Re:Lavabit gets new crypto key, gives users 72 hours to reco...
by sneak on Tuesday October 15, 2013 @08:28PM
(#6557289)
Forward secrecy in this instance does not matter one bit.
Presuming they've imaged the drives with their encrypted mail, all they'd have to do is a half-dozen line patch to the code to log the passwords to disk as they come in.
Then they can decrypt everyone's private keys, and decrypt everyone's mail, PFS or no.
Anyone sending their Lavabit password outside of their own home is simply asking for someone else to decrypt and read their email.
If I had been a Lavabit customer, I would see this cipher suite as him saying-without-saying that this service is suspect and is to be avoided at all costs.
Presuming they've imaged the drives with their encrypted mail, all they'd have to do is a half-dozen line patch to the code to log the passwords to disk as they come in.
Then they can decrypt everyone's private keys, and decrypt everyone's mail, PFS or no.
Anyone sending their Lavabit password outside of their own home is simply asking for someone else to decrypt and read their email.
If I had been a Lavabit customer, I would see this cipher suite as him saying-without-saying that this service is suspect and is to be avoided at all costs.