Lavabit email service was never that secure to begin with
Share on Twitter.
Get the most reliable SMTP service for your business. You wished you got it sooner!
November 9, 2013
Former Lavabit CEO Ladar Levison claims that its new Dark Mail initiative he's brewing up with a team from Silent Circle
will enable email service that's virtually spy-proof.
However, according to at least one expert, the original Lavabit email service was never all that secure to begin with, contrary
to what Lavabit had claimed in the past.
Internet security expert Moxie Marlinspike wrote in a blog post this week-- "How is it possible that a service which wasn't supposed
to have access to its users' emails found itself in a position where it had no other option but to shut down in an attempt to avoid
complying with a request for the contents of its users' emails?"
Marlinspike does have a good and valid point. The main issue with Lavabit's original design, according to him, is that each Lavabit
user's private encryption key was stored on the Lavabit server.
The key was itself encrypted with a password, that's true. But every time a user wanted to read an email, that password needed
to be transmitted to the server, essentially negating any kind security.
"But unlike the design of most secure email servers, which are ciphertext in and ciphertext out, this is the inverse-- plaintext
in and plaintext out," Marlinspike wrote. "The server stores your password for authentication, uses that same password for an encryption
key, and promises not to look at either the incoming plaintext, the password itself, or the outgoing plaintext, but all of this password
traffic can still be viewed in plaintext by anybody."
Those "promises," Marlinspike says, are essentially worthless, and most security experts we spoke to agree. For one thing, because
Levison was in possession of every user's private key, all he would need to do to read your Lavabit email is intercept your password as
it came into his server, use it to decrypt your private key, then use the private key to decrypt your e-mail.
This is essentially what the Lavabit server did anyway-- Levison just claims he never eavesdropped, but can you believe everything
he says now?
But even if he never did, and no one is suggesting he did in the first place, any attacker or a disgruntled employee who gained
access to the Lavabit system might not have been so scrupulous.
"The whole cryptography was nothing more than a lot of overhead and some shorthand for a promise not to peek into your messages," Marlinspike
"Even though Lavabit advertised that they can't read your email, what they meant was that they would choose not to," he added.
Finally, an attacker that found a method to eavesdrop the communications between the mail server and the client would effectively
negate all of the security mechanisms on the Lavabit server.
The security encryption itself, the passwords, the keys-– none of it would really matter to an attacker with the ability to eavesdrop
in over the internet cable, who would be able to obtain the user's password and unlock all of the rest.
Marlinspike says that his criticisms of Lavabit aren't intended as attacks on Levison, but he does worry that the current effort
to release the Lavabit code as an open source project will just lead to further vulnerable email services that pretend to be secure
but that in fact are not.
"I think we should support Ladar for making the hard choice that he did to at least speak out and let his users know they'd been
compromised," he wrote. "But I still think that we should simultaneously be extremely critical of the technical choices and false
guarantees that put him in that position in the very first place. It's my belief that the whole thing could have been prevented had
the service been truly secure, and Lavabit would still be in business."
We tried three times to contact Levison for some comment on these matters, but our emails have bounced as undeliverable.
In other IT news
You can call it what you want: a very secret research project, a floating data center or a classified work assignment, but since last Thursday,
what looks like a three-story building resting on two barges have been spotted by everybody in the bay of San Francisco, and Google
has confirmed it's the owner of the barges.
And up until today, nobody seemed to know what the barges were to be used for, but now Google has shed a bit of light on just what
it intends to do with them.
The company says that its two vessels, officially known as The Google Barges, will in fact be designed to serve as nautical showrooms
for the company's latest and greatest products.
"Although it's still very early to tell and things may change, we’re exploring using the barges as an interactive space where
people can learn about new technology," Google added.
The statement more or less ends widespread speculation on what Google was aiming to do with the barges. Spotted floating in the waters
of the San Francisco Bay on October 31, the mystery ship drew attention from the public and authorities alike.
Then a second ship was soon brought to the waters off of coastal Maine. Google's mysterious seaborne barges had been theorized to
be anything from floating nightclubs to covert research and storage units to the (accurate) consensus belief that the units would function
as moving demonstration venues for the company's hardware projects.
Others initially believed they were floating data centers. Google has no shortage of shiny new toys to show off on the nautical
The company is continuing to push its Glass platform to developers and a fresh crop of Android devices would benefit greatly
from an expansive environment in which hardware features and services could be demonstrated.
Google is remaining tight-lipped on whether more barges would be deployed or if the current pair would be moved to locations
around the globe.
In other IT and technology news
IBM has expanded its footprint in the big data segment with the launch of a new SmartCloud analytics tool this week, urging customers
on its SmartCloud Enterprise System to step up their migration efforts.
SmartCloud Analytics – Predictive Insights, to give it its rather long-winded title, is designed to let organizations search
through their IT operations' data and select the trends most critical to network performance, IBM said.
It apparently uses “cognitive computing capabilities”-– an IBM buzzword often attached to its Watson AI system – to better
understand a customer’s IT set-up and adapt and update according to business and performance changes.
The new analytics offering will run on the SoftLayer public cloud infrastructure IBM acquired just 2 1/2 months ago.
Last week, IBM told users of its home-baked public cloud, SmartCloud Enterprise, they’d have until January 31, 2014 to migrate
SmartCloud Enterprise vice president Dennis Quan said at the OpenStack Summit in Hong Kong today that enterprise customers
should take advantage of IBM’s offer of free migration through Racemi and self-service tools.
“Racemi features a combination of technology as well as expertise and depth of experience in doing this so we really engaged
a top provider in helping our customers do these transitions and migrations,” he gushed.
“The idea is that we provide customers with options with partners like Racemi as well as self-service tooling and documentation
to help them transition to what we think is a superior and more strategic platform.”
Quan said that Big Blue could help with “more involved transitions and workload moves” as well, although these fall outside of
the free tools and support described above.
Source: Moxie Marlinspike.
Get the most dependable SMTP server for your company. You will congratulate yourself!
Share on Twitter.
Need to know more about the cloud? Sign up for your free Cloud Hosting White Paper.