I was forced to shut down Lavabit (2014)
theguardian.com
theguardian.com
Since Lavabit used the older RSA key exchange, instead of a DHE key exchange, the private key they were forced to hand over could decrypt all past HTTPS connections. With forward secret (DHE/ECDHE) key exchanges, the private key can only be used to impersonate the server; it cannot be used to decrypt any past (or future) HTTPS connections.
Had Lavabit used DHE/ECDHE, they would have nothing to give. Even adding a backdoor to their servers (or a MITM logging middlebox) would gain nothing, unless the target logged in after it was installed. They would be able to simply respond "we have nothing useful to give" and be done with it, like recently happened to Whispersystems.
https://whispersystems.org/bigbrother/eastern-virginia-grand...
I have never found myself in the situation that Ladar Levison describes but I wonder (and fear) whether I would have the courage to shut down my business on a matter of principle like that.
You might believe the government should never be able to access private communications at all, but that would be a quite extreme position. In this case they had a (presumably legitimate) warrant for access to a specific user's emails (and while it shouldn't affect the principles at issue, it focuses the mind to remember that this was a child porn case IIRC).
Do you have a link? If you're referring to Lavabit's shutdown, according to this source [1], they were looking for Snowden. I've never heard Snowden associated with child porn.
[1] https://www.wired.com/2016/03/government-error-just-revealed...
https://www.wired.com/2016/03/government-error-just-revealed...
But federal authorities recently screwed up and revealed the secret themselves when they published a cache of case documents but failed to redact one identifying piece of information about the target: his email address, Ed_Snowden@lavabit.com. With that, the very authorities holding the threat of jail time over Levison’s head if he said anything have confirmed what everyone had long ago presumed: that the target account was Snowden’s.
Children are absolutely innocent, and they always deserve protection. Using child exploitation as a means to snoop isn't protecting; it's just a bullshit excuse at mass surveillance. There is, however, a balance to privacy.
It reminds me of the Investigatory Powers Act in Britain which demands ISPs to log everyone's internet browsing history and the end of end-to-end encryption as all encryption will have to have backdoors.
All that will happen, is that anonymous email providers will move to countries which are privacy friendly. It's a game of whack a mole. There's already Sigaint which is an anonymous email provider which is hosted on Tor. I'll be using Sigaint, offshore hosting and I2VPN when I launch my anonymous website.
The article is giving a one-sided account. The government issued a (presumably valid) warrant to intercept messages on a specific user's account. He had designed the system such that he couldn't provide that access except by providing his keys to everything, and at first attempted to bill the government for building a system that would let him grant access to individual accounts.
From the first paragraphs:
> THE U.S. GOVERNMENT in July obtained a search warrant demanding that Edward Snowden’s e-mail provider, Lavabit, turn over the private SSL keys that protected all web traffic to the site, according to to newly unsealed documents.
> The July 16 order came after Texas-based Lavabit refused to circumvent its own security systems to comply with earlier orders intended to monitor a particular Lavabit user’s metadata, defined as “information about each communication sent or received by the account, including the date and time of the communication, the method of communication, and the source and destination of the communication.”
Now in this reply you seem to know much more about the case so why make the false accusation about child porn in the first comment?
In this particular case I was surprised (as a European) that one can be summoned to a court outside of their home town. In my country it's unthinkable that someone from another city could sue me and expect me to go there for a court hearing. I'm sure there are exceptional cases where someone might be summoned, say, to the capital, but AFAIK this would be a very unusual case.
Little things like this - lies, misrepresentations, pressure; I am more scared of police and other agencies when I think of visiting the US than I am of criminals. Unsettling.
Generally it is very hard to do this. The U.S. actually has two levels of court systems: state (each state has their own judicial system) and federal (for cases involving federal law, agencies, and so on - IANAL so I don't actually know the full list). This rapidly gets obscenely complicated when you think about the fact that some people live in one state but work in another, about how you might handle an accident on a road trip to Disneyland, or even about how states can tax businesses that operate online, say through Amazon.
In many cases you have to file in a region convenient for the defendant to respond.
Federal court, even at the lowest levels, is serious stuff. Combine that with
- the NSA, - implications for national security, which means everyone with a title and everyone who wants one is going to raise a hullaballoo, from the Department of State to the Department of Defense to the Department of Homeland Security, - countries around the world being pissed, and - the FBI, with explicit directives to capture Snowden,
and what you get is a very well-oiled political and bureaucratic machine moving far faster than it normally would. Now, as a disclaimer, I have absolutely no experience with federal cases, but in the state civil cases that I saw when I interned at a small law firm, it was perfectly common for components of the judicial process to take weeks; it takes months and egregious conduct to be found in contempt.
I was going to say that I suspected the case went to a specific subject-matter court (yes, if you have a case dealing with a specific topic X, it's possible - highly unlikely but possible - that you may have to deal with a subject-matter court), but after doing some fact-checking (https://www.wired.com/2013/10/lavabit_unsealed/), it seems the suit was raised in the Eastern District of Virginia. I'm not sure exactly what it was that gave V.A. E.D. original jurisdiction over such a case, but I'm sure someone better versed in this could provide a better answer.
It's all about threat model. If I'm trying to get past a hotel firewall, an ISP deep-packet inspection system, or a coffeeshop blocking my traffic or snooping on it for profiling purposes, then PIA is a simple, reliable choice.
If I'm a freedom fighter in a hostile country or a criminal with state-level adversaries, then PIA is a poor choice for you. It's not ever going to protect you against someone who wants you bad enough.
The truth is that it's turtles all the way down my friend. Follow the paranoia thought-chain long enough and pretty soon you're suspicious of your own phone, the supply chain that put it in your hands, the manufacturer of the components that went into it, and the people who wrote the applications you run on it.
If you're really worried about privacy, then you better not ever use technology. It's all suspect.
Why are they better than other VPN companies which do not use extraordinarily dishonest marketing tactics?
Or maybe even a company that doesn't cover up leaks of customer data? Go ask PIA why they didn't speak up when they got compromised via this bug: https://kayako.atlassian.net/wiki/display/DOCS/Security+advi...
Also ask them why they didn't find it during internal audits, this bug was as obvious as they come. Anyone with a clue could see it simply by looking at the cookies privateinternetaccess.com would set.
I'm with you on security vulnerabilities and marketing but I'm also pragmatic. Few of the companies we deal and support financially have perfect records.
I'm writing this on a Macbook Pro. Tell me how they stack up on the human rights issue with their Chinese factories.
That also makes it hard to switch away if you choose to leave them. Your data is captive.
I don't think that their intentions are bad...it's just the nature of how it's designed.
Here is an exerpt from the email:
Dear ProtonMail Plus Subscriber,
We are happy to announce the beta program for a new product that adds IMAP and SMTP support to ProtonMail. We call this project the ProtonMail Bridge.
The ProtonMail Bridge is among the most requested features by the community and lets you send and receive encrypted emails from within your mail client of choice. The Bridge supports any client that uses IMAP/SMTP including Outlook, Thunderbird, and AppleMail.
We will be choosing only a few dozen people to start so if you are interested in participating please fill out the following form by the end of this week:
No, that's not a good alternative. None of them are. The "good alternative" is to run your own mailserver on a physical piece of hardware, under a business name, not at your house.
Technically speaking, it's childs play, so that's not a barrier. It does cost something to rent 1U of space somewhere but if you shop around and pay annually, etc., it's bearable.
What you gain is huge:
1. Subpoenas/letters/writs go to you and you get to decide how to respond to them. You're the operator.
2. By you I mean your business entity which is a PO BOX somewhere. Not your house.
3. You get to control retention and encryption and certificates and security features.
4. Finally, instead of being a consumer/viewer of "the web" you get to be a peer on the network. For some people this will be truly using the Internet for the very first time.
You're assuming here that the executive will actually follow the full.due process of law vs. "we raided X address on suspicion and grabbed a few servers". Not true in many parts of the world and having email encrypted and stored in a different jurisdiction may be safer.
Microsoft even managed to add telemetry on Windows 7, 8 and 10 without much push-back and stores your Office docs automatically on their cloud.