Lavabit Case Unsealed: FBI Demands Companies Secretly Turn Over Crypto Keys 527
jest3r writes "Lavabit won a victory in court and were able to get the secret court order [which led to the site's closure] unsealed. The ACLU's Chris Soghoian called it the nuclear option: The court order revealed the FBI demanded Lavabit turn over their root SSL certificate, something that would allow them to monitor the traffic of every user of the service. Lavabit offered an alternative method to tap into the single user in question but the FBI wasn't interested. Lavabit could either comply or shut down. As such, no U.S. company that relies on SSL encryption can be trusted with sensitive data. Everything from Google to Facebook to Skype to your bank account is only encrypted by SSL keys, and if the FBI can force Lavabit to hand over their SSL key or face shutdown, they can do it to anyone."
Should the US still be in charge of the internet? (Score:5, Interesting)
Go ahead, mod me troll. But given the recent revelations, how can we claim to be any better than even the fucking UN at this point? I've made a complete u-turn on this issue, and it scares the crap out of me that I would have continued to defend the US as the savior and guardian of the open and free internet if it wasn't for a single guy leaking some stuff. And we can't even push something as simple as net-neutrality regulations through without it becoming a horrible political mess.
Fuck this government and its institutions and fuck the people that support it.
So much for narrow scope (Score:4, Interesting)
Groklaw/PJ (Score:2, Interesting)
Was this the thing PJ said she couldn't reveal but would cause anyone to distrust email?
Re:Why? (Score:2, Interesting)
If you read the article, they demanded the SSL key since Lavabit did not comply with the earlier order. All the Feds originally wanted was metadata for one user. Lavabit could have provided that, but refused. The prosecutors asked they be held in contempt of court, and then asked for the SSL keys. This is on Lavabit.
Edward Snowden’s E-Mail Provider Defied FBI Demands to Turn Over Crypto Keys, Documents Show [wired.com]
“The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system,’” the government complained.
U.S. Magistrate Judge Theresa Buchanan immediately ordered Lavabit to comply, threatening Levison with criminal contempt — which could have potentially put him in jail.
By July 9, Lavabit still hadn’t defeated its security for the government, and prosecutors asked for a summons to be served for Lavabit, and founder Ladar Levison, to be held in contempt “for its disobedience and resistance to these lawful orders.”
A week later, prosecutors upped the ante and obtained the search warrant demanding “all information necessary to decrypt communications sent to or from the Lavabit e-mail account [redacted] including encryption keys and SSL keys.”
Re:Why? (Score:5, Interesting)
Actually, they did not have access to the site (that would have been overly broad and unconstitutional), but lavabit was forced by the court to install a packet dumper. So FBI had the full encrypted streams of all user sessions. FBI then requested the SSL key that would unlock all stored streams. The court reasoned that because the site uses a single SSL key for all users, that's lavabit's fault and agreed that the request is not overly broad.
Luckily there's a simple technical fix for this: perfect forward secrecy in HTTPS, using RSA DiffieHellman or ECDH key exchange. The encryption key is ephemeral and the SSL private key cannot be used to perform a passive attack on the sniffed. FBI/NSA is forced to perform a MIM on the very sessions they target; if done on the scale of the whole internet, this would be easily detected.
All HTTPS servers should ship with this cypher suite as the default.
Re:What moron judge allowed this? (Score:5, Interesting)
update (Score:5, Interesting)
UPDATE 7:00pm CT: In a press release published on his Facebook page, Levison confirmed the unsealing and laid out his defense.
“People using my service trusted me to safeguard their online identities and protect their information. I simply could not betray that trust," he said. "If the Obama administration feels compelled to continue violating the privacy rights of the masses just so they can conduct surveillance on the few then he should at least ask Congress for laws providing that authority instead of using the courts to force businesses into secretly becoming complicit in crimes against the American people. http://arstechnica.com/tech-policy/2013/10/lavabit-defied-order-for-snowdens-login-info-then-govt-asked-for-sites-ssl-key/
Re:https (Score:5, Interesting)
Your favorite site also bans random TOR exit nodes from browsing it. I can understand banning posting to prevent spam and such, but browsing ? That's just moronic. It also craps when the IP of the user changes during editing/posting.
Slashdot, please get on with the times, you are probably the legal site most visited by TOR users. You need to add HTTPS and improve TOR support.
Re:Why? (Score:5, Interesting)
The best part is they said here that they wanted the "Root Certificate", which would allow them to sign new keys. Caveat: that's just a trust model, allowing them to replace LavaBit's SSL key. What they wanted was LavaBit's site SSL private key.
Let's say that the NSA got the Verisign Root Certificate and started using it to sign Verisign CSRs. A CSR includes the public key (certificate), but not the private key. The public key is already known. The NSA gains ... nothing.
Now if they get the Google Gmail SSL private key, they can decrypt the SSL session handshake and key exchange. The key exchange exchanges a symmetric encryption key for AES or RC4 (yes RC4 is secure; yes I know it's used in WEP, which uses a new NONCE for every packet, and in their implementation they generate insecure NONCE/IV pairs and you can collect millions of these and crack it. Not applicable here). With Gmail's SSL private key, the NSA can decrypt the symmetric session key exchange and use that key to decrypt your session and read your e-mail.
That's the difference.
Certificate Authorities compromised? (Score:5, Interesting)
Re:What moron judge allowed this? (Score:5, Interesting)
I got no mod points, but this is absolutely the takeaway.
The US depends on it's software industry; we shipped all our labor jobs overseas to trade them for office work (programming). That, and Hollywood, is why we're so mean to other countries over IP.
And now the US government has completely undermined them. It's probably a good time to be a programmer in Brazil and Germany. I wonder If our software industry will be able to recover from this.
Comment removed (Score:5, Interesting)
Re:Contribute (Score:4, Interesting)
It's interesting that Americans have a choice to contribute a few bucks to this defense... while having apparently no choice about the amount they are paying for the prosecution.
Re:Why? (Score:4, Interesting)
In my humble and non-judgely opinion, the fact that Lavabit would have had to defeat its own security means that the original decision that allowed collection of metadata without a warrant supported by facts (Smith v. Maryland) should not apply to this case and the government should have had to articulate facts that led to reasonable suspicion in order to obtain a warrant to get metadata from Lavabit.
Re:Nothing left to do (Score:5, Interesting)
And if you get one of these national security letters or other absurd warrant from the feds, publish it. The right of the press to publish otherwise classified material was affirmed in the 1971 case New York Times Co. v. United States, although that was a pretty weak ruling. But unless you've agreed to keep something secret, you're theoretically free to do with it as you like. Also, I'm not a lawyer and you shouldn't take your legal advice from the internet.
Re:Nothing left to do (Score:4, Interesting)
Yes, the U.S. has the equivalent to parliamentary privilege, and it's been used in living memory rather famously. During the Vietnam War era, Mike Gravel, a Senator from Alaska, included the Pentagon Papers [wikipedia.org] into the Congressional Record, meaning they were then publicly available. He was protected by Article I, Section 6 of the Constitution, which among other things says about members of Congress that "for any Speech or Debate in either House, they shall not be questioned in any other Place." ("Speech" includes inclusions into the Congressional Record.)