News for hackers. Stuff that matters.
Re:Lavabit gets new crypto key, gives users 72 hours to reco... by FiloSottile on Tuesday October 15, 2013 @06:05PM (#6556688)
> Since the SSL certificates formerly used to protect access to Lavabit have been compromised, we recommend manually validating the serial number and fingerprint your computer received before using this website. [https://liberty.lavabit.com/]

What? If an active attacker is changing certificates on the fly, he's also surely able to change the values in the HTML content of the page.

This will add absolutely no security for the users, only false sense of security via complex-looking measures, and he should know this.

Re:Lavabit gets new crypto key, gives users 72 hours to reco... by sil3ntmac on Tuesday October 15, 2013 @07:50PM (#6557143)
Hopefully liberty.lavabit.com uses a new uncompromised cert?
Re:Lavabit gets new crypto key, gives users 72 hours to reco... by FiloSottile on Tuesday October 15, 2013 @11:03PM (#6557795)
The point is that if it is uncompromised we are safe, if it isn't writing the fingerprint in the HTML will be of no help at all.
Re:Lavabit gets new crypto key, gives users 72 hours to reco... by dublinben on Tuesday October 15, 2013 @10:32PM (#6557687)
Presumably, but not an EV one. It might as well have been generated by the NSA at this point, for all we know.