Lavabit, the secure email service that shut down in 2013 rather than turn over the encryption key for a user account to the federal government, has reemerged with a new encrypted mail offering based on a standard developed by the company.
It’s been more than three years since Lavabit founder Ladar Levison decided to end the company’s original email service in the face of a warrant requiring him to divulge the SSL key associated with a user’s account. The owner of the account wasn’t made public, but it has been reported that it was Edward Snowden. Levison resisted the warrant but eventually turned over the key just as he shut down the service. Since then, Levison has spoken about wanting to revive Lavabit, and he began working on a new standard called Dark Internet Mail Environment (DIME) and an encrypted mail server known as Magma.
“DIME is the technological evolution over current standards, OpenPGP and S/MIME, which are both difficult to deploy and only narrowly adopted. Recent revelations regarding surveillance have pushed OpenPGP and S/MIME to the forefront, but these standards simply can’t address the current privacy crisis because they don’t provide automatic encryption or protect metadata,” Levison said in announcing the new service.
“By encrypting all facets of an email transmission (body, metadata and transport layer), DIME guarantees the security of users and the least amount of information leakage possible. A security-first design, DIME solves problems that plague legacy standards and combines the best of current technologies into a complete system that gives users the greatest protection possible without sacrificing functionality.”
The new Lavabit system offers three modes with different levels of security, depending upon the user’s needs: Trustful, Cautious, or Paranoid. The main difference between the three modes is the way that the keys are handled. In Trustful mode, the user’s key is held unencrypted in the Lavabit server’s memory while the user is logged in and the server performs the encryption operations. In Cautious mode, the user’s key is encrypted on her device, sent to the server in encrypted form, and is not accessible to the company.
Paranoid mode is where things get really interesting.
“In Paranoid mode, your key never transmits anywhere; You maintain ABSOLUTE control. It is up to the user to move their key to any new device. If you create the original key within client software and wish to also use it on your phone, you must devise a secure method to move your key. This will allow you to export it to a file securely and encrypted,” Levison said.
“You can use a data cable or your own trusted digital method to copy the key to your new device. You can use a device to communicate for a period and then destroy the key or device, without a copy of the key stored. This renders all communication that the key opened inaccessible from that point on. Paranoid mode is ultra-secure, however, it requires technical proficiency in user key management.”
Since Snowden began feeding NSA secrets to media organizations, revealing the details of the agency’s surveillance, encrypted email, phone, and text apps have enjoyed a huge increase in popularity. Lavabit reemerges in a time when many non-technical users are looking for encrypted communications apps, especially those that don’t require a lot of effort and technical knowledge to set up.
Image: Schizoform, CC By license.
