Lavabit, secure email? Hardly, says infosec wizard Moxie Marlinspike

Former Lavabit proprietor Ladar Levison claims the new Dark Mail initiative he’s cooking up with the team from Silent Circle will enable email that’s virtually spy-proof, but according to at least one expert, the original Lavabit service was never all that secure to begin with.

“After all,” security guru Moxie Marlinspike wrote in a blog post this week, “how is it possible that a service which wasn’t supposed to have access to its users’ emails found itself in a position where it had no other option but to shut down in an attempt to avoid complying with a request for the contents of its users’ emails?”

The main problem with Lavabit’s design, according to Marlinspike, is that each Lavabit user’s private encryption key was stored on the Lavabit server. The key was itself encrypted with a password, true. But every time the user wanted to read an email, that password needed to be transmitted to the server, essentially negating any security.

SOURCE: theregister.co.uk