Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

151–160 of 321 posts

Re: Lavabit SSL Cert Revoked

#151

Post by MustBeAShill »

benregenspan wrote: post #148
n09n wrote: post #106

Earlier quoted context omitted.

That doesn't seem like the right interpretation. They asked for this because Lavabit was unable, or possibly unwilling, to turn over Snowden's records, and impersonating Lavabit the next time he tried to check his email would have been the only way to get that info. So yes, if your shopping list can't be recovered without your private SSL keys, they will take those when they have a warrant for your shopping list.

According to the New Yorker piece on Lavabit yesterday ( http://www.newyorker.com/online/blogs/elements/2013/10/how-l... ), the owner was willing to add code tailored to tracing only Snowden's (or whoever it belonged to) account. The FBI turned him down and demanded the less surgical option.

...and a solution that would fail to preserve the chain of evidence. If there's a black box at any point, e.g. Levison produces information and emails it to the investigating officers, the doctrine of "fruit of the poisoned tree" applies.

Re: Lavabit SSL Cert Revoked

#152

Post by MustBeAShill »

guelo wrote: post #145
rayiner wrote: post #93

Earlier quoted context omitted.

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

The reason you are wrong is that you ignore the dragnet aspect. In meat space people would not accept their snail mail being read without probable cause. Recent polls show that people are more concerned about the spying than terrorism.

Do you mean like how the U.S. Postal service has been recording senders and recipients for decades? It's not a good analogy.

Re: Lavabit SSL Cert Revoked

#153

Post by jasonlotito »

kelnos wrote: post #149
abalone wrote: post #147

Earlier quoted context omitted.

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals. Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive. But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the acc…

I disagree with the premise. I don't believe that a service should be required by law to provide the possibility for the government to intercept the activity of its users. You can always say "but the child pornographers!" or, "but the terrorists!"... but... no, sorry. I believe that people should have the ability to engage in total privacy. The fact that the US gov't is doing this because of Snowden (a person I admir…

> I believe that people should have the ability to engage total privacy.

They already have the ability to do this.

That's not what you are asking for. What you are really asking for is:

"I believe that people should have the ability to engage total privacy through any means of communication they so choose."

Re: Lavabit SSL Cert Revoked

#154

Post by tedks »

aianus wrote: post #129
orblivion wrote: post #126

Earlier quoted context omitted.

Explain to me how a PGP web-of-trust can be MITM'd? Presumably you exchange keys in person?

The govt coerces somebody you trust (either directly or through the web of trust) to hand over their private keys and then begins impersonating them.

Crypto is no substitute for tradecraft.

Re: Lavabit SSL Cert Revoked

#155

Post by MustBeAShill »

joe_the_user wrote: post #96
mpyne wrote: post #43

Earlier quoted context omitted.

Interesting link, and much more informative than the other Lavabit news articles. It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. The judge is correct in stating that if Levison…

" It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. " No - it is a plan that the government doesn't work with service provider and instead demands data and intercepts that "just ha…

> No - it is a plan that the government doesn't work with service provider and instead demands data and intercepts that "just happen" to let them spy on an entire network.

It's interesting that you attack the FBI when you hear them make an unsubstantiated claim, but you have no problem repeating claims you heard on internet forums. When you make claims like this with certainty, it weakens your position and reveals that you don't know what you're talking about.

Re: Lavabit SSL Cert Revoked

#156

Post by MustBeAShill »

lettergram wrote: post #83

I've read quite a few complaints about the government on this post. My suggestion is to simply do something. You have (a) the ability to vote, so stop voting in Republicans OR Democrats (both equally as bad) OR even run yourselves. (b) send a letter to your representative, they occasionally will read the mail, plus you at least can vent your frustration at someone who CAN do something.

Or run for office yourself. I would vote for a centrist candidate that offered a bill that declared email as sacrosanct as a telephone call or postal mail.

Re: Lavabit SSL Cert Revoked

#157

Post by MustBeAShill »

shmerl wrote: post #16
powertower wrote: post #12

Can this be classified as - http://en.wikipedia.org/wiki/Obstruction_of_justice ? That is, I'm sure he understands that this action might be interfering with an investigation, and that it's reasonable to believe it was a willful act on his part. Can you get into trouble for doing something like this?

When did unconstitutional massive surveillance become justice?

What does massive surveillance have to do with the Lavabit action?

Re: Lavabit SSL Cert Revoked

#158

Post by abalone »

kelnos wrote: post #149
abalone wrote: post #147

Earlier quoted context omitted.

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals. Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive. But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the acc…

I disagree with the premise. I don't believe that a service should be required by law to provide the possibility for the government to intercept the activity of its users. You can always say "but the child pornographers!" or, "but the terrorists!"... but... no, sorry. I believe that people should have the ability to engage in total privacy. The fact that the US gov't is doing this because of Snowden (a person I admir…

Your argument against the ability to wiretap child pornographers and terrorists is "no, sorry".

That's not a very complete argument.

Re: Lavabit SSL Cert Revoked

#159

Post by plorg »

gcb1 wrote: post #107
mpyne wrote: post #43

Earlier quoted context omitted.

Interesting link, and much more informative than the other Lavabit news articles. It's a shame the government didn't work with Levison to either allow Levison to add the requested intercept himself (which, yes, would have required Uncle Sam to trust him) or to allow a third-party (or even a third party requested from both sides) to audit the proposed interception code. The judge is correct in stating that if Levison…

no. no. no. the judge's trust talk was a falacy time waster. - give me your bank password so i can get the $5 you own me. - why dont i give you a check for $5? - so i have to trust your check is good but you cant trust me with your bank password? see? it is just crazy talk to push him around. the judge knows here his/her obedience rests. he is not even listening to the defense.

What if it was more like

- You owe me $25

- I only keep my money in bitcoin

- Well, I don't do that bitcoin thing, and I don't really want to set a whole thing just to transfer the money

- OK, I could get it for you in cash, but you'll have to give me a few days

...a few days later

- Uhh...so about that money

- Oh, haven't gotten around to transferring that

- OK, but I could use it. Or, I could borrow your phone and talk to Steve: he'll trade me cash for bitcoin.

- But then you could take all of my bitcoins.

- I'm not going to do that

- But I can't trust you

- Then why should I trust you to pay me?

Re: Lavabit SSL Cert Revoked

#160

Post by MustBeAShill »

huslage wrote: post #118

This is not new people! We've known for many years that MiTM was "normal" in surveillance circles. We've been saying for years that CAs are probably compromised as well. Why does it take some "revelation" to make people PAY ATTENTION? This is not a technical issue. It's a rights issue. Solving it by technical means only kicks the can down the road by an exceedingly small amount of time. Fix the system first.

Isn't the fact the cert was revoked showing that the CA system works? The FBI would love for it to be still chained back to a valid CA.

You were only seconds away from calling folks "sheeple", weren't you ;)

Post reply on HN