Hacker News new | ask | show | jobs
by curun1r 3434 days ago
If Edward Snowden started a mail service, I'd probably trust it more. If you want to talk about "going to the mat" for people, I think Snowden has made the bigger sacrifice.

Moxie and Whisper Systems probably would get my nod too. Perhaps even DJB or Bruce Schnier.
2 comments
nommm-nommm 3434 days ago
Moxie is not impressed with lavabit as lavabit's entire security model relied on "we totally promise we won't look at your private key."

https://moxie.org/blog/lavabit-critique/

>Unlike the design of most secure servers, which are ciphertext in and ciphertext out, this is the inverse: plaintext in and plaintext out. The server stores your password for authentication, uses that same password for an encryption key, and promises not to look at either the incoming plaintext, the password itself, or the outgoing plaintext.

>The ciphertext, key, and password are all stored on the server using a mechanism that is solely within the server’s control and which the client has no ability to verify. There is no way to ever prove or disprove whether any encryption was ever happening at all, and whether it was or not makes little difference

Anyways, having good inventions doesn't equal having a secure product.

link
ycmbntrthrwaway 3433 days ago
This one is about old Lavabit. It equals "trustful mode" of the new Lavabit.
link
simplehuman 3433 days ago
Moxie is not impressed with anything other than signal
link
pvg 3433 days ago
He lists two projects unrelated to Signal in the article. There is no mention of Signal.
link
pvg 3434 days ago
Snowden is not a security expert nor a cryptographer. He used Cryptocat and Lavabit, for instance - he was (like most people) unable to independently assess the quality of their security guarantees and believed their claims.
link
nyolfen 3433 days ago
he has said that he used pgp in his emails with poitras and greenwald because he knew from personal experience that, properly implemented, nsa was unable to decrypt messages protected with it
link
pvg 3433 days ago
Are you saying he didn't use Lavabit and Cryptocat?
link
ycmbntrthrwaway 3433 days ago
He used PGP over Lavabit. So even though Lavabit was compromised, content of his emails is secure.
link