Earlier quoted context omitted.
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
> They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316
CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
31–40 of 86 posts
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#32"or spend £500,000 building a backdoor into the system" A nice round number... They had good motive to protect their customers and close the service. Why start talking about this kind of ridiculous development costs, that sound like it got pulled out of the air? At least I'd be more sympathetic, if they sticked to the facts. I could even support their cause by posting and tweeting that this is terrible. Now I just fe…
" This is Brian, the CEO. Yea, it was a nice round number out of the air. But it probably wasn't far off the mark.
For all the other comments, below is a blog post on the matter which is going to go live shortly:
With the story about our PrivateSky takedown now public, I want to take the opportunity to clarify a few points in various articles that have appeared since yesterday covering the story.
The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash. In fact, the headline contradicts the article, which becomes clear as you read it.
Secondly, a very important point wasn’t printed. GCHQ couldn’t, by law, request a blanket back door on the system. There are a very rigid set of controls that mean only specific individuals can come under surveillance. The legal request for such surveillance has a due process that must be stridently followed. At no time did I or anyone at CertiVox talk about CertiVox in relation to any RIPA warrant, only the generic process by which these warrants are served.
By saying “our friends at GCHQ”, there is no facetiousness intended. The team at CertiVox have the upmost respect for the folks we interacted with at GCHQ. They took the due process I outlined in the previous point very seriously. We found that as an organisation, and every individual involved there, were as worried about a breach of public trust as much as we are.
Finally, I believe very strongly the following should be a larger part of the public discourse of these subjects. What everyone needs to understand is that every developed democracy in the world, even where privacy rights are enshrined to the maximum efficacy by statute, has laws on the books that mandate that Internet Service Providers have facilities to work with law enforcement for the purposes of legal intercept, to enforce public safety and security.
Being L.I. capable is a very important set features and functions that must be in place for any credible, commercial service on the Internet. In endeavouring to make PrivateSky as secure as possible, we overlooked this critical requirement when we built PrivateSky.
When CertiVox positioned PrivateSky as the easiest to use and most secure encrypted messaging service, we really had two significant points of differentiation. First, even though we held the root encryption keys to the system, it was architected in such as way that it would have been all but impossible for our internal staff to snoop on our customer’s communications, or for the service to leak any of our customer’s data. Secondly, our possession of the root keys, and our use of identity based encryption, made the system incredibly easy to use. For the user, there were no private or public keys to manage, every workflow was handled for the user in an easy to grasp pure HTML5 interface, no hardware or software required, just an HTML5 browser.
We boxed ourselves into a feature set and market position that when called upon to comply with legal statues, we simply had no alternative but to shut the service down. We built it, but we couldn’t host it.
Why? Because as you can probably surmise, there is an inherent impedance mismatch between being able to host a commercial communications service that gives the upmost in privacy to its users, against any breach, whilst at the same time being able to operate safely within the confines of the law as it is on the books in most countries on the planet.
Is this wrong? Actually, I don’t think it is. This may be an unpopular viewpoint, but I cannot argue against having a well regulated legal intercept function as being necessary to have in place for a society that prizes law and order and the safety of its citizens. This is speaking as someone who lived in NYC during 9/11.
In summary, it’s the abuse of the communications interception in the Snowden revelations that has everyone up in arms, as so it should. But that’s not what happened with PrivateSky.
What is our next move?
Watch this space.
-----"
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#33Earlier quoted context omitted.
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
> They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#34Earlier quoted context omitted.
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
> They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316
Your interpretation is extremely naïve. I could hold a gun to your head, for example. You wouldn't be forced per se to meet my demands, but you probably would because it would be extremely unreasonable not to. In the same way, the consequences for not complying are: an extremely expensive and possibly unaffordable rewrite, going to jail for a few years, or giving up their customers data in violation of their principles. The GHCQ order effectively put a gun to their head.
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#35Earlier quoted context omitted.
I don't know anything about the implementation, but I would assume that the idea is to avoid having the service provider be a single point where complete failure can occur. Perhaps this new system offloads that risk to the customer. But then I get confused, what service is the service provider providing if the customer still needs to carry around half of 'the data'?
Splitting it in two does not mean splitting it in half.
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#36Earlier quoted context omitted.
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
> They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316
Are you PG? No? Then who are you to decide when a discussion ends round here?
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#37There are some details of the legislation in question here[1]. It allows the UK to monitor "in the interests of the economic well-being of the United Kingdom" which seems a little broad! It would be interesting to know if this warrant targeted all users or a specific subset? I wonder how they decide whether to issue a warrant or just break into the site in question. A warrant could imply that they are unable to attac…
A warrant might mean that they do not ever illegally hack sites, and that they only ever obey the law.
RIPA is problematic law, and it's nice to see discussion of RIPA cases involving GCHQ.
Not avoiding the problems of RIPA and GCHQ (I certainly think it needs better oversight and I'd prefer better law) RIPA has been abused quite a lot by many other organisations for stuff that US readers may find really awful.
Local education authorities spy on parents to ensure they're actually in the catchment area of a school that they want to send children to, for example. Or councils spy on people applying for parking permits to make sure those people live in that area, and aren't just selling the permits on. Having that activity regulated is important, but RIPA is less regulation and more encouragment.
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#38I like the idea obfuscating the location of the containers of the data as well as the content.
Shred, encrypt, disperse. You send a token to the recipient and they are able to use that to build location requests for the containers. Once they have the parts, they can assemble and decrypt.
So, in which country can this be developed?
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#39"or spend £500,000 building a backdoor into the system" A nice round number... They had good motive to protect their customers and close the service. Why start talking about this kind of ridiculous development costs, that sound like it got pulled out of the air? At least I'd be more sympathetic, if they sticked to the facts. I could even support their cause by posting and tweeting that this is terrible. Now I just fe…
Re: CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant
#40So, just like Lavabit as 'moxie keeps pointing out[1][2], it wasn't actually secure. Still, I like the principled stand they took.