<story><title>Lavabit gets new crypto key, gives users 72 hours to recover e-mails</title><url>http://arstechnica.com/tech-policy/2013/10/lavabit-gets-new-crypto-key-gives-users-72-hours-to-recover-e-mails/</url></story><parent_chain></parent_chain><comment><author>robhu</author><text>The new certificate does not offer Forward Secrecy &lt;a href=&quot;https://www.ssllabs.com/ssltest/analyze.html?d=liberty.lavabit.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.ssllabs.com&amp;#x2F;ssltest&amp;#x2F;analyze.html?d=liberty.lavab...&lt;/a&gt;&lt;p&gt;Does this not mean that the NSA could patiently log all the traffic going in and out of the site over the next few days, then get a court order for this new SSL private key, then decrypt the traffic they collected?&lt;p&gt;I may have misunderstood, but doesn&amp;#x27;t that make this something of a trojan horse? Many users will login and try to download all their email, and for everyone who does, when the NSA (very likely) get a court order for the new SSL key, they&amp;#x27;ll have that large amount of private email everyone tried to copy from the site?</text></comment>
<story><title>Lavabit gets new crypto key, gives users 72 hours to recover e-mails</title><url>http://arstechnica.com/tech-policy/2013/10/lavabit-gets-new-crypto-key-gives-users-72-hours-to-recover-e-mails/</url></story><parent_chain></parent_chain><comment><author>drraoulduke</author><text>I wouldn&amp;#x27;t trust this. The government could be running the site now. It&amp;#x27;s happened before.</text></comment>