Hacker News Reader

Comment by orclev | Hacker News Reader

To my understanding this is what I would expect to happen. He handed over the cert to the FBI, so from a security standpoint it's useless now and should be considered compromised.

View on HN

Will having the private key allow the decryption of ciphertext that was previously intercepted (while the service was active) and stored? Lavabit was already shut down, so this revocation is equally useless for user security. :(

If the connection was using a forward-secret key exchange (like DHE or ECDHE), then no. Unfortunately it's common not to and browsers don't do anything to warn people that they're using a low-security mode.

FWIW, just now I went looking for a firefox plugin that reports (in a human-friendly way) whether or not the SSL connection for a page is using perfect forward secrecy (PFS).

I found "Calomel SSL Validation," which I am about to install. The PFS reporting only works with Firefox 25 and up.

https://addons.mozilla.org/en-US/firefox/addon/calomel-ssl-v...

Also the Netcraft Extension gives you this information: http://news.netcraft.com/archives/2013/09/06/perfect-forward...

Sadly it comes with an awful toolbar.

Thanks for finding this. Calomel's website [1] gives much more information about how the scoring is done as well as security in general; very interesting.

[1] https://calomel.org/firefox_ssl_validation.html

It depends on what ciphersuite was being used for the particular session. Some offer forward secrecy, but not all.

So does that mean the CAs will start penalizing sites if they give out their private key and -- pursuant to a court order -- don't tell anyone that they've given it out?

Reply on news.ycombinator.com