Hacker News Reader

Comment by mtgx | Hacker News Reader

So that settles it for recommending Hushmail for true private communications - don't use it.

Apparently you have never been to their website. They clearly state that they will fully cooperate with law enforcement on signup.

Its a mandatory checkbox on signup:

I understand that Hushmail is not suitable for illegal activity and that the providers of Hushmail will cooperate fully with authorities pursuing evidence via valid legal channels. See our Security Page.

The corollary is that Hushmail is a shitty service. A good service for private e-mail should make it impossible for the server administrators to see what is going on. Obviously that checkbox should make any user that needs real security turn around in the door.

I've never used Hushmail, but I assumed "secure e-mail" == "none of my information touches the server in plaintext". So this comment is quite interesting.

The realities of the browser environment make it impossible to do what you describe. It's been possible with native clients for a long time, but has always been pretty cumbersome for non-geeks--I've been working on a native client solution that would be easy for non-geeks to use and provide a few different levels of security (which come with varying levels of convenience) that are all better than the "plain-text everywhere" option most people use now.

I posted a link to this yesterday and don't mean to spam, but the topic has come up a few times in the past day, so: http://parley.co

> http://parley.co

Excellent writeup. It really helps when the conversation is steered away from terms like 'amendment', 'advertisers', 'enforcement', 'criminality' and steered back to the central idea of recovering and safeguarding an intuitive and traditional idea of privacy in personal communication (postcard analogy). Lots of people, many with vested interests, insist that this isn't possible, that the genie is out of the bottle. But let's at least try, right?

In fact, PGP was a neat solution for the internet of the '90s with its quaint directory services (Bigfoot, anyone?) and dialup links. I think it had Pretty Good uptake too. So I'm very interested to see what can be done in today's environment.

(Your exchange with jmillikin looked promising too. Did it continue?)

Thanks noibl, that's very generous of you. Besides being as self-conscious as anyone might be when publishing a bit of writing, I knew that I was writing for two separately critical audiences (computer security experts and those who would tend to brush off most privacy advocates as unnecessarily alarmist) which made it considerably more daunting. You put it quite well yourself, though: let's at least try. The defeatist attitude many people take toward privacy (and I'll be the first to admit, I do it too sometimes) is at least as concerning to me as the privacy challenges themselves, but I really do believe we stand a fighting chance on both fronts.

My exchange with jmillikin didn't continue, unfortunately, but I really do want to discuss exactly what we're building with anyone who will listen--there will be more information on the website soon enough but I would love for anyone who reads this to email me any time. My email is in my profile.

Supposedly lavabit.com is (from the admin perspective) about as close to zero knowledge as it gets. Logs are kept for a minimum to diagnose abuse/performance issues, and crypto keys are strictly between the user and server. As I understand it, the only legal compromise would be a national security letter style gag order to alter the binary that interfaces the client (be it Outlook, your phone, or the web-mail host) to the back-end data store, which is stored encrypted on disk.

Security flaws are another thing entirely. I have no idea if anyone, aside from internal developers, has vetted the system for flaws that typically result in server compromises.

I was a satisfied free user some years ago, and the above was my understanding of the service after a few pointed queries to the support address.

> alter the binary that interfaces the client

Which, in case it's not clear, is exactly what Hushmail did/does.

http://themonetaryfuture.blogspot.com.au/2009/05/pgp-creator...

The main difference being that the modification was code sent to, and then executed by, the end-user's browser in the form of a Java applet.

I personally believe that Lavabit (a tiny company composed of a few dedicated folks) would rather shut down service than do something as underhanded as what Hushmail did.

In either case, the end user is relying on a proprietary system/company to fight the good fight for them, which is foolhardy if your well being is on the line. Those in need of strong privacy would probably use PGP+tor for communication anyway.

You said '(be it Outlook, your phone, or the web-mail host)'. I was just providing a relevant historical example to support your point. (Lavabit does have a webmail interface.)

FWIW, the Hushmail ex-CEO seems to strongly agree with you on both the ethics point and the need for users to take blind trust out of the security equation.

---

So I've just gone to the Lavabit site and it looks like that they store your private key on the server.[1] That doesn't strike me as being more secure than Malone's idea of externally-audited client-side crypto. But then, as you say, you've arrived at PGPGPG.

The fact, then, that Zimmerman was involved with the company so early on and they still fucked it up just goes to show that faith in the efforts of 'a few dedicated folks' doesn't get you very far.

[1] http://lavabit.com/secure.html

"Security" here is used in a weird way.

Security is a design feature, not a policy.

I do not understand why they are still in the business. It seems their reputation is destroyed, yet they are still here.

For people who only care about non-government espionage.

you have to be an idiot to use any email provider for something like this, without PGP encrypting your content.

That wasn't the first time they cooperated with law enforcement.

One thing it's a "private communications" service and other a bulletproof one.

Is there a better one?

Yes, encrypt all your mails using PGP.

The problem with PGP is that while it keeps the content of your mail exchange secret, it does not protect the information that two persons exchanged emails. So if the investigators have a lead to person A that sells drugs and see that he's communicating with person B that accepts payments, the might just guess what relationship the two have.

Right, that's why you use Tor. PGP provides privacy and accountability. Tor provides anonymity.

Just remember you have to trust the security of the receiving party as well. Make sure not to reveal yourself with the contents of your emails since the other party might not be as disciplined with their tor and pgp use as you are.

Tor doesn't anonomise email :-/ If you want that, look for mixminion or mixmaster. Tor is a low latency mixnet for TCP streams (aka web browsing).

SMTP uses TCP and works over tor just fine. But you can always just use a free web mail account somewhere.

Yes, that's to fetch mail from a server. TorBirdy for instance is a plug in for Thunderbird.

But! If you want to send a message alice@domain.com to bob@otherdomain.com that is not anonymous, unless you take other measures.

Yes. There is a difference between "private" and "anonymous".

Encryption often removes anonymity by tying an identity to keys and to a web of trust.

For that use tor to access your emails and/or use tormail.org which will not be able to disclose that information.

Actually now-a-days it's using an OTR client, since it adds deniability and forward secrecy. I don't know if it removes offline messaging. It's also a lot easier to use and easier to convince your friends and close ones to use it since they only need to flip a switch practically.

http://www.cypherpunks.ca/otr/

@Xylakant then you have to pull an "Petraeus" and just keep the emails unsent in the draft folder. Not sure if this is still a viable option.

People are forgetting that if you use PGP you can post it anywhere

The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP.

There are other mixnets such as Mixmaster and Mixminion that do what Tor does for TCP but with email. They unfortunately need many more people to run nodes.

"The Petreus incident is sort of crazy for this reason. Here is the head of the CIA, doesn't even use PGP."

He's just a bureaucrat, hired after retiring as an Army general. I seriously doubt if he had any personal spy craft training beyond "use this secure computer and this secure phone when you're working on company business, sir. And don't talk about Fight Club."

The head of the CIA is aware of the methods used to extract information from suspects, and thus wants his information to be easily found if he's discovered, rather than requiring him to be extra-ordinarily renditioned and water-boarded.

</tinfoil hat>

I guess it just shows that anonymous and private communication is still really hard for most people, even though we had the work of cypherpunks trying to help.

Why would they waterboard him if he was willing to give up the keys?

https://countermail.com/

TorMail

Most providers happily cooperate with law enforcement and other government agencies, in particular if they don't have to (or are forbidden to) inform their customers. In many cases, informal contacts are used or a polite official request without a court order is already sufficient.

Please note that all the discussion that is done here about Hushmail being or not secure is only applicable to @hushmail to @hushmail communication. Securing mails to external addresses is impossible by design (without other types of key exchange/trust, e.g. PGP).

Reply on news.ycombinator.com