FBI outed in attempt to obtain SSL certificate

N&P: Discuss governments, nations, politics and recent related news here.

Moderators: Alyrium Denryle, Edi, K. A. Pital

User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

TheHammer wrote:However SSL is specific to the data in transit - and that's the data that the FBI was after: e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox. At a certain point that data is decrypted so that the two devices can talk to each other. Lavabit could have done the exact same thing the FBI was intending to do with the SSL cert, and thus retained control of the keys entirely. Instead they refused to do so, which lead to the FBI doing it themselves.
None of that would work if the user simply never entered his password into the system again if the local logs were encrypted... You cant catch data in transit if theres no data in transit. :wink:

If Lavabit cant comply with an order because its impossible Lavabit is not at fault.

Because if its Snowden theyre after he has no reason to log onto the service anymore, because he had already skipped the country by the time FBI became curious about his email account.
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Sure they are. Generally you give them what the warrant's for and they find they can't get jack shit from it. Not stonewall them until you're facing an obstruction charge and having to appeal your way out of things. Don't get me wrong, I'm not saying the FBI is absolutely right, but Lavabit isn't a knight in shining armor here.
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

Gaidin wrote:Sure they are. Generally you give them what the warrant's for and they find they can't get jack shit from it. Not stonewall them until you're facing an obstruction charge and having to appeal your way out of things. Don't get me wrong, I'm not saying the FBI is absolutely right, but Lavabit isn't a knight in shining armor here.
You seem to have missed the point where the secret court forbade Lavabit from seeking legal counseling on the matter...

http://arstechnica.com/tech-policy/2013 ... -decision/
Levison explained he was under gag order and that he was legally unable to explain to the public why he ended the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been banned from sharing some information with his lawyer.
Would you bend over backwards blind if your businesses only core operation was customer security and strangers sought compromise that security by demanding you do something that is literal impossibility to execute? Or actually, more like 'burn down your house so we can sweep through the ashes with metal detector'.

'You want what?!', 'No, we cant do that, fuck off'.

Not knowing, because being not allowed to seek legal help that could backfire bad on him....
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

NettiWelho wrote: You seem to have missed the point where the secret court forbade Lavabit from seeking legal counseling on the matter...

http://arstechnica.com/tech-policy/2013 ... -decision/
Levison explained he was under gag order and that he was legally unable to explain to the public why he ended the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been banned from sharing some information with his lawyer.
Would you bend over backwards blind if your businesses only core operation was customer security and strangers sought compromise that security by demanding you do something that is literal impossibility to execute? Or actually, more like 'burn down your house so we can sweep through the ashes with metal detector'.

'You want what?!', 'No, we cant do that, fuck off'.

Not knowing, because being not allowed to seek legal help that could backfire bad on him....
I'm certainly not going to bend over backwards to have a discussion with you if you're just going to reveal tidbits of information about an event that's been on the sideline for me because I've been busy with other things. The only reason I can discuss it now is because, shockingly, I have time. If you want to assume I know more than what is in this thread, fuck off.
User avatar
Terralthra
Requiescat in Pace
Posts: 4741
Joined: 2007-10-05 09:55pm
Location: San Francisco, California, United States

Re: FBI outed in attempt to obtain SSL certificate

Post by Terralthra »

Blaming someone else for not informing you of things that are easily findable from basic google searches is sad and pathetic.
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

Gaidin wrote:
NettiWelho wrote: You seem to have missed the point where the secret court forbade Lavabit from seeking legal counseling on the matter...

http://arstechnica.com/tech-policy/2013 ... -decision/
Levison explained he was under gag order and that he was legally unable to explain to the public why he ended the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been banned from sharing some information with his lawyer.
Would you bend over backwards blind if your businesses only core operation was customer security and strangers sought compromise that security by demanding you do something that is literal impossibility to execute? Or actually, more like 'burn down your house so we can sweep through the ashes with metal detector'.

'You want what?!', 'No, we cant do that, fuck off'.

Not knowing, because being not allowed to seek legal help that could backfire bad on him....
I'm certainly not going to bend over backwards to have a discussion with you if you're just going to reveal tidbits of information about an event that's been on the sideline for me because I've been busy with other things. The only reason I can discuss it now is because, shockingly, I have time. If you want to assume I know more than what is in this thread, fuck off.
You should not interpret my at times lacking social skills for insults.
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Terralthra wrote:Blaming someone else for not informing you of things that are easily findable from basic google searches is sad and pathetic.
Shit. He was just waiting for me to put my foot in my mouth over something in another thread that I didn't have the ability or time to read, much less participate in. And it's just icing on the cake that it's something I'd agree with too. If he's going to spend his time waiting for moments like that, then like I said, he can fuck off. That bit of information certainly hasn't been in this thread and isn't in the first bunch of threads on the forum.
Simon_Jester
Emperor's Hand
Posts: 30165
Joined: 2009-05-23 07:29pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Simon_Jester »

Gaidin wrote:I'm certainly not going to bend over backwards to have a discussion with you if you're just going to reveal tidbits of information about an event that's been on the sideline for me because I've been busy with other things. The only reason I can discuss it now is because, shockingly, I have time. If you want to assume I know more than what is in this thread, fuck off.
This was alluded to earlier: in the OP it talks about the trouble Lavabit's had getting in touch with a lawyer over this, and White Haven talked about it too.
Gaidin wrote:
Terralthra wrote:Blaming someone else for not informing you of things that are easily findable from basic google searches is sad and pathetic.
Shit. He was just waiting for me to put my foot in my mouth over something in another thread that I didn't have the ability or time to read, much less participate in. And it's just icing on the cake that it's something I'd agree with too. If he's going to spend his time waiting for moments like that, then like I said, he can fuck off. That bit of information certainly hasn't been in this thread and isn't in the first bunch of threads on the forum.
...So his even bringing it up is evidence that he's arguing in bad faith?

I mean, I introduce new arguments all the time, or emphasize a point I took for granted but that affects the other party's perspective. It's not because I'm holding them in reserve like a sneaky bastard.
This space dedicated to Vasily Arkhipov
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Simon_Jester wrote:
Gaidin wrote:I'm certainly not going to bend over backwards to have a discussion with you if you're just going to reveal tidbits of information about an event that's been on the sideline for me because I've been busy with other things. The only reason I can discuss it now is because, shockingly, I have time. If you want to assume I know more than what is in this thread, fuck off.
This was alluded to earlier: in the OP it talks about the trouble Lavabit's had getting in touch with a lawyer over this, and White Haven talked about it too.
Gaidin wrote:
Terralthra wrote:Blaming someone else for not informing you of things that are easily findable from basic google searches is sad and pathetic.
Shit. He was just waiting for me to put my foot in my mouth over something in another thread that I didn't have the ability or time to read, much less participate in. And it's just icing on the cake that it's something I'd agree with too. If he's going to spend his time waiting for moments like that, then like I said, he can fuck off. That bit of information certainly hasn't been in this thread and isn't in the first bunch of threads on the forum.
...So his even bringing it up is evidence that he's arguing in bad faith?

I mean, I introduce new arguments all the time, or emphasize a point I took for granted but that affects the other party's perspective. It's not because I'm holding them in reserve like a sneaky bastard.
I could find nothing explicit about it in the article(even just now). And in fact Lavabit's lawyer was involved in the article. The first explicit source about Lavabit's lawyer being withheld from anything was just posted. Frankly the OP can allude to anything it wants, but the source didn't reference such limitations, and in fact had the lawyer arguing for Lavabit. I had no reason to doubt the lawyer's involvement. It was on them.
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

NettiWelho wrote:
TheHammer wrote:However SSL is specific to the data in transit - and that's the data that the FBI was after: e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox. At a certain point that data is decrypted so that the two devices can talk to each other. Lavabit could have done the exact same thing the FBI was intending to do with the SSL cert, and thus retained control of the keys entirely. Instead they refused to do so, which lead to the FBI doing it themselves.
None of that would work if the user simply never entered his password into the system again if the local logs were encrypted... You cant catch data in transit if theres no data in transit. :wink:

If Lavabit cant comply with an order because its impossible Lavabit is not at fault.

Because if its Snowden theyre after he has no reason to log onto the service anymore, because he had already skipped the country by the time FBI became curious about his email account.
The only reason to get the SSL keys would be to capture future data transmissions. Again, the data that the FBI was hoping to capture e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox would need to be captured fresh as presumably Lavabits was not keeping logs that they could hand over. That's Lavabit's story anyway.

If Snowden never logged in, then you're correct there would be nothing to get from that aspect. That's why Lavabits was under a gag order from the court - so that he WOULD continue to use the service thinking his data was "untouchable". However, even in the event that Snowden stopped using the service, others who are emailing snowden could be identified (the "from" lines the FBI was looking for).
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

NettiWelho wrote:
Gaidin wrote:Sure they are. Generally you give them what the warrant's for and they find they can't get jack shit from it. Not stonewall them until you're facing an obstruction charge and having to appeal your way out of things. Don't get me wrong, I'm not saying the FBI is absolutely right, but Lavabit isn't a knight in shining armor here.
You seem to have missed the point where the secret court forbade Lavabit from seeking legal counseling on the matter...

http://arstechnica.com/tech-policy/2013 ... -decision/
Levison explained he was under gag order and that he was legally unable to explain to the public why he ended the service. Instead, he asked for donations to "fight for the Constitution" in the United States Court of Appeals for the Fourth Circuit. Levison also stated he has even been banned from sharing some information with his lawyer.
Would you bend over backwards blind if your businesses only core operation was customer security and strangers sought compromise that security by demanding you do something that is literal impossibility to execute? Or actually, more like 'burn down your house so we can sweep through the ashes with metal detector'.

'You want what?!', 'No, we cant do that, fuck off'.

Not knowing, because being not allowed to seek legal help that could backfire bad on him....
A core business model for banks is that they protect money for their customers. But guess what? If the government comes in with a court order to seize or freeze the assets for one of their customers they MUST and DO comply. That hasn't stopped the majority of people from continuing to use banks to deposit their funds.

Lavabit could absolutely still proclaim to be secure and safe from anyone illegally accessing your data. But a business model built around the premise that even legal entities, providing search warrants, would be stonewalled when trying to perform their duties, would be an illegal enterprise itself.
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

TheHammer wrote:The only reason to get the SSL keys would be to capture future data transmissions. Again, the data that the FBI was hoping to capture e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox would need to be captured fresh as presumably Lavabits was not keeping logs that they could hand over. That's Lavabit's story anyway.
If that was all the FBI wanted they could have simply demanded Lavabit to temporarily modify couple of lines of code in the system to perform that, no SSL required by the FBI..
TheHammer wrote:If Snowden never logged in, then you're correct there would be nothing to get from that aspect. That's why Lavabits was under a gag order from the court - so that he WOULD continue to use the service thinking his data was "untouchable". However, even in the event that Snowden stopped using the service, others who are emailing snowden could be identified (the "from" lines the FBI was looking for).
That does not provide a reason for why the gag order should require him from seeking legal advice on the specifics...

TheHammer wrote:A core business model for banks is that they protect money for their customers. But guess what? If the government comes in with a court order to seize or freeze the assets for one of their customers they MUST and DO comply. That hasn't stopped the majority of people from continuing to use banks to deposit their funds.
Except in this case the government attempted to seize assets of every single individual visiting the bank, using a warrant made against a single individual...
TheHammer wrote:Lavabit could absolutely still proclaim to be secure and safe from anyone illegally accessing your data.
Actually, they couldn't. If there is unknown amount of key copies in possession of unknown amount of people working for unknown organizations they cannot make a statement that their customers privates are kept private.

In fact, there is evidence that the organization in question and/or affiliate orgnizations have been unable to keep supposedly private information private either throught incompetence or malice.
TheHammer wrote:But a business model built around the premise that even legal entities, providing search warrants, would be stonewalled when trying to perform their duties, would be an illegal enterprise itself.
Are you thick or what? What exactly makes a business illegal if the authorities first have warrant demanding a literal impossibility and their increased demands include wholesale desruction of the whole companys assets, keeping in mind he cant legally discuss the specifics with his lawyer?
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

NettiWelho wrote:
TheHammer wrote:The only reason to get the SSL keys would be to capture future data transmissions. Again, the data that the FBI was hoping to capture e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox would need to be captured fresh as presumably Lavabits was not keeping logs that they could hand over. That's Lavabit's story anyway.
If that was all the FBI wanted they could have simply demanded Lavabit to temporarily modify couple of lines of code in the system to perform that, no SSL required by the FBI..
They did demand that in the original order and Lavabits refused. I noted this earlier.
TheHammer wrote:If Snowden never logged in, then you're correct there would be nothing to get from that aspect. That's why Lavabits was under a gag order from the court - so that he WOULD continue to use the service thinking his data was "untouchable". However, even in the event that Snowden stopped using the service, others who are emailing snowden could be identified (the "from" lines the FBI was looking for).
That does not provide a reason for why the gag order should require him from seeking legal advice on the specifics...
If the only specifics he wasn't allowed to discuss where the names of the accounts sought, then he still would have been completely able to get the legal advice he needed. At issue was whether or not he would be legally compelled to comply with a court order to hand over the metadata. Who the specific target was, unless it was he himself, would have been irrelevent to his case and unneccessary for his lawyer to know.

I'll also note that we are taking purely his word on what he was and wasn't allowed to share with his attorney.
TheHammer wrote:A core business model for banks is that they protect money for their customers. But guess what? If the government comes in with a court order to seize or freeze the assets for one of their customers they MUST and DO comply. That hasn't stopped the majority of people from continuing to use banks to deposit their funds.
Except in this case the government attempted to seize assets of every single individual visiting the bank, using a warrant made against a single individual...
No, In this case the "bank" refused to hand over the assets requested. At that point the FBI demanded a key to the "armored car" that transported assets to the "bank vault", with the strict intent of only seizing the assets to which they are entitled.
TheHammer wrote:Lavabit could absolutely still proclaim to be secure and safe from anyone illegally accessing your data.
Actually, they couldn't. If there is unknown amount of key copies in possession of unknown amount of people working for unknown organizations they cannot make a statement that their customers privates are kept private.

In fact, there is evidence that the organization in question and/or affiliate orgnizations have been unable to keep supposedly private information private either throught incompetence or malice.
The key in this case could be replaced by a new key once the FBI had gotten what it was legally entitled to get. SSL keys are not permanent and unchangeable, They have expiration dates after all. They can be manually are re-issued at any time.

Your swipe at the supposed "incompetence or malice" of the FBI only reveals your personal bias clouding your judgement.
TheHammer wrote:But a business model built around the premise that even legal entities, providing search warrants, would be stonewalled when trying to perform their duties, would be an illegal enterprise itself.
Are you thick or what? What exactly makes a business illegal if the authorities first have warrant demanding a literal impossibility and their increased demands include wholesale desruction of the whole companys assets, keeping in mind he cant tell the specifics to his lawyer.
No I'm not thick. Unlike you, I just happen to understand the technology and know what the fuck I'm talking about.

What the FBI asked for was not a "literal impossibility". The FBI did not demand the encrypted contents of their mail servers. They demanded the metadata which by virtue of neccessity, Lavabits WOULD have been able to provide had they cooperated. In short, Lavabits could have done exactly what the FBI was intending to do with the SSL keys. They simply refused.

It was also not "wholesale destruction of the whole companies assets". That is hyperbole of the nth degree.

I already addressed the "can't tell specifics to his lawyer" above, but I'll re-iterate here. He might have been forbidden from revealing the specific target of the warrant, but that would not be material to his legal case. The issue was whether or not he had the right to refuse to comply with the court order, the specific target for which the order was issued is irrelevent.
User avatar
White Haven
Sith Acolyte
Posts: 6360
Joined: 2004-05-17 03:14pm
Location: The North Remembers, When It Can Be Bothered

Re: FBI outed in attempt to obtain SSL certificate

Post by White Haven »

No one is arguing that Levinson had a legal right to refuse the initial search warrant under the law. Some, myself included, would argue that he had an ethical and moral responsibility to do so, but having an ethical responsibility to break the law is still breaking the law. Accordingly, the FBI had every right to compel compliance and punish noncompliance, but their escalation to 'destroy your entire business model and compromise the security of four hundred thousand peoples' secure communications' does not in any way follow. Compounding that, the FBI them attempted to hush it all up under pain of further criminal prosecution, which is not something you do when what you're attempting is totally clean and above-board in any sane scenario.
Image
Image
Chronological Incontinence: Time warps around the poster. The thread topic winks out of existence and reappears in 1d10 posts.

Out of Context Theatre, this week starring Darth Nostril.
-'If you really want to fuck with these idiots tell them that there is a vaccine for chemtrails.'

Fiction!: The Final War (Bolo/Lovecraft) (Ch 7 9/15/11), Living (D&D, Complete)Image
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

White Haven wrote:No one is arguing that Levinson had a legal right to refuse the initial search warrant under the law. Some, myself included, would argue that he had an ethical and moral responsibility to do so, but having an ethical responsibility to break the law is still breaking the law. Accordingly, the FBI had every right to compel compliance and punish noncompliance, but their escalation to 'destroy your entire business model and compromise the security of four hundred thousand peoples' secure communications' does not in any way follow. Compounding that, the FBI them attempted to hush it all up under pain of further criminal prosecution, which is not something you do when what you're attempting is totally clean and above-board in any sane scenario.
I guess I don't get the "ethical and moral" objections in this case. I know the tendency is to lump this in with calndestine NSA surveillance but its apples and oranges. There was a warrant issued in this case, and Levinson was able to go before a judge to have his side heard. This would be a perfectly reasonable, and perfectly legal search and seizure in any era...
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

TheHammer wrote:There was a warrant issued in this case, and Levinson was able to go before a judge to have his side heard. This would be a perfectly reasonable, and perfectly legal search and seizure in any era...
Still does not give any legimitacy for keeping demanding SSL keys after Lavabits had agreed to implement the functionality originally requested.
More to the point, nothing brought up so far gives any legimitacy for increasing the demands in the first place.

They should have kept the scope of the demands same just increase the pressure on Levison by actually going after him if he was hindering a legal warrant, not increase the coverage of the warrant to blanket search of 100% of customers.
TheHammer wrote:It was also not "wholesale destruction of the whole companies assets". That is hyperbole of the nth degree.
If the sole asset of you company is the clients trust that what they type is not read by 3rd parties how do you keep operating if there is unknown amount of key copies in possession of unknown amount of people working for unknown organizations?
User avatar
White Haven
Sith Acolyte
Posts: 6360
Joined: 2004-05-17 03:14pm
Location: The North Remembers, When It Can Be Bothered

Re: FBI outed in attempt to obtain SSL certificate

Post by White Haven »

TheHammer wrote:
White Haven wrote:No one is arguing that Levinson had a legal right to refuse the initial search warrant under the law. Some, myself included, would argue that he had an ethical and moral responsibility to do so, but having an ethical responsibility to break the law is still breaking the law. Accordingly, the FBI had every right to compel compliance and punish noncompliance, but their escalation to 'destroy your entire business model and compromise the security of four hundred thousand peoples' secure communications' does not in any way follow. Compounding that, the FBI them attempted to hush it all up under pain of further criminal prosecution, which is not something you do when what you're attempting is totally clean and above-board in any sane scenario.
I guess I don't get the "ethical and moral" objections in this case. I know the tendency is to lump this in with calndestine NSA surveillance but its apples and oranges. There was a warrant issued in this case, and Levinson was able to go before a judge to have his side heard. This would be a perfectly reasonable, and perfectly legal search and seizure in any era...
When you attack someone in defense of a third party (the NSA), you act in support of the third party's actions and agenda. Anyone who has ethical issues with that third party is going to have the same issues with the FBI's actions in direct support of them. Is the warrant legal? Under current law, yes. Is refusing to comply with that warrant legal? No. Is doing so ethical and moral? I certainly consider it so, and apparently so did Levinson.

Does that give the FBI carte blanche to reach vastly, hilarously beyond the scope of the aforementioned warrant instead of simply forcing compliance and/or punishing noncompliance? Fuck no.
Image
Image
Chronological Incontinence: Time warps around the poster. The thread topic winks out of existence and reappears in 1d10 posts.

Out of Context Theatre, this week starring Darth Nostril.
-'If you really want to fuck with these idiots tell them that there is a vaccine for chemtrails.'

Fiction!: The Final War (Bolo/Lovecraft) (Ch 7 9/15/11), Living (D&D, Complete)Image
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Just a note, the reason you're seeing the FBI here and not the NSA, is because the NSA can't enforce law. So it doesn't matter what the NSA did or didn't do, if charges are going to be brought against anybody at the federal level, the FBI are going to run the investigation.
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

NettiWelho wrote:
TheHammer wrote:There was a warrant issued in this case, and Levinson was able to go before a judge to have his side heard. This would be a perfectly reasonable, and perfectly legal search and seizure in any era...
Still does not give any legimitacy for keeping demanding SSL keys after Lavabits had agreed to implement the functionality originally requested.
More to the point, nothing brought up so far gives any legimitacy for increasing the demands in the first place.

They should have kept the scope of the demands same just increase the pressure on Levison by actually going after him if he was hindering a legal warrant, not increase the coverage of the warrant to blanket search of 100% of customers.
Lavabits steadfast refusal to cooperate made any last minute supposed cooperation dubious at best. Their "compliance" in how they provided the SSL key shows you the kind of bullshit run around the FBI was going to get at that point. In an investigation time is of the essence. While being dicked around by Levinson, word could have reached Snowded et al to stop using the service. Lavabit made their bed.

The actual data captured was still within the scope of the warrant. The only data captured was data sent to the intended target, and even then the scope of the warrant only allowed for capturing of the metadata.
TheHammer wrote:It was also not "wholesale destruction of the whole companies assets". That is hyperbole of the nth degree.
If the sole asset of you company is the clients trust that what they type is not read by 3rd parties how do you keep operating if there is unknown amount of key copies in possession of unknown amount of people working for unknown organizations?
Lavabits could have avoided all of this by complying in the first place. But "all wasn't lost" even when they had to give up the SSL keys.

Further, even having the SSL keys isn't enough to crack security. You would also need to be able to intercept the communications before you can decrypt them. http://en.wikipedia.org/wiki/Man-in-the-middle_attack.

But the biggest reason why it doesn't matter if the FBI had the key, I've explained this before, is because THE SSL KEY CAN BE CHANGED. Once the FBI had retrieved its data and device, you had no need to worry about "unknown persons" with "unknown copies of keys". You change the key and you're done.

Their law abiding citizens would have understood that they had to comply with a search warrant. They could explain that their security wasn't defeated, rather they were legally obligated to provide the information. Sure those dealing in illicit activites would probably have fled the site, but then, if your business model is that you'd be a safe haven for illegal communication, then I have no sympathy for you.
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

TheHammer wrote:Lavabits could have avoided all of this by complying in the first place. But "all wasn't lost" even when they had to give up the SSL keys.
There is no scenario that would require FBI to have the SSL keys after Lavabit signaled they were ready to do what the FBI originally requested.
wired wrote:With the SSL keys, and a wiretap, the FBI could have decrypted all web sessions between Lavabit users and the site
TheHammer wrote:Further, even having the SSL keys isn't enough to crack security. You would also need to be able to intercept the communications before you can decrypt them. http://en.wikipedia.org/wiki/Man-in-the-middle_attack.
Mitm is not relevant to this case, thats not they stated they wanted to do.

And they DO have the facilities to capture any traffic they want from their split line input. http://en.wikipedia.org/wiki/Room_641A
They just need to ask NSA for it, who can decrypt it with the key FBI just provided...
TheHammer wrote:The actual data captured was still within the scope of the warrant. The only data captured was data sent to the intended target, and even then the scope of the warrant only allowed for capturing of the metadata.
Sure, FBI officially only gets the data allowed under the warrant, but NSA will siphon it all because it will become a techical possibility.
TheHammer wrote:But the biggest reason why it doesn't matter if the FBI had the key, I've explained this before, is because THE SSL KEY CAN BE CHANGED. Once the FBI had retrieved its data and device, you had no need to worry about "unknown persons" with "unknown copies of keys". You change the key and you're done.
By then its too late, a period of time has passed during which all communications were compromised. And even after changing the key the feds can always get the new one with the same excuse.
TheHammer wrote:Their law abiding citizens would have understood that they had to comply with a search warrant. They could explain that their security wasn't defeated, rather they were legally obligated to provide the information. Sure those dealing in illicit activites would probably have fled the site, but then, if your business model is that you'd be a safe haven for illegal communication, then I have no sympathy for you.
So, you'd have no sympathy for jews if they were rounded up and shot for the crime of being jewish?
Simon_Jester
Emperor's Hand
Posts: 30165
Joined: 2009-05-23 07:29pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Simon_Jester »

Excuse me.

TheHammer, let me ask you a simple, blunt question.

Is there ANY limit on what the FBI can ask for in terms of escalation? Suppose all confidential information in America were stored on a single computer; could the FBI demand that this computer be turned over for the FBI to peruse all of it, at their leisure, under penalty of law, when the warrant-based mandate to do so comes solely from a search for one person's information? Could this be done without any unusual safeguards to hold the FBI responsible for the confidentiality of the information?

Is there an analogous 'no limits' condition in physical space? Can the FBI search adjacent properties not owned by the person named in the warrant, on the grounds that he might have hidden things there? Can they search a whole apartment building because they can't be bothered to find the accused's address? Can they search a whole city, the property of 400000 people, for the personal effects of one man?

What is the limit to a search warrant?
This space dedicated to Vasily Arkhipov
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

NettiWelho wrote:
TheHammer wrote:Lavabits could have avoided all of this by complying in the first place. But "all wasn't lost" even when they had to give up the SSL keys.
There is no scenario that would require FBI to have the SSL keys after Lavabit signaled they were ready to do what the FBI originally requested.
Lavabits already shit in their own bed by refusing to comply with the multiple orders they had been given. The FBI would need to trust that Lavabits was in fact giving them the information to which they were entitled. They had given the FBI no reason to trust that they would do so.

I also find the claim that they were "ready to do what the FBI originally requested" to be dubious at best. I have yet to see any quotes that would lead me to believe they actually were willing to cooperate.
wired wrote:With the SSL keys, and a wiretap, the FBI could have decrypted all web sessions between Lavabit users and the site
TheHammer wrote:Further, even having the SSL keys isn't enough to crack security. You would also need to be able to intercept the communications before you can decrypt them. http://en.wikipedia.org/wiki/Man-in-the-middle_attack.
Mitm is not relevant to this case, thats not they stated they wanted to do.

And they DO have the facilities to capture any traffic they want from their split line input. http://en.wikipedia.org/wiki/Room_641A
They just need to ask NSA for it, who can decrypt it with the key FBI just provided...
Actually MITM is the only way to do it using the SSL keys. Each SSL session generates a random key between the client and the server. You can't just take an SSL key and listen in to web traffic like a telephone conversation. Instead with the SSL key you are able to fool the client into thinking that you ARE the server.

There are other ways to try and attack SSL, but they are far more difficult, less effective, and do not use the SSL key anyway.
TheHammer wrote:The actual data captured was still within the scope of the warrant. The only data captured was data sent to the intended target, and even then the scope of the warrant only allowed for capturing of the metadata.
Sure, FBI officially only gets the data allowed under the warrant, but NSA will siphon it all because it will become a techical possibility.
Not once the SSL key is changed they can't, not to any extent that they couldn't before anyway. Further it would also be illegal for the NSA to siphon data not related to foreign intelligence.
TheHammer wrote:But the biggest reason why it doesn't matter if the FBI had the key, I've explained this before, is because THE SSL KEY CAN BE CHANGED. Once the FBI had retrieved its data and device, you had no need to worry about "unknown persons" with "unknown copies of keys". You change the key and you're done.
By then its too late, a period of time has passed during which all communications were compromised. And even after changing the key the feds can always get the new one with the same excuse.
So? They are a law enforcement agency who are pursuing their legal duty. If they get another warrant for another suspect down the road, then maybe Lavabits or the next company will be a little quicker to comply with the order.
TheHammer wrote:Their law abiding citizens would have understood that they had to comply with a search warrant. They could explain that their security wasn't defeated, rather they were legally obligated to provide the information. Sure those dealing in illicit activites would probably have fled the site, but then, if your business model is that you'd be a safe haven for illegal communication, then I have no sympathy for you.
So, you'd have no sympathy for jews if they were rounded up and shot for the crime of being jewish?
Wow... :roll: I'm not going to bother with any sort of drawn out reply to your moronic statement.
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

Simon_Jester wrote:Excuse me.

TheHammer, let me ask you a simple, blunt question.

Is there ANY limit on what the FBI can ask for in terms of escalation? Suppose all confidential information in America were stored on a single computer; could the FBI demand that this computer be turned over for the FBI to peruse all of it, at their leisure, under penalty of law, when the warrant-based mandate to do so comes solely from a search for one person's information? Could this be done without any unusual safeguards to hold the FBI responsible for the confidentiality of the information?
You're sliding down that slippery slope to Tinfoilhat-ville Simon... Your hypothetical is so far out of bounds for reality that I really can't even think of a way to respond to it. So I'm going to circle back to this particular real life example as to why this notion of "no limits" isn't grounded in reality...
Is there an analogous 'no limits' condition in physical space? Can the FBI search adjacent properties not owned by the person named in the warrant, on the grounds that he might have hidden things there? Can they search a whole apartment building because they can't be bothered to find the accused's address? Can they search a whole city, the property of 400000 people, for the personal effects of one man?

What is the limit to a search warrant?
I don't know what your technical background is, but I'll try to adapt your analogy to explain. The FBI is not asking for the right to search 400,000 people's property. The FBI has asked for, and has been granted the right to search one man's property. They know where he lives. However this man happens to live in an extremely secure "appartment building" with 400,000 other people. This apartment building has just one master key to get in to the building. The FBI can not get in to this building without that key, and the building management has refused all requests for cooperation. Thus they have asked a judge to order that key be given to them, with the explicit understanding that once inside the building they are only to search the appartment they are entitled to search. They will be on the lookout for anyone going to and from the one apartment they are watching, however the remaining 399,999 people will be allowed to come and go as they please without search or interruption.

I want to emphasize this one more time:
“We can assure the court that the way that this would operate, while the metadata stream would be captured by a device, the device does not download, does not store, no one looks at it,” Trump said. “It filters everything, and at the back end of the filter, we get what we’re required to get under the order.”

The word "capture" is a bit of a misnomer here. The data actually passes through the device. Essentially, in our hypothetical apartment building scenario, the FBI has replaced Lavabits as the "doorman". While this doorman is on the lookout for and will intercept its target, for everyone else it merely opens the door and nothing else.
“So there’s no agents looking through the 400,000 other bits of information, customers, whatever,” Trump added. “No one looks at that, no one stores it, no one has access to it.”

“All right,” said Judge Hilton. “Well, I think that’s reasonable.”
The limit of the search warrant is that they can only view the information on the target. Without that assurance, I highly doubt the judge would have approved their request.
bilateralrope
Sith Acolyte
Posts: 6199
Joined: 2005-06-25 06:50pm
Location: New Zealand

Re: FBI outed in attempt to obtain SSL certificate

Post by bilateralrope »

Further it would also be illegal for the NSA to siphon data not related to foreign intelligence.
Just like it's illegal for NSA staff to spy on loved ones. Or lying to congress.

Why do you think the NSA cares about the law when they can break it without punishment ?
Post Reply