Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Exactly Did The US Government Ask Lavabit to Do?

xato.net

Post reply on HN
Print view View original

41–46 of 46 posts

Re: What Exactly Did The US Government Ask Lavabit to Do?

#41

Post by tedunangst »

bigiain wrote: post #38
zokier wrote: post #21

Earlier quoted context omitted.

> That is almost always in clear text, as most of this infrastructure was designed 30 years ago and hasn't evolved much since then Email has definitely evolved since it's inception. STARTTLS (RFC3207) is the relevant standard here.

I don't suppose anyone has any stats (or even educated guesses) about how many mail servers you'd not be able to connect/send to if you enforced TLS connections from your outgoing SMTP server (as in, refused to send data to servers that didn't respond appropriately to a STARTTLS command)?

Having run a mail server that used to have a self-signed cert and that now doesn't offer starttls at all, I can tell you I experienced zero failed deliveries (well, nobody has ever complained, and I still get all the mail I expect to get). Maybe incoming mail will use starttls if available, but if it's not (mitm, fake mx record, etc.) the remote server isn't going to stop. It just delivers in plaintext.

I mean, it's trival to see this is true. Open up your mail server's configuration file. Where's the line that specifies trusted root CAs for relaying to remote servers? Oh, there isn't one? So how does it verify the chain of trust?

(I realize I didn't quite address your question. Solid answer: at least one. But I'm fairly confident the number of server configured as you suggest is extremely close to zero.)

Re: What Exactly Did The US Government Ask Lavabit to Do?

#42

Post by dangero »

Hypothetical question:

What if the founder of Lavabit took the documents that the US government sent him and gagged him with and put them somewhere where they could be stolen or illegally accessed? For example, what if he put them on a computer with a public facing ip address, or even left them on his desk in his office? If he could have plausible deniability couldn't they get stolen and leaked without him really getting in trouble?

This may seem like a stretch, but when you consider the government is using secret interpretations of laws how is it any different than what they are doing?

Re: What Exactly Did The US Government Ask Lavabit to Do?

#44

Post by nwh »

justanother wrote: post #43

Kickstarter idea: $xxx,xxx for the network operator who sniffs network traffic that discloses the basis for the Secret TSA ID law. Goose, gander, etc. I'd happily kick in 1%.

Accepting the money would be a death sentence, essentially. Nobody would do it.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#45

Post by galaktor »

chris_mahan wrote: post #31
zokier wrote: post #12

Earlier quoted context omitted.

This gets asked a lot currently. The sentiment seems to be that email is doomed from a security viewpoint. You'll be leaking metadata no matter what. Even if your email provider was somehow secure, you have no way of knowing if the person (and their provider) you are communicating with is secure. If it's not (which is very likely) then all your efforts to secure your end are almost for nothing. So yeah, my suggestion…

Probably postcards are more secure.

Modern post companies use OCR and other digital processing to handle all mail, including postcards. At least is would be easier to mask who is sending the postcard, for example by omitting the sender details and throwing it into a mailbox far(ish) away from your home. Not a perfect system, as one could probably locate your home via triangulation if you were to use a number of different post boxes in the area of your home.

Re: What Exactly Did The US Government Ask Lavabit to Do?

#46

Post by FedRegister »

dangero wrote: post #42

Hypothetical question: What if the founder of Lavabit took the documents that the US government sent him and gagged him with and put them somewhere where they could be stolen or illegally accessed? For example, what if he put them on a computer with a public facing ip address, or even left them on his desk in his office? If he could have plausible deniability couldn't they get stolen and leaked without him really get…

>This may seem like a stretch, but when you consider the government is using secret interpretations of laws how is it any different than what they are doing?

The difference is that they have the guns, the tanks, and the full weight of the Department of Justice behind them.

Post reply on HN