Slashdot Mirror
Lavabit Is Relaunching (theintercept.com)
The encrypted email service once used by whistleblower Edward Snowden is relaunching today. Ladar Levison, the founder of the encrypted email service Lavabit, announced on Friday that he's relaunching the service with a new architecture that fixes the SSL problem and includes other privacy-enhancing features as well, such as one that obscures the metadata on emails to prevent government agencies like the NSA and FBI from being able to find out with whom Lavabit users communicate. In addition, he's also announcing plans to roll out end-to-end encryption later this year. The Intercept provides some backstory in its report: In 2013, [Levison] took the defiant step of shutting down the company's service rather than comply with a federal law enforcement request that could compromise its customers' communications. The FBI had sought access to the email account of one of Lavabit's most prominent users -- Edward Snowden. Levison had custody of his service's SSL encryption key that could help the government obtain Snowden's password. And though the feds insisted they were only after Snowden's account, the key would have helped them obtain the credentials for other users as well. Lavabit had 410,000 user accounts at the time. Rather than undermine the trust and privacy of his users, Levison ended the company's email service entirely, preventing the feds from getting access to emails stored on his servers. But the company's users lost access to their accounts as well. Levison, who became a hero of the privacy community for his tough stance, has spent the last three years trying to ensure he'll never have to help the feds break into customer accounts again. "The SSL key was our biggest threat," he says.
It is nice to have a good transport layer for E-mail, but no matter how well secure it is, it is wise to have your final message/file encryption be separate, just in case something happens. The same reason people put stuff in a physical, sealed envelope before it goes into the courier's hands, even though the courier is 100% trustworthy.
so even if 100% of the service is hosted overseas, the gestapo errr FBI and NSA, will still put pressure on him to compromise the service.
Any more, you want fed proof email, 100% of the solution has to be fed proof.
That means non US citizens as employees working in a fed proof country, and servers hosted in a fed proof country.
I think proton mail fits this need well.
Lawyers, MBA's, RIAA? A jedi fears not these things!
ProtonMail already exists, has 2 million users, excellent security and architectural design, zero knowledge on the part of the provider, 2 factor authentication, optional two password setup (one for the account, another to decrypt the inbox), is located in Switzerland instead of the US, etc. It's also trivial to use, the importance of which can't be overstated.
In contrast, the new LavaBit is promising end-to-end encryption "later this year", as opposed to PM, which has always had it. It's concerning that a single SSL certificate was the only barrier between the users and total decryption. More competition is always good, but this looks like a significant step down from an existing service.
to move viable commercial amd government computer equipment overseas where no local host may tamper with nuisamce physical facility take-over messages: a place where overseas the Crown of England and the Shah of Iran cant colonize or co-habit because the natives will be opinionated and armed without infringing regulations and are all able-bodied since rejecting GMO foods: ladies and gentlemen, im talking about America.
This guy went through some moderate crap to get where he is, including cancelling his service rather than surrendering his principles. Additionally, he went through the hassle of getting the ability to discuss what happened, which involved some court work. Why would you assume this is a honeypot all of a sudden?
Please, please, can we have groklaw back? http://groklaw.net/ Pamela?
Question... With all the various contortions that the metadata takes, how well do they handle spam? I guess all the checks are done prior to storing the email on their servers?
Wasn't Lavabit's experience what caused the wonderful Pamela Jones to shut down Groklaw?
Lord, how I miss that website. God bless you, PJ, wherever you are.
SSL problem fixed: the key is now in a Hardware Security Module and cannot be seized by police.
That fixes communication, but what about stored data. And why the FBI couldn't seize the hardware security module itself?
what is needed is to require emails to be encrypted at the client side.
With each new client set-up, any new users should be required to get their encryption key, or enter in their current ones.
Then on the emails, by default, encrypt. If the user wants, they can turn it off on an individual one.
I prefer the "u" in honour as it seems to be missing these days.
"All of a sudden?" Look how much time they've had to find his weaknesses.
That's the tricky thing about trust on the internet; you can't trust. That is the only correct answer. If you have trust in technology, that trust is misplaced. If you have trust in people, that is probably misplaced too; and even if it isn't, you can't know for sure!
I highly recommend adopting technology strategies that do not rely on trust. When I click on some perverted anime video with cat women, I have to accept that somebody might find out. If such perversions were illegal in my location, I'd have to assume I might get in trouble. If I ever ran for office, some jerk is going to pull out an old access log that proves I'm either a pervert or a prevert. That is just the nature of technology! Increased communication provides more information, not less. As some have said, "information wants to be free!" Information technology can't reduce information, it can only add to the available information.
As a former WebTV user, I know that WebTV's can't do telnet. Besides, you should be logging in via SSH on your PS2 Linux kit.
We know that Levison is both capable with regards to technology and has excellent personal integrity. Add to that that he now also understand the legal angle better and this is one of the most secure offerings available.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Most of the law is not about right or wrong, but about keeping the population under control. As long as people keep confusing "legal" and "moral", this scam will continue.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Collateral damage from the shutdown of Lavabit was the closure of Groklaw.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.