See below, Lavabit not a good comparison as it was not end-to-end encrypted. Also read https://arstechnica.com/information-technology/2013/11/op-ed...

Thanks for the information.

One similarity between Lavabit and Skiff is that tptacek calls them both non-end-to-end encrypted.

It's very simple. One of them had access to user's private keys (Lavabit).

One never has access to user private keys (Skiff).

I don't understand how you don't have exactly the same access they did. I feel like I've invested a fair bit of time to understanding how this stuff works, and the story you're telling doesn't make sense. What am I missing?

What amilich said is correct. However, what he is leaving out is that both have access to unencrypted email at send and recieve time, so you are taking Skiffs word that they dont log emails - since you have to trust the server this is not e2ee.

Lavabit is the one that used user passwords to encrypt the messages, thus ensuring that they had access to all the necessary secrets to decrypt user messages any time the user was viewing them?

And that had complied previously with US government subpoenas to provide metadata and data for users?

+1

Isn't that what you're Skiff is doing too? It seems like it's just the Lavabit design with a some 2010 cryptography layered on top.

No. Lavabit had fundamental flaws where passwords were sent to the server so anyone who could decrypt the HTTPS traffic could basically access the content [1].

Skiff's password mechanism actually solves this flaw cryptographically using known, established primitives.

We use argon2id to take password and turn it into two cryptographic keys. One key is used for an SRP scheme to prove you have the password in a signing flow that bootstraps session management. The other key is actually the data encryption key. These keys are never sent to Skiff's servers and this generation happens all in the browser.

Lavabit really failed fundamentally in having actual end to end encryption because the password was sent to the server.

[1] https://arstechnica.com/information-technology/2013/11/op-ed....

That's all moot though, since your server has access to plaintext emails when sending and recieving (99.99999% of email addresses would be outside skiff), which completely subverts the whole point of encryption. A vulnerability on the server could leak all user emails, without needing their keys.... This is a solution theoretically only as strong as encryption at rest.

>And that had complied previously with US government subpoenas to provide metadata and data for users?

Interesting. Link? Are you talking about this article? https://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits...

It seems to be talking about metadata, not data.