Lavabit to Briefly Reinstate Services for Data Recovery

https://rally.org/lavabit#post_gRdzf0nzD6E

by welder • 13 years ago

51 18 13 years ago

bennyg• 13 years ago

I know it goes to another website, but is the database connecting to the new website, or is the new website connecting to the old website that connects to the DB? I feel like this matters for SSL reasons.

lm7412• 13 years ago

This is sketchy. The new server no longer attempts to provide any forward security.

For the old (now revoked) site, Chrome would use: TLS_DHE_RSA_WITH_AES_256_CBC_SHA. For the new liberty.lavabit.com site, Chrome will pick TLS_RSA_WITH_AES_256_CBC_SHA with the new server. This means that instead of having to factor a 1024 bit dh parameter for each session, the FBI/NSA/etc will be able to be able to decrypt traffic to this server when they get the private key.

https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavab... https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com

lm7412• 13 years ago

Follow up: I emailed support@lavabit.com asking them to update their configuration and linking them to https://wiki.mozilla.org/Security/Server_Side_TLS (Thanks for posting that, jvehent)

lurkinggrue• 13 years ago

Wait! Didn't he erase the servers? Wasn't that the point?

inigoesdr• 13 years ago

If he had erased them he wouldn't have needed to give up the encryption key and he wouldn't have had as much of a problem giving it up unless he used it elsewhere.

Karunamon• 13 years ago

I'd assume that the bad guys with guns would have attempted to spin that into a "destruction of evidence" charge or similar too.

svag• 13 years ago

Here is the announcement https://liberty.lavabit.com/

Mithrandir• 13 years ago

He mentioned this in an interview with CNET:

http://news.cnet.com/8301-1009_3-57597954-83/lavabit-chief-p...

"What happens to your customer's e-mails and data?

Levison: I'm looking into setting up a site where users can download their data and set up a forwarding [e-mail] address, but that may take a week or two to set up. That's all I can do until I feel confident that I can resume the service without having to compromise its integrity.

I will make it clear that I don't plan to use any encryption for that site. [People] should only use it if they feel comfortable with the information being intercepted. And yes, I do plan to have that disclaimer on the site.

Unfortunately, what's become clear is that there's no protections in our current body of law to keep the government from compelling us to provide the information necessary to decrypt those communications in secret.

I'm still looking at seeing if that's even logistically feasible -- there's half a billion messages [sent in the 10 years Lavabit operated]. By shutting down the service, I will be losing the infrastructure that I used to support all those people.

There's stuff that I can't share with my own lawyer. This is going to be a long fight."

spc476• 13 years ago

"There's stuff that I can't share with my own lawyer."

That right there says to me that he can bring that issue up as a violation of his Constitutional rights (Amendment VI---"and to have the Assistance of Counsel for his defense."). It's insane that he can't talk to his lawyers.

eli• 13 years ago

Who said he's the defendant?

n09n2• 13 years ago

Or is he just deliberately choosing to misinterpret ambiguous language to mean he can't talk to his lawyers in order to make the government look bad? This is the same man that printed out his key in 4 point font when presented with a court order.

sneak• 13 years ago

Wait, isn't this the service that encrypted all the user's data to a key encrypted with the user's passphrase?

And now the NSA wants his users' keys, and presumably has the encrypted versions (and the data encrypted to them, too).

Now we're all going to log in and give them the missing puzzle piece so that they can decrypt the keys and then decrypt the messages?

That doesn't make much sense now, does it?

MichaelGG• 13 years ago

Yeah, why don't they expose a way to download your encrypted data, along with source code to show how to decrypt it?

tomphoolery• 13 years ago

Yeah if I had a Lavabit account I'd just stay far far away from the data. Who knows who's watching, and what puzzle pieces they can now put together..

n09n2• 13 years ago

Not only does it make sense, that's the whole point.

Lavabit to Briefly Reinstate Services for Data Recovery

Related Stories