Hacker News Reader

Lavabit's explanation of their security, via the Wayback Machine: http://web.archive.org/web/20130530023856/http://lavabit.com...

It's just how encryption works; you don't store the plain passwords or keys the users submit to decrypt their stuff, thus you have no way to access it.

It all happens on the client side. Servers only store the encrypted emails and have no idea what the contents or the keys are.

right, but incoming and outgoing emails from lavabit servers won't necessarily be encrypted, unless the other party is using GPG or whatever - it's just the way they're stored.

The same server(s) also control the JavaScript code run by the client/browser. They could serve special code (to any one the government wanted to spy on) that returned their password to the server.

That's exactly why LavaBit shut down, looks like they were forced to do that.