Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lavabit SSL Cert Revoked

lavabit.com

Post reply on HN
Print view View original

231–240 of 321 posts

Re: Lavabit SSL Cert Revoked

#231

Post by bigiain »

rtpg wrote: post #208
kelnos wrote: post #149

Earlier quoted context omitted.

I disagree with the premise. I don't believe that a service should be required by law to provide the possibility for the government to intercept the activity of its users. You can always say "but the child pornographers!" or, "but the terrorists!"... but... no, sorry. I believe that people should have the ability to engage in total privacy. The fact that the US gov't is doing this because of Snowden (a person I admir…

So you don't think law enforcement should be able to do its job? If we lived in total privacy, and I were to start a ponzi scheme completely online, then I would not be able to be stopped because : 1. My e-mail wouldn't be looked at 2. My bank accounts couldn't be looked at Almost all evidence gathering during criminal investigation involves a loss of privacy at one point

I don't for a minute agree that law enforcement's operational problems trump every other right citizens have.

I find it _astounding_ that people are supporting the idea of forcing Levinson to back down on the guarantee of privacy he'd made to his _other_, not under any probable cause level of suspicion, 400,000 fully-entitled-to-the-privacy-they've-chosen-to-pay-for customers. Violating the privacy of four hundred THOUSAND unrelated-to-the-investigation users? Users who had an expectation of privacy, who were buying a service from a company marketing themselves on providing privacy. Then attempting to coerce that company's founder into not only failing to provide the service his customers were paying him for - but also denying him the right to let them know.

All because _one_ customer has monumentally embarrassed a particularly powerful government department.

Is that _seriously_ "OK" in anybodies worldview?

Re: Lavabit SSL Cert Revoked

#232

Post by darkarmani »

abalone wrote: post #147
brian_cloutier wrote: post #63

Lavabit has revealed something incredibly important. The US Government has no problem with seizing your private keys . It claims the right to impersonate you without your permission. It no longer matters which system you use, Sovereign Keys, PGP web-of-trust, traditional PKI, they're all the same. Services based in the US can be MITM'd without leaving any traces. If this is allowed to continue uncontested there will…

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals. Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive. But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the acc…

> But by this point the government didn't trust him to act as a spy on their behalf (which frankly is not an unreasonable assumption).

I don't understand this conclusion. He cooperated with legal investigations before, he just needed time and resources to implement what they were asking for.

Re: Lavabit SSL Cert Revoked

#233

Post by malandrew »

The lavabit case highlights something interesting that we need. We need that not only individuals have privacy, but that businesses have privacy of who their users are. The same way we provide anonymity to users through centralized means, is there not a way to provide a way for service provider to have a sufficient level of opaqueness of who their customers are. You can't subpeona Service Provider A if you don't know whether Person of Interest X is using the services of A, B, C, or D, etc.

Re: Lavabit SSL Cert Revoked

#234

Post by spin »

rayiner wrote: post #93
l33tbro wrote: post #37

I'm so sick of being sickened. I hate that this is becoming the norm and we can't do anything about it. I hate to spit cliches, but is this where my tax dollars go? For me, govt and internet should almost be like church and state. Where is the data around foiled terrorist plots? I just can't stomach the obtuse logic that we need to pay our taxes to employ these virtual minders. This is not what the internet is about.…

The basic problem is an impedance mismatch. Some people see the internet as this noble grand thing (like you, comparing it to the church). The government, like most voters, sees it as just a place to look at cat pictures and buy crap on zappos. The government treats the internet like it treats meat space things. Nobody complains that they can Public Storage to open storage units with a warrant, so why should the inte…

Getting a warrant to search one person's inbox seems pretty reasonable to me. (Seems pretty analogous to searching one person's rented storage space.)

Forcing Lavabit to hand over everything seems like searching all storage lockers, even for people who are suspected of nothing. That's way over the line for me.

Re: Lavabit SSL Cert Revoked

#235

Post by mizchief »

abalone wrote: post #176
mburns wrote: post #167

Earlier quoted context omitted.

His argument is clearly that people have a right to privacy. It says so in his next sentence. The 'no, sorry' is him discarding the emotional plea that often justifies invading a person's privacy in the first place ("please, won't somebody think of the children!").

Well, what about the children? Serious question. I say it's an incomplete argument because there is no mention of how we should go about prosecuting child pornographers and terrorists, rescuing missing persons when phone/email records are our only clue, and so on. There's just "no, sorry", the right to privacy trumps these things under all possible circumstances. The question remains.. why? Why is a world with ideall…

If you want to stop child porn, maybe you should go after the source instead of the consumers? Even if you did stop the spread of the digital pornography you still have all the molesters and other physical abusers out there. Maybe we should expend resources on actual cops patrolling neighborhoods and keeping pedophiles in jail instead of releasing them and confining them into "safe" zones. That is if you really want to protect kids, and not hunt down perverts on the internet.

Re: Lavabit SSL Cert Revoked

#236

Post by darkarmani »

jasonlotito wrote: post #209
smokeyj wrote: post #201

Earlier quoted context omitted.

Does asking for a site's private SSL key sound like a reasonable search? I realize "reasonable" is entirely subjective, which is why I don't put much faith in out justice system.

> Does asking for a site's private SSL key sound like a reasonable search? Considering that was far from the first thing they asked for, no. Were their goals reasonable? Yes. Was Levison trying to cooperate? No.

> Was Levison trying to cooperate? No.

You sound astounded that someone on the receiving side of legal action is trying not to cooperate. Next you'll be stating that him hiring a lawyer is proof of non-cooperation and evidence of guilt.

If you got to do overbroad things every time a defendant was "non-cooperative" it would apply to every single court case.

Re: Lavabit SSL Cert Revoked

#237

Post by mburns »

abalone wrote: post #220
mburns wrote: post #190

Earlier quoted context omitted.

We should prosecute crimes the way we always have: presumed innocence until proven otherwise with evidence. A right to be able to communicate privately doesn't make Plain Old Telephone calls not be easily traced, or make the police useless. How about this example, to clarify the issue: However pedophiles (or terrorists) get their content, be it a darknet site or the sneakernet, under the 5th amendment a person can re…

> presumed innocence until proven otherwise with evidence. That's exactly the problem. Lawful surveillance is one of the most fundamental means of gathering evidence. If you take away that, then in a lot of cases you take away the ability to prove guilt. You offer no support for the claim that police would be useful in a world where all telecommunications are impenetrably encrypted with no means for lawful intercept.…

Yes, in this case, it was the Lavabit service. But tools to allow for private communication already exist, and in those cases, the 5th amendment protects the parties involved, with no service provider able to provide the police useful data. The more the government abuses its surveillance abilities with massive collections, the more pressure will exist for criminal enterprises to turn their attention to the likes of Freenet, that are inherently difficult to surveil, even when working with the physical ISPs.

So, you ask, how do police investigations compensate when the criminals they're after increasingly use anonymous, private, secure, distribute means of communication?

Aside from the standard drug detection at borders or traffic stops, money tracking, physical surveillance, informants, undercover work, district attorneys giving deals to catch bigger bad guys, or other, you know, physical police work that doesn't include being told who, when and where the deal is going to take place, I'm not sure how Police will be able to function.

But I'm sure they won't be useless.

Re: Lavabit SSL Cert Revoked

#238

Post by abalone »

PhasmaFelis wrote: post #224
abalone wrote: post #147

Earlier quoted context omitted.

Ok, let's keep this in perspective. The problem here is Lavabit was specifically designed to disallow lawful intercepts of individuals. Targeting individuals is absolutely the right way to go about a lawful intercept. Sucking up all traffic like the NSA has been doing is totally overbroad and invasive. But the whole point of the asymmetric encryption feature of Lavabit was to make it impossible for anyone but the acc…

> But surely we can all agree there exist circumstances under which some lawful intercepts are justified: child pornographers, terrorists actively planning murders, missing persons, etc. The problem is Lavabit was not designed to facilitate intercepts under any circumstances. That's not true, though. Levison could and did help the government with intercepts before, and offered to provide the same service again; this…

Well, it actually is true that the asymmetric encryption feature of the premium Lavabit service is designed to make intercepts impossible. Only the account holder can decrypt it.

Handing over account payment information in response to lawful requests is quite a different matter from defeating asymmetric encryption. Account info is unencrypted records that Lavabit has access to in accordance with their TOS. They can turn those over, in accordance to their TOS.

Faking out their own service to defeat their own encryption, which they specifically advertised as being only decryptable by the account holder and not Lavabit, is a whole different ballgame.

I noted exactly what you stated, that Lavabit offered to help the government implement something like that -- only after being threatened with the "nuclear option" of key seizure.

You've got to concede that there's room for some doubt as to whether Lavabit could be trusted to comply with something as extraordinary as that. It would be trusting them to reneg on a specific promise made to all customers about the security of their service, namely that it is impossible for Lavabit to snoop on encrypted communications.

Re: Lavabit SSL Cert Revoked

#239

Post by icambron »

jlgreco wrote: post #199
polarix wrote: post #191

Earlier quoted context omitted.

That's a perfectly reasonable question, actually. One possible answer is that communicating on the internet requires the use of a physical commons, which one could reasonably argue carries either innate restrictions or restrictions legitimately imposed by the owners of said infrastructure.

That is a reasonable response. I would counter by saying that I see that as a justification for why they [government, ISP, whoever] should be allowed make demands about the use of the physical commons, but isn't a reason why they should exercise this conceded right. For example: I, a hypothetical bar owner, have a right to ban silly hats in my bar. Why? Because I own it. However that's not a reason that I should ban…

It's that last point that's so strong:

"Yes, yes, you have the right not be subjected to unreasonable search and seizure, but not if you're walking on the public sidewalk."

The key here is that the government is not like a private land owner. That's why government workers have so much leeway in criticizing their employers, and why you're allowed to protest on government land, and why schools can't have daily prayers even though they want to. The government simply isn't a private actor enforcing rules over the stuff it owns; we own the commons, and the government simply administers them according to some strict rules. Unlike a private land owner, it can't say, "if you don't like the way I do things, take your business elsewhere." Otherwise you get "You can vote for whomever you want, but since we own all these voting booths, you can only use them to vote for the incumbent."

If the government can pursue any arbitrary policy just by virtue of "owning" some infrastructure, the whole constitutional democracy thing gets circumvented.

Edit: changed "to privacy" to "not to be subjected to unreasonable search and seizure" to avoid confusion.

Re: Lavabit SSL Cert Revoked

#240

Post by jlgreco »

jasonlotito wrote: post #217
jlgreco wrote: post #204

Earlier quoted context omitted.

You could have just answered "I don't think that." Or, you know, given me the exact response you just typed.... It really was not my intention to ask you a loaded question. Instead of calling my question childish, you should consider the possibility that your comment is not nearly as clear as you seem to think.

I explained exactly why wasn't going to answer your question in my response. "That's a loaded question and I'm not going to play that game" I picked the words carefully and precisely. http://en.wikipedia.org/wiki/Loaded_question > you should consider the possibility that your comment is not nearly as clear as you seem to think. I realize that people might not be native english speakers. I make the assumption people w…

I am sensing a lot of continued hostility here. I am not sure why, since we apparently do not disagree, and since I have made it clear that I did not have any malicious intent.

> I make the assumption people will ask if they are unsure or not clear.

You have misunderstood me. I did not find your comment to be unclear after reading it. However my take-away from your comment was incorrect.

Complaining about a loaded question, instead of simply and civilly correcting me ("I don't think that"), came off very strongly as a dodge. Or, as kordless describes, "conversation killer".

I hope this clears up any lingering confusion.

Post reply on HN