Lavabit to Briefly Reinstate Services for Data Recovery | Hacker News Reader

Lavabit to Briefly Reinstate Services for Data Recovery

rally.org

51 pointswelder18 comments

This is sketchy. The new server no longer attempts to provide any forward security.

For the old (now revoked) site, Chrome would use: TLS_DHE_RSA_WITH_AES_256_CBC_SHA. For the new liberty.lavabit.com site, Chrome will pick TLS_RSA_WITH_AES_256_CBC_SHA with the new server. This means that instead of having to factor a 1024 bit dh parameter for each session, the FBI/NSA/etc will be able to be able to decrypt traffic to this server when they get the private key.

https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavab... https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com

Follow up: I emailed support@lavabit.com asking them to update their configuration and linking them to https://wiki.mozilla.org/Security/Server_Side_TLS (Thanks for posting that, jvehent)

He mentioned this in an interview with CNET:

http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-p...

"What happens to your customer's e-mails and data?

Levison: I'm looking into setting up a site where users can download their data and set up a forwarding [e-mail] address, but that may take a week or two to set up. That's all I can do until I feel confident that I can resume the service without having to compromise its integrity.

I will make it clear that I don't plan to use any encryption for that site. [People] should only use it if they feel comfortable with the information being intercepted. And yes, I do plan to have that disclaimer on the site.

Unfortunately, what's become clear is that there's no protections in our current body of law to keep the government from compelling us to provide the information necessary to decrypt those communications in secret.

I'm still looking at seeing if that's even logistically feasible -- there's half a billion messages [sent in the 10 years Lavabit operated]. By shutting down the service, I will be losing the infrastructure that I used to support all those people.

There's stuff that I can't share with my own lawyer. This is going to be a long fight."

"There's stuff that I can't share with my own lawyer."

That right there says to me that he can bring that issue up as a violation of his Constitutional rights (Amendment VI---"and to have the Assistance of Counsel for his defense."). It's insane that he can't talk to his lawyers.

Who said he's the defendant?

If he cannot talk with a lawyer, how can he even be sure that he isn't a defendant? Is he suppose to learn law himself? How can he even know if such a restriction is even legal and enforceable, if he cannot talk with a lawyer? How can he challenge their questionable interpretation of whatever laws may make this legal, if he cannot talk with a lawyer? How can he be sure that, by complying with whatever requests they make, he isn't inadvertently committing crimes that he can later be charged for?

Nobody should ever be forbidden from consulting a lawyer, particularly when dealing with other lawyers. These gag orders are a minefields designed to dismember anyone who finds themselves in them; they have absolutely no place in a free society.

Or is he just deliberately choosing to misinterpret ambiguous language to mean he can't talk to his lawyers in order to make the government look bad? This is the same man that printed out his key in 4 point font when presented with a court order.

> misinterpret ambiguous language

If only a lawyer could clear that up for him. ...oh wait.

He's not the only one.

http://en.wikipedia.org/wiki/National_security_letter#Doe_v....

>In his ruling Judge Marrero wrote "All but the most mettlesome and undaunted NSL recipients would consider themselves effectively barred from consulting an attorney or anyone else who might advise them otherwise," and concluded, "as well as bound to absolute silence about the existence of the NSL...For the reasonable NSL recipient confronted with the NSL's mandatory language and the FBI's conduct related to the NSL, resistance is not a viable option."[22]

Frankly, your words seem more like propaganda than his.

Wait, isn't this the service that encrypted all the user's data to a key encrypted with the user's passphrase?

And now the NSA wants his users' keys, and presumably has the encrypted versions (and the data encrypted to them, too).

Now we're all going to log in and give them the missing puzzle piece so that they can decrypt the keys and then decrypt the messages?

That doesn't make much sense now, does it?

Yeah, why don't they expose a way to download your encrypted data, along with source code to show how to decrypt it?

Yeah if I had a Lavabit account I'd just stay far far away from the data. Who knows who's watching, and what puzzle pieces they can now put together..

Not only does it make sense, that's the whole point.

Wait! Didn't he erase the servers? Wasn't that the point?

If he had erased them he wouldn't have needed to give up the encryption key and he wouldn't have had as much of a problem giving it up unless he used it elsewhere.

I'd assume that the bad guys with guns would have attempted to spin that into a "destruction of evidence" charge or similar too.

Here is the announcement https://liberty.lavabit.com/

I know it goes to another website, but is the database connecting to the new website, or is the new website connecting to the old website that connects to the DB? I feel like this matters for SSL reasons.

Reply on news.ycombinator.com