBI turned him down and demanded the less surgical option.

Re: Lavabit SSL Cert Revoked

#149

Post by kelnos »

abalone wrote: post #147
brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals. Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive. But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the acc…

I disagree with the premise. I don't believe that a service should be required by law to provide the possibility for the government to intercept the activity of its users.

You can always say "but the child pornographers!" or, "but the terrorists!"... but... no, sorry. I believe that people should have the ability to engage in total privacy. The fact that the US gov't is doing this because of Snowden (a person I admire) just reinforces my belief.

Re: Lavabit SSL Cert Revoked

#150

Post by wbl »

benregenspan wrote: post #148
n09n wrote: post #106

Earlier quoted context omitted.

That doesn't seem like the right interpretation. They asked for this because Lavabit was unable, or possibly unwilling, to turn over Snowden's records, and impersonating Lavabit the next time he tried to check his email would have been the only way to get that info. So yes, if your shopping list can't be recovered without your private SSL keys, they will take those when they have a warrant for your shopping list.

According to the New Yorker piece on Lavabit yesterday ( http://www.newyorker.com/online/blogs/elements/2013/10/how-l... ), the owner was willing to add code tailored to tracing only Snowden's (or whoever it belonged to) account. The FBI turned him down and demanded the less surgical option.

Only after he refused to do it initially. Read the case file: it's not hard and has a lot of detail reporters miss.
Post reply on HN