Slashdot Mirror
Lavabit Is Relaunching (theintercept.com)
The encrypted email service once used by whistleblower Edward Snowden is relaunching today. Ladar Levison, the founder of the encrypted email service Lavabit, announced on Friday that he's relaunching the service with a new architecture that fixes the SSL problem and includes other privacy-enhancing features as well, such as one that obscures the metadata on emails to prevent government agencies like the NSA and FBI from being able to find out with whom Lavabit users communicate. In addition, he's also announcing plans to roll out end-to-end encryption later this year. The Intercept provides some backstory in its report: In 2013, [Levison] took the defiant step of shutting down the company's service rather than comply with a federal law enforcement request that could compromise its customers' communications. The FBI had sought access to the email account of one of Lavabit's most prominent users -- Edward Snowden. Levison had custody of his service's SSL encryption key that could help the government obtain Snowden's password. And though the feds insisted they were only after Snowden's account, the key would have helped them obtain the credentials for other users as well. Lavabit had 410,000 user accounts at the time. Rather than undermine the trust and privacy of his users, Levison ended the company's email service entirely, preventing the feds from getting access to emails stored on his servers. But the company's users lost access to their accounts as well. Levison, who became a hero of the privacy community for his tough stance, has spent the last three years trying to ensure he'll never have to help the feds break into customer accounts again. "The SSL key was our biggest threat," he says.
It is nice to have a good transport layer for E-mail, but no matter how well secure it is, it is wise to have your final message/file encryption be separate, just in case something happens. The same reason people put stuff in a physical, sealed envelope before it goes into the courier's hands, even though the courier is 100% trustworthy.
You can bet your ass he'll be using all those powers that were meant for 'protecting the people' for whatever purpose he wishes.
so even if 100% of the service is hosted overseas, the gestapo errr FBI and NSA, will still put pressure on him to compromise the service.
Any more, you want fed proof email, 100% of the solution has to be fed proof.
That means non US citizens as employees working in a fed proof country, and servers hosted in a fed proof country.
I think proton mail fits this need well.
Lawyers, MBA's, RIAA? A jedi fears not these things!
Nothing to worry about I'm sure
no computer, period, is 100% safe.
if you think otherwise, you're part of the problem
Levison had custody of his service's SSL encryption key that could help the government obtain Snowden's password.
If they could have obtained the password, Lavabit must have been doing things really wrong, no? Salting and hashing and all that...
systemd is Roko's Basilisk.
i telnet into my vmware host from my webtv interface. im tooo obscure.
ProtonMail already exists, has 2 million users, excellent security and architectural design, zero knowledge on the part of the provider, 2 factor authentication, optional two password setup (one for the account, another to decrypt the inbox), is located in Switzerland instead of the US, etc. It's also trivial to use, the importance of which can't be overstated.
In contrast, the new LavaBit is promising end-to-end encryption "later this year", as opposed to PM, which has always had it. It's concerning that a single SSL certificate was the only barrier between the users and total decryption. More competition is always good, but this looks like a significant step down from an existing service.
to move viable commercial amd government computer equipment overseas where no local host may tamper with nuisamce physical facility take-over messages: a place where overseas the Crown of England and the Shah of Iran cant colonize or co-habit because the natives will be opinionated and armed without infringing regulations and are all able-bodied since rejecting GMO foods: ladies and gentlemen, im talking about America.
This guy went through some moderate crap to get where he is, including cancelling his service rather than surrendering his principles. Additionally, he went through the hassle of getting the ability to discuss what happened, which involved some court work. Why would you assume this is a honeypot all of a sudden?
Please, please, can we have groklaw back? http://groklaw.net/ Pamela?
Question... With all the various contortions that the metadata takes, how well do they handle spam? I guess all the checks are done prior to storing the email on their servers?
Wasn't Lavabit's experience what caused the wonderful Pamela Jones to shut down Groklaw?
Lord, how I miss that website. God bless you, PJ, wherever you are.
SSL problem fixed: the key is now in a Hardware Security Module and cannot be seized by police.
That fixes communication, but what about stored data. And why the FBI couldn't seize the hardware security module itself?
No, she was tired of running it and grabbed a convenient political reason to rage-quit.
The site is still up, you can re-read the quit letter anytime; she says she was rage-quitting the internet, not just quitting the site.
As somebody who was "online" on BBSes before the internet was made public, my take is that we always knew that the internet wasn't private... and that it never claimed to be! That is what private networks are for, after all. Just like, of course the sysop of a BBS can read your email! Some of them do, some of them don't; the ones who say they might often don't they were just warning you, and the ones who say they don't can't prove it or deny capability!
what is needed is to require emails to be encrypted at the client side.
With each new client set-up, any new users should be required to get their encryption key, or enter in their current ones.
Then on the emails, by default, encrypt. If the user wants, they can turn it off on an individual one.
I prefer the "u" in honour as it seems to be missing these days.
"All of a sudden?" Look how much time they've had to find his weaknesses.
That's the tricky thing about trust on the internet; you can't trust. That is the only correct answer. If you have trust in technology, that trust is misplaced. If you have trust in people, that is probably misplaced too; and even if it isn't, you can't know for sure!
I highly recommend adopting technology strategies that do not rely on trust. When I click on some perverted anime video with cat women, I have to accept that somebody might find out. If such perversions were illegal in my location, I'd have to assume I might get in trouble. If I ever ran for office, some jerk is going to pull out an old access log that proves I'm either a pervert or a prevert. That is just the nature of technology! Increased communication provides more information, not less. As some have said, "information wants to be free!" Information technology can't reduce information, it can only add to the available information.
Laws are for the little guys. You very rarely hear of them completing pedophile investigations against politicians, those are more likely to get covered up once they realize who they are investigating. Instead, they work hard at undermining privacy of the masses while ignoring extremely vile corruption in D.C.
.. is where the smart kids are. Puffles is the new bitcoin.
We know that Levison is both capable with regards to technology and has excellent personal integrity. Add to that that he now also understand the legal angle better and this is one of the most secure offerings available.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
So you admit then that you do in fact view perverted anime videos with cat women.
Collateral damage from the shutdown of Lavabit was the closure of Groklaw.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.