Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

'backdooring their server to themselves' is not 'backdooring' it's just misdesigning. The alternative is believing Lavabit always scrupulously 'looked away'.

https://moxie.org/blog/lavabit-critique/



We already know that Lavabit design was bad and that is why everyone is moving to E2E.

Still I found no evidence that Lavabit handed over anything but encrypted data and access logs. The only thing I found is [1]: "He says he's received "two dozen" requests over the last ten years, and in cases where he had information, he would turn over what he had. Sometimes he had nothing; messages deleted from his service are deleted permanently."

He has complied with warrants because he had nothing to transfer. Nothing was stored and there is no legal obligation to modify your service to store passwords. When he was asked for TLS keys, he had to shutdown the service to prevent leaking all the passwords and redesigned the server.

The difference between not looking away and Lavabit design is that nothing is exposed if the server is seized.

The design of old Lavabit was not sufficiently secure and there was no way to check if it is more secure from the users' perspective, but still no reason to call it snake oil [2]. Snake oil is a product that is advertised as secure when maker knows it is insecure. Lavabit design was correctly described on its website and source code was promptly published after the shutdown so it is possible to verify that described features existed.

[1] http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-...

[2] https://news.ycombinator.com/item?id=13447919


Still I found no evidence that Lavabit handed over anything but encrypted data and access logs

There isn't any evidence of that or the contrary. He had all the data. We don't know what he did or did not turn over.

Snake oil is a product that is advertised as secure when maker knows it is insecure.

Take another look at this (and Moxie Marlinspike is being generous and sympathetic). It meets your own criteria precisely.

https://moxie.org/blog/lavabit-critique/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: