
Lavabit's founder: 'If You Knew What I Know About Email, You Might Not Use It' - DanielRibeiro
http://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/
======
kintamanimatt
For those without showdead on, there's an insightful comment from beedogs:

My guess (and he intimates this in his comment about backdoors in Chinese
products) is that the US government asked him to basically break his entire
system so they could do MitM attacks.

The conversation probably went something like this:

    
    
        USG: Install this machine in your datacenter.  Route all traffic through it.  
        Accept installation of this new fiber demarc and allow us access to 
        configure this new router.  You do not need to know where this 
        traffic is going.  If you refuse, we'll slap you with a contempt order 
        and throw you in federal prison.  If you tell anyone about this, we will 
        slap you with a contempt order and throw you in federal prison.
        
        LL: Get fucked.  I'll shut everything down instead.
    

\-----

Why beedogs is shadowbanned is beyond me. A quick glance through his comment
history doesn't indicate he's done anything to deserve it.

\----

Hey beedogs: I can't reply to you directly because you're hellbanned. Send an
email to PG. I'm not usually a fan of posting people's contact information,
but in this case it's everywhere anyway - pg [at] ycombinator.com

~~~
phpnode
replying to beedogs because I can't directly:

You made this post
[https://news.ycombinator.com/item?id=6183189](https://news.ycombinator.com/item?id=6183189)
and one of the admins arbitrarily decided that you needed silent punishment.
nice eh?

~~~
kmfrk
That trademark HN moderation at work.

beedogs, you can probably send an e-mail to the powers that be to restore your
account. If they won't, then at least you've got a new story worth sharing.

~~~
jusben1369
There is a fair bit of irony at play huh? All content being observed.
Punishment dishes out arbitrarily and without explanation. Liberty (speech)
curtailed. And this is one of the favorite platforms for pro Snowden
discussions!

~~~
mpyne
And all because of a legitimate policy goal of preventing the destruction of
an insightful commenting community due to the chaos that would ensue if
unrestrained posting were always allowed.

Ironic indeed.

~~~
jusben1369
Right. To those who support the policies they make total sense. Without them
there'd be unknown chaos. Good add.

~~~
dasil003
For the umpteenth time, moderation is not censorship. HN is akin to a private
club not a country that you are born into forced to live in. And furthermore,
the chaos is anything but unknown. It is mob/troll rule ala
slashdot/reddit/4chan and every other online community that grows beyond a
critical mass.

~~~
jusben1369
To Censor: to examine in order to suppress or delete anything considered
objectionable.

So this is censoring speech. They have the _right_ to do it as they're a
private entity. But don't confuse their right to censor with the definition of
censorship. I see that happen a lot.

------
beedogs
My guess (and he intimates this in his comment about backdoors in Chinese
products) is that the US government asked him to basically break his entire
system so they could do MitM attacks and ship unencrypted communications
directly to the NSA.

The conversation probably went something like this:

    
    
        USG: Install this machine in your datacenter.  Route all traffic through it.  
        Accept installation of this new fiber demarc and allow us access to 
        configure this new router.  You do not need to know where this 
        traffic is going.  If you refuse, we'll slap you with a contempt order 
        and throw you in federal prison.  If you tell anyone about this, we will 
        slap you with a contempt order and throw you in federal prison.
        
        LL: Get fucked.  I'll shut everything down instead.
    

The truly terrifying thing about this scenario is that they're likely already
doing this elsewhere on a huge scale.

~~~
sneak
It's called PRISM.

~~~
uxp
For the umpteenth time, PRISM is just a database, it's not the program that
siphons data from all the telcos. PRISM only contains data that is retrieved
via NSLs, Subpoenas, warrants, cooperating parties and possibly data siphoning
if it's found useful and has been tagged/organized.

If we want to fight the government on this, we'd better know what we're
fighting against.

~~~
ynniv
Really? The first thing that pops into your head is to argue _terminology_?

~~~
PhasmaFelis
It's not terminology, it's basic ignorance about what the government is doing
and how. You can't fight NSA snooping on any level if you think that they're
sticking a vacuum hose into your server and siphoning out all the bits. These
details are important.

~~~
ynniv
No one in this thread suggested that the NSA is copying data out of servers
except you. It has been reported that they are wholesale tapping
communications lines, and trying to collect SSL private keys, so Sneak's
sentiment is not wrong. To argue terminology is to play their game, which they
are good at and we will lose. If you disagree with something on a factual
level, say that instead.

~~~
PhasmaFelis
Here's an example of why understanding the NSA's terminology is important:

[https://www.eff.org/deeplinks/2013/08/guide-deceptions-
word-...](https://www.eff.org/deeplinks/2013/08/guide-deceptions-word-games-
obfuscations-officials-use-mislead-public-about-nsa)

If a reporter asks a government stooge if the NSA engages in bulk collection
of Americans' data, the stooge can say no with a straight face because the NSA
has officially defined "bulk collection" to mean something other than
"collecting in bulk." In order to carve through their lies, we _need_ to be
able to understand and navigate their twisted terminology.

------
ibejoeb
Zimmermann on the shut-down and elimination of Silent Circle email: "It’s not
obstruction of justice if you do it before justice comes calling."

I'm sure he and his lawyers aware, but we've got this cool new thing called
Anticipatory Obstruction. It'd probably be a pretty far reach, but stranger
things have happened. See
[http://www.perkinscoie.com/files/upload/LIT_11_06FunkFeature...](http://www.perkinscoie.com/files/upload/LIT_11_06FunkFeatureMay.pdf).

~~~
greenyoda
From the URL that ibejoeb posted above (italics are mine):

Unceremoniously titled “Destruction, Alteration, or Falsification of Records
in Federal Investigations and Bankruptcy,” and part of § 802 of the Sarbanes-
Oxley Act of 2002, § 1519 provides:

Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies,
or makes a false entry in any record, document, or tangible object with the
intent to impede, obstruct, or influence the investigation or proper
administration of any matter within the jurisdiction of any department or
agency of the United States or any case filed under Title 11, or _in relation
to or contemplation of any such matter or case_ , shall be fined under this
title, imprisoned not more than 20 years, or both.

~~~
ibejoeb
That's absolutely the best part, and that's why Zimmermann's comment almost
seems naive. "...before justice comes calling" is exactly what they're talking
about here. What is contemplation, and when does it begin?

I learned from Hanni Fakhoury of EFF that a proposed defense in this kind of
action is to have had in place a strict data retention policy. For example,
prior to beginning operations, the policy would state something like "we will
retain all data aged 6 weeks or less; older data will be destroyed." Now, you
adhere to that policy, perhaps with some activity record around the procedure
itself, and your argument is something like, "it is not obstruction and not
anticipatory obstruction because we defined and abided by the policy before
anything happened, before any event warranting an investigation could occur,
and, therefor, before _contemplation_ of an investigation could occur."

~~~
Amadou
I could swear I read an article a couple of years ago about a wall street bank
losing an obstruction charge specifically because of an email retention policy
just like you described.

Bigger picture, we all know that the reason companies implement email
retention policies is to minimize the risk of the discovery process in any
potential lawsuit - practically the cost of storage is nil so any savings
there is a drop in the bucket. The policies are huge productivity killers for
all employees -- everyone I know who has worked under such conditions has had
at least one case where they needed information from an expired email that
they had not personally archived. The only reason for a company to shoot
itself in the foot with a policy like that is because it is easy to imagine a
one-shot potential million dollar liability loss compared to the essentially
unmeasurable productivity loss spread across the entire company on a daily
basis.

------
malandrew
Once you've been contacted the first time under an NSL letter, what stops you
from choosing to broadcast the entire duration of the ordeal.

government: "Here's an NSL." recipient: "Cool deal. I will respect it and not
mention it to anyone, but be aware that from this point forward I will always
have a device that will broadcast every interaction verbal or electronic that
anyone has to me publicly live in real-time to the Internet. You have the
right to remain silent. Do you understand? Anything you say may be used
against you in the court of public opinion. Do you understand? If you wish to
continue to communicate with me, be aware that any statement that you or
anyone from your office makes to me will instantly and irreversibly become
part of the public record."

On top of that you can hand them a special email address for their use only
and you can delete your own personal email. You can also wear a shirt with
friends and family that informs them in big bold letters that everything is a
matter of the public record.

This would essentially serve to shield you entirely from secret communication
by placing a "force field" of publicity around you. There might be some law
somewhere that prohibits this tactic, I cannot imagine how they would
counteract this tactic legally so long as you always greet them with
disclosure that your are recording everything. I imagine that they could try
to force you somehow to interact with them in a location that prohibits
recording devices.

~~~
nilved
Courts are made of people, not computers; and they care about the bottom line,
not the reasoning behind the loophole. What you describe -- and every other
thought experiment, like warrant canaries -- is a good way to spend the rest
of your life in jail for contempt of court.

If you get an NSL, shut down your business and leave the country.

~~~
hluska
> If you get an NSL, shut down your business and leave the country.

This sentence (and the fact it is so hard to argue with) is one of the most
chilling things I've read this year. Great work! (I guess?)

------
mtgx
He should contest the NSL gag orders. They've already been declared
unconstitutional at least 3 times, but they managed to trick the justice
system by changing a few random words in the law (with the help of Congress),
in effect creating a "new" law that was wiped clean of any
"unconstitutionality" ruling.

The NSL is still unconstitutional in principle, it's just that it needs to be
contested every time they change the law to escape the ruling. Hopefully this
time Congress will stop playing along and creating new laws for them.

Watch this and you'll get it:

[https://www.youtube.com/watch?v=eT2fQu50sMs](https://www.youtube.com/watch?v=eT2fQu50sMs)

~~~
a3n
Kind of like how pharma companies change a tiny little thing about a drug at
the end of its patent term, and then have an entirely "new" patented drug to
sell.

------
Keyframe
Maybe it's time for a new type of email service. Something along the lines of
two way auth, private key on cell phone, public on server. Cell phones have
cameras now, so you could generate a QR code or something which your auth app
could look at and generate a response in order to generate a unique token to
gain access to your message(s). On the server side guys could have a deadman
switch which would purge all data if not heard from administrators for 12
hours. That way they could delete data and not be in jeopardy of obstructing
any government or whomever is seeking to gain access. Bonus points could be
had for not hosting in US too.

~~~
sigkill
The whole problem with email is the asynchronous thing.

You want to be secure, then it needs to be in such a way that there's minimum
reliance on a central server. But in that case, what happens if your local
machine (which is both _your_ mailserver and an end client) is offline? Should
the email bounce around in the network (like bitmessage does)? Or should you
notify the sender with the standard "Mail Subsystem Delivery failure" that we
all know and love.

Actually after reading this, I want to seriously sit down and write a spec but
if I include the assumption that there is a chance for the end-
server/recipient to be offline, it throws everything into chaos.

~~~
samstave
How about a client that does the following, but still uses email: A secure
attachement creation client.

You type your email into the app, which is just a word processor. When you
send it - it saves an encrypted attachment, attaches it to the message and
sends via email.

The other party will need the client to read the attachment, and their client
will need to connect to a secure central ID entity to confirm they are the
recipient client which can open the message.

~~~
sigkill
This is something which I did not think. It's basically like sending
truecrypted packets between people. But this doesn't solve one problem -
metadata. I still know you sent an email at time X to person P2. Tor's method
of onion routing looks quite nice though.

~~~
josho
Ok, what about a new email spec. That as a part of it sends random noise at
random intervals. This makes it hard to determine if you actually sent a mail,
or if it was just the noise part of the spec. ...

Wait, that's so wrong. Why don't we just fix our laws. ...

Wait, we will always have bad actors or regimes, do we just design for that?

~~~
saraid216
When you're worried about things at this level, laws are just an external
dependency not under your control, i.e. a security hole waiting to be
exploited.

------
gst
There are already some existing Bitmessage gateways such as
[http://bitmsg.cc/](http://bitmsg.cc/). Looks like using something like this
would be a better solution for a Lavabit-successor: Use a secure messaging
protocol and then only use gateways to send messages between the traditional
email world and your own secure protocol.

Of course, the gateway could still log your messages, but the same security
issue applied to Lavabit. The main advantage is that once the gateway has
forwarded your message, no one can force the operator to retroactively decrypt
the message.

Bitmessage sounds like one potential solution for this, but it has some
scalability issues. Using RetroShare would be another approach.

------
mvkel
So why doesn't he share with everyone? If he's willing to shut down his
service in the spirit of security, why not expose details in the spirit of
transparency? I can't imagine all of it would be subject to a lawsuit.

~~~
alan_cx
Well, presumably because he doesn't want to end up in jail or Russia.

I very appreciate his actions, what he has felt able to say publicly and his
dilemma in general. Part of me wants to call him a coward, but I can not say I
would do better. I can't criticize. What this does show is how brave and
"heroic" people like Snowden, Bradley, and the like really are.

What would be interesting is to see if he tries to get his story heard via
routes acceptable to government, and if so, what happens.

~~~
icambron
Right. Snowden's path was a brave one, but that kind of martyrdom can't
reasonably be _expected_ of anyone.

------
chmike
What is problematic with mail ? It's because it's in clear text most of the
time and easy to tap with MITM attack?

What about an alternate messaging system addressIng these issues ?

~~~
kintamanimatt
Email is more or less sent in clear text for a significant portion of its
journey in most cases.

    
    
        Sender ----> SMTP ---*unencrypted*---> SMTP ----> Recipient
    

I'm leaving out a lot of transport detail for brevity, but that's the essence.

Also, email is generally stored unencrypted at rest. Even if you take
precautions to secure your own mailbox, the recipient might just have it
floating around in plain text in their Gmail account, just waiting for it to
be nabbed by whoever can get a court order, or whatever.

Also, even if your email is encrypted, the metadata isn't. So you can figure
out who is talking to whom, when, and usually from where (by the IP address).
Also, there are a lot of headers indicating details about your computer (if
you used a fat client rather than webmail), such as the user-agent header
which indicates what software you're running (e.g. Thunderbird, version x, on
Linux/Windows/OS X for x architecture, etc) which can give clues about how to
attack that client with some 0day exploit.

~~~
welterde
Actually the MTA can use opportunistic TLS to transfer the mail. And in a lot
of cases my mail server actually does.

So it's only not encrypted in 20% of the time (depending on who you
communicate with).

------
ezl
email is a tool. you can use it for what it works for.

it doesn't have to be used for all communication.

assume a world where all your emails are archived in publicly accessible
databases. you've lost privacy, but could it still be a useful tool?

send birthday emails. send your friends funny cat videos.

you don't have to use email for everything you used it for before -- you can
just use it in different ways. i would still like to be able to near-instantly
communicate with relatives across the world.

i know bacon clogs my arteries and making bacon has a terrible environmental
footprint relative to eating only grains, but i love it.

~~~
samstave
OK cool - bdays and cats.... now where do I do anything serious where I
need/desire privacy?

~~~
ezl
you're missing the point: maybe email is not good for privacy.

the article is about not using email.

no tool is perfect. you know what would be great? if hammers cured cancer.
they don't though, so we just use them to hammer nails into wood.

speaking to people in public places is also a way to communicate, though
equally bad for privacy. if there's nothing you can do to change the privacy
attribute of "speaking to people in public places", does that mean you should
never do it again?

or: use codes that only you and the other person know, hold hands and tap
morse code into each others palms, find secure rooms.

people get upset when one tool doesn't do all the things they want, but its a
weirdly tech centric thing.

"your startup doesn't do X so i'll criticize it". you can play the "need more
features" game ad infinitum -- but nobody criticizes cast cups for their
failure to keep drinks cold indefinitely or couches for failing to give them
back massages.

Because a feature makes a tool better doesn't make it a requirement for its
usage.

~~~
samstave
> __ _or: use codes that only you and the other person know, hold hands and
> tap morse code into each others palms, find secure rooms._ __

What? What am I some sort of criminal on the run?

 __ _You 're missing the point_ __!!! -- This whole damn thing is completely
unacceptable.

I don't give a shit about "legal" the government is an institution made by
men, and these actions and programs are wrong. The term "legal" holds
absolutely zero meaning to me any longer.

~~~
saraid216
THE WORLD ISN'T EXACTLY THE WAY I WANT IT AND I'M GOING TO KICK AND SCREAM AS
A RESULT RATHER THAN DOING ANYTHING MATURE TO ADDRESS IT.

~~~
samstave
What is more mature: calling out bullshit as it is or acquiescence to
something that is completely wrong due to lack of testicular fortitude?

I am in no way "kicking and screaming" in an immature manner, I am instead
saying "fuck you" to a system with which I will acknowledge no further
authority over me.

I am no longer interested in the opinions or doctrines of the agents of all
systems in this world which are not singularly for the advancement of Humanity
as a singular species.

I am not american, Jewish, atheist, ethnic, sexually-preferential or any other
wedge label.

I am a conscious being who is, from this point forward, only accepting of an
advancement of the Human Race without any profit motive (money, ego, power,
resource) outside of that which benefits the entire planet.

~~~
saraid216
But what about the puppies? :(

~~~
samstave
You're a douchebag

------
dombili
I'm not a programmer so this might be a stupid question and I apologize in
advance but, why not open source the service?

~~~
noahc
It's not a stupid question, but often times open sourcing something involves
one or more of the following:

1\. Documenting everything so it's actually usable. At a minimum, "here is how
to install the dumb thing" should probably be documented.

2\. Often times there are hard-coded values that would need to be extracted
out for security reasons or to simply allow someone to install it on a system
not quite like yours.

3\. Often times there are other dependences that would also have to be open
sources such as modifications to libraries, internal libraries released, shell
scrips, cron jobs, messaging queues, delayed job worker tasks, etc that the
system may rely on. These all need to be packaged up, documented and/or
released.

In short it is a ton of work to take something that is running in our way on
our hardware and generalize it enough that anyone else can run it.

On the other hand, you wouldn't need their service to give you the protections
they offered. Essentially, encrypted email storage. You can get that mostly
off the shelf using any linux distro if you run your own mail service.

~~~
dombili
I see. Obviously it's easier said than done.

I didn't use Lavabit because I mostly don't use email, but I'm guessing
Lavabit was an easier service to use rather than setting up your own email
service. I think @ssimpson has a point though. I don't think he [Ladar
Levison] would be turned off by the difficulty of the task of open sourcing
his project, but he may be waiting to see how the case works out first.

Thanks for your explanation.

------
vishal0123
> He doesn’t have the technological capability to decrypt his customer’s data
> but if someone could intercept the communication between the Lavabit’s
> Dallas-based servers and a user, they could get the user’s password and then
> use that to decrypt their data.

Is it really what I understand from this or LL is trying to say something
else.

~~~
marcioaguiar
Does not make sense to me. Lavabit claims that it cannot decrypt customer's
data, but if someone else could read what goes through Lavabit server and a
client it could decrypt the data?? So, how come Lavabit can't do tha same
thing?

~~~
taway2012
I don't know a lot about Lavabit's arch.

But my guess is he's referring to replacing the login page's Javascript code
with a malicious one that phones back the plaintext password. Kinda like a
keylogger.

------
bengrunfeld
“In America, we’re not supposed to have to worry about watching our words like
this when we’re talking to the press,” Binnall said. (from article)

I am a new immigrant to America. I came with my wife from Australia 8 months
ago. All my life I heard about how the US supported the freedom and rights of
its people, and now that I'm here, I find that that was a sick joke. This
place is a KGB state on the brink of happening.

~~~
chasing
Many Americans (and recent immigrants) are so spoiled, they don't _even_ know
what a lack of freedom looks like.

~~~
IgorPartola
My great grandmother spent 15 years staying up late at night to watch which
buildings the KGB agents went into and who they black bagged every single
night. My great grandfather's brother was black bagged and dragged away in the
middle of the night. My family found out where he was buried decades later
through an government inquiry after the attitude towards these inquiries had
changed (before, if you sent one in, they instead dragged you away).

The moral of the story is that the US is not nearly as bad as people might
think/say, but governments watching people's every move is the first rung in
the 1000 step ladder down to hell.

~~~
e12e
Yes. Because we know they already black bag American Citizens, but only the
_bad ones_ , right?

~~~
IgorPartola
Somewhat, I think. I think a good way to judge a society is by how it treats
its worst citizens. Holding someone without a fair trial is bad if you say
your core value is that all people deserve a fair trial. Arresting someone
without a warrant is bad if you say that the police is not the judge, jury,
and executioner.

However, there is a difference here in frequency/intensity. My great
grandfather's brother was innocent as far as I can tell. He held a fairly high
city-level position as a factory manager, so when he spent enough years in his
job someone decided that he got a little too comfortable and might nt fall in
line if push came to shove (remember this was Stalin, the paranoid maniac bank
robber who killed tens of millions of people for fear of being replaced). This
kind of stuff does not happen in the US. You have to piss someone off at the
Federal level to get on a kill list. Bad mouthing the government is still fine
so long as you do not leak actual facts.

~~~
e12e
While I agree we've seen worse regimes in history, I'm not sure we've seen
much worse "democracies" in recent memory.

Circumstantial evidence is apparently now enough to both be disappeared and
assassinated (never mind the collateral damage). No judge, no jury. This isn't
the rule of law any more.

Add to all this the fact that we can now assume the NSA possess comprehensive
evidence that could be used to indite major financial institutions in the wake
of 2008 -- and yet that is seemingly impossible. The fact that "it's not quite
as bad as Iraq was under Saddam Hussein, only with less government health
care" \-- isn't a very strong argument.

    
    
        "So the poor and the ignorant go to jail
         while the rich go to San Clemente"
         -- We Beg your Pardon America
            Gil Scott-Heron, 1975

~~~
mc32
>Circumstantial evidence...

Circumstantial evidence is perfectly legal and does get many people convicted
every day. One piece may not be enough, but you get supporting evidence and
you have your case --it's a very basic tool.

Indicting savvy bad bankers is very very hard. That and when the investigative
ranks (those who understand the intricacies of finance law, etc.) are reduced
to a fraction of what they were makes it even more difficult.

~~~
e12e
I should've made an effort to make two distinct points:

    
    
      1) killing someone over circumstantial evidence alone is questionable
    
      2) killing someone based on unilateral interpretation of any evidence (as opposed to the result of a verdict from a court) is questionable
    
    

Other than that: Are you seriously arguing that it is harder to verify if
someone conspired to defraud, assuming the NSA could provide rich evidence of
both communication and content, than it is to prove that someone is conspiring
to do harm?

That is: in the latter case you (would/should) have to prove _intent_ before
any crime is committed (and that a crime is _likely_ to be committed) -- while
in the latter case you would only have to be able to document the most likely
path that led to _recorded_ events taking place? You're even able to document
profit, in the case of the banks.

~~~
mc32
I agree with your points 1 & 2\. It's questionable.

to the other point, yes. Securities laws, from what I can tell, are very
convoluted. Even experts find it hard to tell when one enters or exits the
grey areas. In addition, in 2008, there were other considerations to take.
Until, I know better, I don't think the NSA is allowed to use whatever
information they have, to prosecute domestic crimes. They may 'tip off' the
SEC, etc. but the SEc must gather their own info and evidence. Also, it's not
as if the NSA are experts in Securities. They look for physical threats rather
than soft threats to the economy/population.

See some review of this in this NPR piece:
[http://www.npr.org/2011/07/13/137789065/why-prosecutors-
dont...](http://www.npr.org/2011/07/13/137789065/why-prosecutors-dont-go-
after-wall-street)

------
enupten
Why don't all these tech companies form a coalition and release the details
together ? The government would never dare going after a dozen companies at
once, that would in essence spell doom for Silicon valley (and Obama's liberal
rhetoric, such as it is). Surely there are times when breaking the law is the
right thing ?

------
digipaper
One the companies closed and deleted all their paying customers emails? That's
bad imo.

~~~
phpnode
better to delete it than hand it over if privacy was your selling point in the
first place. if i were a customer, i'd be ok with this.

~~~
iaskwhy
Also, if I understand this correctly, his customers most probably had a copy
of the emails on their computers so their loss was only the email address (and
emails eventually received after the closedown).

~~~
pdonis
_his customers most probably had a copy of the emails on their computers_

Based on the fact that a number of them are talking about having lost data, I
suspect that at least a significant number of customers only used webmail to
access their accounts, so they never had a local copy of their data.

~~~
iaskwhy
I was thinking that using webmail would defeat the purpose of really private
email.

~~~
pdonis
Not if you access it via https.

~~~
iaskwhy
It's still showing not encrypted on the screen which allows all sort of
possibilities when done on a browser. For example, let's say you're using
Chrome, hard to make sure page contents are not being used somehow.

~~~
pdonis
The same applies to any other email client; it has your data unencrypted, so
if you can't trust it, you're screwed.

~~~
iaskwhy
That's why I assumed people that actually care about privacy use a desktop
software, open source and with IMAP, so there wouldn't be no huge loss.

~~~
pdonis
_a desktop software, open source and with IMAP_

Which will still see your data unencrypted. And there are open-source browsers
too.

In any case, as I said several posts ago, a number of Lavabit customers were
complaining about having lost their stored emails; if they were using a
desktop email client with IMAP, that wouldn't be the case.

