Voi cum va protejati comunicatiile online?

[Zimbru]

Lavabit is down

My Fellow Users,

I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations. I wish that I could legally share with you the events that led to my decision. I cannot. I feel you deserve to know what’s going on--the first amendment is supposed to guarantee me the freedom to speak out in situations like this. Unfortunately, Congress has passed laws that say otherwise. As things currently stand, I cannot share my experiences over the last six weeks, even though I have twice made the appropriate requests.

What’s going to happen now? We’ve already started preparing the paperwork needed to continue to fight for the Constitution in the Fourth Circuit Court of Appeals. A favorable decision would allow me resurrect Lavabit as an American company.

This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States.

Sincerely,
Ladar Levison
Owner and Operator, Lavabit LLC

[IulianC]

Parerea mea e ca toate beneficiile aceastea ale internetului sunt niste " cai troieni " baieti o pun de o noua ordine mondiala, o noua forma de tiranie, asa ca au inceput sa ofere beneficii online cu ajutorul carora sa poata controla mai usor masele.

[George]

sincer... pot sa ma controleze cum vor ei atata timp cat am ce pune pe masa, ca nu o sa devin eu nu stiu ce lider nu mai conteaza. Cati va cunoasteti arborele genealogic?. Unul strange, a doua sau a treia generatie cheltuieste.

[puthre]

Se pare ca deja nemtii au inteles cum e cu emailurile tinute in US:
Growing Demand For German Email Providers After NSA Scandal - SPIEGEL ONLINE

[sergiuliano]

Completare la MegaPWN

"But that would be pointless, because any such attempt could easily be detected and would completely ruin our credibility. Some juristictions force service providers to install backdoors, but MEGA will always migrate to a jurisdiction that respects your right to privacy instead of putting your data at risk. Major software vendors, e.g. in the United States, could easily be forced by their local government to abuse their update mechanisms to deliver backdoor code to specific targets. We will never provide any government with any backdoors, period."

Daca dai accept la JS-uri , activeX-uri etc, poti compromite cel mai tare sistem de securitate, indiferent de cine a fost facut ...

Se pare ca pe langa functia de chat criptat a celor de la mega, va fi lansat si servicu video + email in curand, toate cu un nivel de securitate crescut.

[puthre]

Completare la MegaPWN

"But that would be pointless, because any such attempt could easily be detected and would completely ruin our credibility.

Nu e deloc usor de detectat. Mai mult decat atat, nu e posibila implementarea securitatii la un standard acceptabil in javascript. Uite mai multe detalii aici:
Matasano Security - Matasano Web Security Assessments for Enterprises

[Zimbru]

another level : http://www.nytimes.com/2013/09/06/us....html?hp&_r=1&

[sergiuliano]

Sa accepti executarea unui script , indiferent de natura scriptului, poate sa compromita securitatea unei masini, din acest motiv cred ca exemplul celor dela megapwn este unul rauvoit daca nu chiar stupid, insa, interesant la cei de la Mega este declaratia si scopul lor "the privacy company" - cel putin incearca si probabil si reusesc intr-o anumita masura, sa tina datele confidentiale fara sa ofere acces unor terte parti cum fac toate companiile US / EU based...

[puthre]

Sa accepti executarea unui script , indiferent de natura scriptului, poate sa compromita securitatea unei masini, din acest motiv cred ca exemplul celor dela megapwn este unul rauvoit daca nu chiar stupid, insa, interesant la cei de la Mega este declaratia si scopul lor "the privacy company" - cel putin incearca si probabil si reusesc intr-o anumita masura, sa tina datele confidentiale fara sa ofere acces unor terte parti cum fac toate companiile US / EU based...

Ceea ce iti arata scriptul ala e ca si cei de la Mega pot sa aiba acces la parola ta daca vor. Daca ai incredere in mega nu e nici o problema, inafara de faptul ca encriptarea de pe client devine inutila, pentru ca poti sa le dai lor cheia sau mai mult decat atat, sa nu criptezi datele deloc, pentru ca ai incredere in ei. Daca nu ai incredere in mega, atunci iarasi criptarea de pe client e inutila atata timp cat pot avea acces la cheie oricand vor.
In ambele cazuri criptarea e inutila si iti da un fals sentiment de siguranta.

[sergiuliano]

@puthre - e adevarat, insa mega , spre deosebire de alte companii, si-a construit toata imaginea pe privacy ... in momentul in care apare o dovada ca au incalcat acest lucru, pot sa piarda tot... si deja este evaluata la peste 100 de milioane de USD... miza e prea mare ca sa incalce declaratia initiala ...