Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We're Fighting the Feds Over Your Email

m.us.wsj.com

Post reply on HN
Print view View original

41–50 of 94 posts

Re: We're Fighting the Feds Over Your Email

#41

Post by harryh »

lisper wrote: post #36
rayiner wrote: post #17

Earlier quoted context omitted.

A physical letter in a rented mailbox is also generally not data-mined for the commercial purposes of the service provider. I think cloud companies essentially want the 4th amendment benefits of treating the cloud like real world private areas (e.g. bank lock boxes), without any of the obligations that come along with that. The "reasonable expectation of privacy" in things like safe deposit boxes or storage units is…

> The "reasonable expectation of privacy" in things like safe deposit boxes or storage units is based on the actual fact that service providers generally do not and cannot access the contents of those rented spaces. And the "reasonable expectation of privacy" in cloud email is based on the fact that, while computers necessarily have access to the data (it is not possible to provide email service otherwise), humans ge…

If you don't think that humans have access to the contents of your cloud hosted email service then I've got a bridge to sell you.

Re: We're Fighting the Feds Over Your Email

#42

Post by junto »

I think Microsoft are right here and I'm glad that they are willing to take this on. Of is in their interests to show that their customers' email privacy is afforded the same level of protection that normal mail does.

Re: We're Fighting the Feds Over Your Email

#43

Post by Kalium »

me1010 wrote: post #38
Kalium wrote: post #28

Earlier quoted context omitted.

If memory serves, the feds had probable cause and a warrant when they want after Lavabit. Lavabit tried to fight it. Lavabit lost. So they shut down instead and tried to spin it as the feds shutting them down.

I believe they were told to hand over the SSL private key. I'm not sure everyone using the Lavabit service was a criminal... So, my thought is that probable cause for handing over the master key to the hotel should be a bit more than probable cause to hand over the room key...

That's my understanding as well. Unfortunately, Lavabit used one SSL certificate for every incoming user, rendering it impossible to use anything lesser. So to continue your analogy, the hotel only had one key - the master.

Re: We're Fighting the Feds Over Your Email

#44

Post by [deleted] »

lisper wrote: post #36
rayiner wrote: post #17

Earlier quoted context omitted.

A physical letter in a rented mailbox is also generally not data-mined for the commercial purposes of the service provider. I think cloud companies essentially want the 4th amendment benefits of treating the cloud like real world private areas (e.g. bank lock boxes), without any of the obligations that come along with that. The "reasonable expectation of privacy" in things like safe deposit boxes or storage units is…

> The "reasonable expectation of privacy" in things like safe deposit boxes or storage units is based on the actual fact that service providers generally do not and cannot access the contents of those rented spaces. And the "reasonable expectation of privacy" in cloud email is based on the fact that, while computers necessarily have access to the data (it is not possible to provide email service otherwise), humans ge…

[deleted]

Re: We're Fighting the Feds Over Your Email

#45

Post by fooqux »

Kalium wrote: post #28
fooqux wrote: post #15

Earlier quoted context omitted.

I'm no longer sure that is enough. Considering what happened to Lavabit, just offering end-to-end encryption is only going to work until the government decides they want what you have hidden. I doubt that Microsoft will put up as much of a fight, or take the high road out, like the Lavabit founder did. Fighting them on the legal front to stop such practices from starting may well be the best option right now. Even th…

If memory serves, the feds had probable cause and a warrant when they want after Lavabit. Lavabit tried to fight it. Lavabit lost. So they shut down instead and tried to spin it as the feds shutting them down.

They did indeed have a warrant for the info. The problem was how they chose to pursue obtaining the info- that is, installing a MitM black box that could read all customer email going through it, not just the citizen for whom they had the warrant. I'm not sure if they promised or not to only snoop on that one individual, but even if they did you would have no way of knowing if they're telling the truth or not. From what I read, he wasn't necessarily trying to protect Snowden, but protect the rest of his userbase.

Re: We're Fighting the Feds Over Your Email

#46

Post by mahyarm »

me1010 wrote: post #33
fooqux wrote: post #15

Earlier quoted context omitted.

I'm no longer sure that is enough. Considering what happened to Lavabit, just offering end-to-end encryption is only going to work until the government decides they want what you have hidden. I doubt that Microsoft will put up as much of a fight, or take the high road out, like the Lavabit founder did. Fighting them on the legal front to stop such practices from starting may well be the best option right now. Even th…

End users need to and can take control over their own email privacy. GPG. Ten minutes to download, install, and generate a key pair is all you need to secure your email. Perhaps the willingness to do so will increase when the government successfully argues that non-encrypted mail posted through an email server is the same as posting your thoughts on a public peg board... If you want full compatibility, you can pay a…

Pffft, GPG doesn't work if you want to communicate with other people. It's very difficult to get people to use it, and the UX is horrible for it. On top of that it's even harder to use on mobile platforms. GPG also doesn't have forward secrecy.

Re: We're Fighting the Feds Over Your Email

#47

Post by [deleted] »

panarky wrote: post #6

Relevant excerpts: Microsoft believes you own emails stored in the cloud, and that they have the same privacy protection as paper letters sent by mail... The U.S. government can obtain emails only subject to the full legal protections of the Constitution's Fourth Amendment... A search warrant cannot reach beyond U.S. shores... [The US government] argues that your emails become the business records of a cloud provider…

[deleted]

Re: We're Fighting the Feds Over Your Email

#48

Post by marcosdumay »

fooqux wrote: post #15
higherpurpose wrote: post #12

If Microsoft was serious about this, they'd also offer end-to-end encryption for their e-mails (open source protocol, otherwise they shouldn't bother). But because they aren't doing this, it just shows they are more concerned about not losing business overseas than "fighting for your e-mail".

I'm no longer sure that is enough. Considering what happened to Lavabit, just offering end-to-end encryption is only going to work until the government decides they want what you have hidden. I doubt that Microsoft will put up as much of a fight, or take the high road out, like the Lavabit founder did. Fighting them on the legal front to stop such practices from starting may well be the best option right now. Even th…

End-to-end means that Microsoft has no capability of reading the emails, or share them with anybody, as they are not in any end of the communication.

Re: We're Fighting the Feds Over Your Email

#49

Post by Kalium »

fooqux wrote: post #45
Kalium wrote: post #28

Earlier quoted context omitted.

If memory serves, the feds had probable cause and a warrant when they want after Lavabit. Lavabit tried to fight it. Lavabit lost. So they shut down instead and tried to spin it as the feds shutting them down.

They did indeed have a warrant for the info. The problem was how they chose to pursue obtaining the info- that is, installing a MitM black box that could read all customer email going through it, not just the citizen for whom they had the warrant. I'm not sure if they promised or not to only snoop on that one individual, but even if they did you would have no way of knowing if they're telling the truth or not. From w…

What other options were there? There was only one SSL key. Once you can MitM one user in that scenario, you can MitM them all.

To my understanding Lavabit didn't have a system in place for separating out one user like that, and the feds would likely have been disinclined to wait for the development of one.

So perhaps we should take this as a lesson in designing systems to be as secure as possible even with legitimate warrants rather than as a sign of warrants being abused.

Re: We're Fighting the Feds Over Your Email

#50

Post by [deleted] »

rhino369 wrote: post #26
panarky wrote: post #6

Relevant excerpts: Microsoft believes you own emails stored in the cloud, and that they have the same privacy protection as paper letters sent by mail... The U.S. government can obtain emails only subject to the full legal protections of the Constitution's Fourth Amendment... A search warrant cannot reach beyond U.S. shores... [The US government] argues that your emails become the business records of a cloud provider…

>A search warrant cannot reach beyond U.S. shores... Well, that is also part of this case. The court is going to determine how to fit data into the current caselaw. There is good reason for why the US can't order searches in another country. But if Microsoft has servers in the United States that can routinely access their cloud servers, there is a good argument that data is really in the United States as well. The bu…

[deleted]
Post reply on HN