Lavabit NOW - your current experience - Page 2

OxfordComma · 13 May 2009, 07:51 PM

Thanks for the tip.

Yoda7 · 1 Aug 2009, 06:59 PM

I have been using Lavabit for at least a year and up to about a month ago was very happy with it, especially the security aspects.

However, twice in the past month emails sent to me by my regular contacts have been delayed by two days! No apology nor explanation from Lavabit. That is absolutely and totally unacceptable.

If it happens again I'm out.

I dont know what is going on at Lavabit but I really do hope they get their act together. If they do, I reckon they could resell their email service to some of the smaller ISP's who seem to struggle with their email servers.

Initially I thought Lavabit's email service was their main business but Lavabit themselves have stated on other forums that is not the case. It seems to be just a sideline business.

At least they recently appointed a dedicated support engineer.

I want to be able to rely on Lavabit being rock solid in terms of business continuity, security, reliability and support.

That way I can change ISP (which I have to do regularly due to pricing, reliability & speed issues where I live) and not have to change my primary email address.

OxfordComma · 2 Aug 2009, 12:06 AM

Thanks for the testimony Yoda. Of you, it is good. Haha!

A bit of an update. I've since gone ahead and opted for a premium account, and so far, I'm very happy with it. It handles a fair volume of emails - I'm a subscriber to a freecycle group - perfectly well. I open my email client and down they come. No delays. No missing emails. No emails taking the scenic route. So on that front, I'm quite happy with the $16 I spent on the service.

I've contacted support once and got no response, but I'll be chasing that up having been on holiday. So it seems their customer service still leaves a lot to be desired, but it's a small price to pay for the knowledge that no-one can read my emails. I'm still quite positive about it. Besides, I wouldn't have thought the folks at gmail or hotmail would respond to enquiries from Joe Public.

I was able to get a sweet email address too. Bonus!

Anyway, thanks for the comment. Any other readers with tales or experience please go ahead and share.

LinuxRoot · 2 Aug 2009, 03:06 PM

I just recently signed up for Lavabit as I don't particularly care for email providers Yahoo and Gmail. As far as their service, I haven't had adequate time to evaluate it, so the jury is still out. However, I do like their idea of email security. I use SSL POP3 access and all seems to be as it should. If within a short period of time I do not experience any negative issues, I will opt for their paid service.

I chose Lavabit over Fastmail because Fastmail's pricing structure is not competitive.

David · 2 Aug 2009, 03:23 PM

Quote:

Originally Posted by ;484392

I just recently signed up for Lavabit as I don't particularly care for email providers Yahoo and Gmail. As far as their service, I haven't had adequate time to evaluate it, so the jury is still out. However, I do like their idea of email security. I use SSL POP3 access and all seems to be as it should. If within a short period of time I do not experience any negative issues, I will opt for their paid service.

I chose Lavabit over Fastmail because Fastmail's pricing structure is not competitive.

Welcome to the forums LinuxRoot; while I fully agree with your synopsis, I would hasten to say that Fastmail have a proven track record (while Lavabit do not) Lavabit (from what I have gathered) seem to be a one man show. I would also hasten to say that I us neither of these services these days.

jdtaylor · 2 Aug 2009, 07:08 PM

What is odd, I haven't had a response from them either when I usualyl do.

OxfordComma · 2 Aug 2009, 07:40 PM

Almost immediately after writing my previous comment the folks at Lavabit got back to me with a solution for my problem. They took about 5 days to a week I think. Not the quickest service, but hey it's something.

Things are looking up.

Yoda7 · 3 Aug 2009, 04:08 PM

Quote:

Originally Posted by David

Welcome to the forums LinuxRoot; while I fully agree with your synopsis, I would hasten to say that Fastmail have a proven track record (while Lavabit do not) Lavabit (from what I have gathered) seem to be a one man show. I would also hasten to say that I us neither of these services these days.

David,
Do you use another dedicated email service or just your ISP's email server?

David · 3 Aug 2009, 05:13 PM

Quote:

Originally Posted by Yoda7

David,
Do you use another dedicated email service or just your ISP's email server?

I have a webhosting account that gives me very solid (reliable) old fashioned email (at my own domain) + a paid account at EUMX (which gives me lots of quota for a cheap price) I also use my ISP email accounts at telus.net. I have still too many accounts... as I also have the usual at Yahoo, Hotmail, and Gmail. One day I will force myself to give them all up I am sure - I will add that I am not an email account addict (compared to some) - most folk here have ten times as many email accounts as I do

**ReuvenNY** · 3 Aug 2009, 08:55 PM

David, what happened to your Tuffmail account?

David · 3 Aug 2009, 11:50 PM

Quote:

Originally Posted by ReuvenNY

David, what happened to your Tuffmail account?

Hello ReuvenNY: I let my Tuffmail account expire some time ago, not because of any problems with it (it was likely the most reliable account I ever had) but because I just don't really need it anymore and my webhosting account (at Baremetal) is more than enough for me these days (it gives me similar features.. SquirrelMail interface and all)

lavabit · 4 Aug 2009, 04:51 PM

We've heard your complaints about our inability to answer all of the support emails, and have hired a part time engineer to help with the load. Since his only responsibility is answering your questions, our hope is that he won't be side tracked by the project deadlines that were keeping the rest of us from answering them. He's still coming up to speed, and were still working to get caught up, but things should be better going forward.

As for the encryption question above, we only store a SHA 512 hash that is derived from the plain text password; not the password itself. We take great care to make sure that the plain text password is never written to disk; even as part of the system paging file. And we delete the plain text password once we've decrypted the private key needed to decrypt your messages. All of that said, if someone had physical access to our servers (ie big brother), and they could freeze our application in memory during the split second it was holding a password, an attacker could extract the plaintext password that way.

But keep in mind what we designed the system for. Specifically our encryption system was designed to keep our admin team from being able to read your email. And by extension, keep us from having any sensitive data to surrender if faced with a national security letter from the PATRIOT Act. Its not an end to end security solution like PGP or S/MIME. Combined with TLS/SSL the hope is that if an attacker (again big brother) wanted to read your messages they would need to go directly to the user, and not secretively to the ISP. And if they goto the user, that person has the opportunity to fight the request in court; something they can't do if the request is in secret to the ISP.

As for competitors, the most popular one we've heard about is Hushmail. But their goals are a little different. And anyone using them should understand that their system has the same vulnerabilities that ours does. See this link for a case study on what I'm talking about:

http://www.wired.com/threatlevel/200...crypted-e-mai/

Merovingian · 4 Aug 2009, 07:05 PM

thanks for the reply, and the update, lavabit! It's good to know you're listening to your customers and taking steps to remedy their issues.

As far as my experience with Lavabit.com, I have really enjoyed my account. I have had my account for quite a while, and feel very good about my experiences so far. I was able to get myfirstname @ lavabit.com, which is my #1 desired username. I have never noticed any reliability issues at all.

My only disappointment is that there still isn't our custom web interface that has been talked about for over a year. I'm glad we have what we have, but to not have an interface with an address book feature is difficult to overlook.

Any word on a possible date for implementation of the new web interface?

B4its2L8 · 4 Aug 2009, 09:01 PM

Quote:

Originally Posted by Merovingian

My only disappointment is that there still isn't our custom web interface that has been talked about for over a year. I'm glad we have what we have, but to not have an interface with an address book feature is difficult to overlook.

Also, there are still things that need to be implemented by contacting support, rather than the users having access to them themselves. Perhaps that, too, was implied in your comments above ?

sd

LinuxRoot · 7 Aug 2009, 11:22 AM

Ok, I've had a few days to review Lavabit premium, including their support. I have determined it to be top notch. 5 of 5 stars. I've found an email home.

1 Aug 2009, 06:59 PM	#17
Yoda7 Junior Member Join Date: Jun 2009 Location: Australia Posts: 4	Lavabit Reliability I have been using Lavabit for at least a year and up to about a month ago was very happy with it, especially the security aspects. However, twice in the past month emails sent to me by my regular contacts have been delayed by two days! No apology nor explanation from Lavabit. That is absolutely and totally unacceptable. If it happens again I'm out. I dont know what is going on at Lavabit but I really do hope they get their act together. If they do, I reckon they could resell their email service to some of the smaller ISP's who seem to struggle with their email servers. Initially I thought Lavabit's email service was their main business but Lavabit themselves have stated on other forums that is not the case. It seems to be just a sideline business. At least they recently appointed a dedicated support engineer. I want to be able to rely on Lavabit being rock solid in terms of business continuity, security, reliability and support. That way I can change ISP (which I have to do regularly due to pricing, reliability & speed issues where I live) and not have to change my primary email address.

2 Aug 2009, 07:40 PM	#22
OxfordComma Junior Member Join Date: May 2009 Posts: 10	Typical Almost immediately after writing my previous comment the folks at Lavabit got back to me with a solution for my problem. They took about 5 days to a week I think. Not the quickest service, but hey it's something. Things are looking up.

13 May 2009, 07:51 PM	#16
OxfordComma Junior Member Join Date: May 2009 Posts: 10	Thanks for the tip.

2 Aug 2009, 12:06 AM	#18
OxfordComma Junior Member Join Date: May 2009 Posts: 10	Thanks for the testimony Yoda. Of you, it is good. Haha! A bit of an update. I've since gone ahead and opted for a premium account, and so far, I'm very happy with it. It handles a fair volume of emails - I'm a subscriber to a freecycle group - perfectly well. I open my email client and down they come. No delays. No missing emails. No emails taking the scenic route. So on that front, I'm quite happy with the $16 I spent on the service. I've contacted support once and got no response, but I'll be chasing that up having been on holiday. So it seems their customer service still leaves a lot to be desired, but it's a small price to pay for the knowledge that no-one can read my emails. I'm still quite positive about it. Besides, I wouldn't have thought the folks at gmail or hotmail would respond to enquiries from Joe Public. I was able to get a sweet email address too. Bonus! Anyway, thanks for the comment. Any other readers with tales or experience please go ahead and share.

2 Aug 2009, 03:06 PM	#19
LinuxRoot Junior Member Join Date: Aug 2009 Posts: 20	I just recently signed up for Lavabit as I don't particularly care for email providers Yahoo and Gmail. As far as their service, I haven't had adequate time to evaluate it, so the jury is still out. However, I do like their idea of email security. I use SSL POP3 access and all seems to be as it should. If within a short period of time I do not experience any negative issues, I will opt for their paid service. I chose Lavabit over Fastmail because Fastmail's pricing structure is not competitive.

2 Aug 2009, 07:08 PM	#21
jdtaylor Master of the @ Join Date: Sep 2004 Posts: 1,693	What is odd, I haven't had a response from them either when I usualyl do.

3 Aug 2009, 08:55 PM	#25
ReuvenNY Moderator Join Date: Mar 2002 Location: New York Posts: 4,259	David, what happened to your Tuffmail account?

4 Aug 2009, 04:51 PM	#27
lavabit Member Join Date: Mar 2007 Posts: 56 Representative of: Lavabit.com	We've heard your complaints about our inability to answer all of the support emails, and have hired a part time engineer to help with the load. Since his only responsibility is answering your questions, our hope is that he won't be side tracked by the project deadlines that were keeping the rest of us from answering them. He's still coming up to speed, and were still working to get caught up, but things should be better going forward. As for the encryption question above, we only store a SHA 512 hash that is derived from the plain text password; not the password itself. We take great care to make sure that the plain text password is never written to disk; even as part of the system paging file. And we delete the plain text password once we've decrypted the private key needed to decrypt your messages. All of that said, if someone had physical access to our servers (ie big brother), and they could freeze our application in memory during the split second it was holding a password, an attacker could extract the plaintext password that way. But keep in mind what we designed the system for. Specifically our encryption system was designed to keep our admin team from being able to read your email. And by extension, keep us from having any sensitive data to surrender if faced with a national security letter from the PATRIOT Act. Its not an end to end security solution like PGP or S/MIME. Combined with TLS/SSL the hope is that if an attacker (again big brother) wanted to read your messages they would need to go directly to the user, and not secretively to the ISP. And if they goto the user, that person has the opportunity to fight the request in court; something they can't do if the request is in secret to the ISP. As for competitors, the most popular one we've heard about is Hushmail. But their goals are a little different. And anyone using them should understand that their system has the same vulnerabilities that ours does. See this link for a case study on what I'm talking about: http://www.wired.com/threatlevel/200...crypted-e-mai/

4 Aug 2009, 07:05 PM	#28
Merovingian Master of the @ Join Date: Aug 2007 Location: U.S.A. Posts: 1,583	thanks for the reply, and the update, lavabit! It's good to know you're listening to your customers and taking steps to remedy their issues. As far as my experience with Lavabit.com, I have really enjoyed my account. I have had my account for quite a while, and feel very good about my experiences so far. I was able to get myfirstname @ lavabit.com, which is my #1 desired username. I have never noticed any reliability issues at all. My only disappointment is that there still isn't our custom web interface that has been talked about for over a year. I'm glad we have what we have, but to not have an interface with an address book feature is difficult to overlook. Any word on a possible date for implementation of the new web interface?

7 Aug 2009, 11:22 AM	#30
LinuxRoot Junior Member Join Date: Aug 2009 Posts: 20	Ok, I've had a few days to review Lavabit premium, including their support. I have determined it to be top notch. 5 of 5 stars. I've found an email home.