GoDaddy Revokes Lavabit's Security Certificate After Reading About How The Feds Got It

from the post-facto dept

By now the details of the shutdown of secure email provider Lavabit are fairly well known. Seeking to spy on Ed Snowden’s communications, the feds demanded Lavabit give them access to Snowden’s account. After some back and forth, they further demanded the site’s private SSL keys. Lavabit’s Ladar Levison first provided it to them printed out in illegible 4 point type, and when the court found that unacceptable, he shut down the entire service while simultaneously handing over the key. Here’s an interesting side note to all of that, dug up by Kashmir Hill over at Forbes: After the details of what happened were unsealed by the court a week ago, GoDaddy revoked the security certificate it had provided for Lavabit, saying that there’s now proof Levison provided them to a third party, violating the policy on a secure cert:

“[W]e’re compelled by industry policies to revoke certs when we become aware that the private key has been communicated to a 3rd-party and thus could be used by that party to intercept and decrypt communications,” says GoDaddy spokesperson Elizabeth L. Driscoll, in response to an inquiry about Lavabit’s keys being revoked.

Of course, since the service is already shut down, this move has no direct impact on anything, but makes a fairly strong symbolic statement. Many have been wondering, if the feds are ordering Lavabit to hand over its SSL keys, it’s quite likely the same demand has been made of many other companies as well, most of which likely complied. So, this raises the question of whether or not certificate authorities are going to start looking for the possibility of other compromised certs and revoking them….

Separately, as Hill notes, this could also aid Levison in his legal case, as he can now legitimately argue another way in which being forced to turn over the keys could create an unreasonable burden on his business by having the keys revoked.

Filed Under: , , , , ,
Companies: godaddy, lavabit

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “GoDaddy Revokes Lavabit's Security Certificate After Reading About How The Feds Got It”

Subscribe: RSS Leave a comment
Anonymous Coward says:

A lot of people don't understand the point of CAs

The entire point of a certificate authority is to verify the owner of the SSL certificate.

There are different classes of certification, and the highest class comes with all sorts of guarantees that the person using the SSL certificate is the one that is supposed to.

A proper CA must ensure that if an SSL cert falls into the wrong hands, that it be promptly revoked, as they can no longer guarantee the owner of the cert is the sole person that they have verified.

FamilyManFirst says:

Re: Possible out

I wonder how a judge would react if, in court (a la the Lavabit hearings), the judge ordered that the company turn over their cert and the company rep responded that, sure, they’d do so, but that they were then contractually bound to notify the CA that the cert had been compromised, which would lead to the revocation of the cert? Can a judge order a company to willfully violate a contract like this?

Anonymous Coward says:

it should also stop the Feds from going after any site/service that requires a secure certificate. how can businesses that require them be able to conduct their business when that cert is handed over? how can any business even request a cert when it is going to be put into the position of betraying customers and committing fraud by saying it’s site/service is secure when it isn’t? is it supposed to put a footnote on it’s contracts, stating that everything is as advertised, as long as and until, the feds go in and completely fuck everything up? would the Feds be happy with that sort of condition? i doubt not!!! (profile) says:

Re: Footnotes

is it supposed to put a footnote on it’s contracts, stating that everything is as advertised, as long as and until, the feds go in and completely fuck everything up? would the Feds be happy with that sort of condition?

That’s how some health insurance exchanges are treating the issue of government breaches of privacy: “only exception to this [privacy] policy is that we may share information provided in your application with the appropriate authorities for law enforcement and audit activities.

Anonymous Coward says:

Going to the source

Instead of speculating, let’s see what the rules should be.

The rules for Mozilla (Firefox) are at Following the links, you can find things like:

“If the CA or any of its designated RAs become aware that a Subscriber?s Private Key has been communicated to an unauthorized person or an organization not affiliated with the Subscriber, then the CA shall revoke all certificates that include the Public Key corresponding to the communicated Private Key.”

The other browsers should have similar requirements.

If a CA does not want to be removed from the browsers’ root trust stores, they have to revoke any certificate where the private key has been revealed to anyone else. There is no “law enforcement” exception.

Anonymous Coward says:

Re: Going to the source

Yeah, what GoDaddy did here was correct. You just have to wonder how many companies have compromised private keys they know about but is gagged and bound by court order not to inform the authority about?

What is creating a glaring hole here, is that courts can order a key to be handed over at all. The system cannot keep any credibility as soon as a key is compromised. I am not sure how NSA argues the system can work under these conditions? Guess it is the same as their coded backdoors: They are far outside the normal laws and lack the integrity to make the oversight aware of the consequences of their endevours!

elemecca (profile) says:

Re: Re: Going to the source

The browser vendors are relevant here because they exert strong market pressure on the CAs in their root store to have reasonable revocation policies. Since the majority of their customers are using their certificates to operate HTTPS web sites even one major browser removing their root certificate is a business-ending event for a CA.

Anonymous Coward says:

Re: Re: Going to the source

Browsers are very much relevant to this issue. These will push on CA issuers to make sure their product is trustworthy. That it’s purpose to the user through the browser. This is a partial list of those CAs in my browser.

That’s hardly an external issue when you are depending on them being free of malware and security issues. Having that trust lost to the public very much has results.

Brazenly Anonymous says:

Re: Re: Re:2 Going to the source

Users contract with browsers to establish the chain of trust for secure websites. As such, they are part of the chain and very much a part of the issue. Occasionally users will modify the trust pool or create their own, but any part of the chain of trust can be bypassed this way, not just browsers.

Anonymous Coward says:

So when do we start seeing the revocation of AT&T, Google, Yahoo!, and other major telecoms and email providers?

How exactly will GoDaddy find out about these compromised CAs? I mean Lavabit is only the latest in a whole series of email providers who have been compromised, all of whom you can bet have been given gag orders in one form or another.

And how about the rest of the CA issuers? Are they going to follow suit too?

The more that comes out about this NSA business the nastier it looks.

Sunhawk (profile) says:

Re: Re:

Could Godaddy demand sworn statements from other service providers and revoke their keys if they can not rule out that their keys have been handed over to a third party?

Presumably, even secret court orders can not force service providers to commit perjury?

Well now… This could be quite interesting

In regards to the article, GoDaddy did the correct thing (besides, it’s not like Lavabit is going to be using that cert any more). In addition, this could perhaps assist future businesses hit with a similar order (those that wish to resist it, that is). I’m not entirely sure to the extent a federal agency can force a business to act as a baffle (effectively that’s what using a business’ cert is; not unlike forcing a store to employ an undercover cop as a cashier), but “this will cause my business to be unable to function” surely should strengthen a defense.

Anonymous Coward says:

I understand the revocation is more about GoDaddy’s maintenance of our trust in it as a CA than about invalidating Lavabit’s certificate for end users. But hands up; who here actually has their browser configured to check for certificate revocation?

It doesn’t matter in this case since Lavabit won’t be using their cert anymore. I’m just wondering if anyone really checks for revocation for the sites they visit. I tried enabling CRL checking in Chrome on a reasonably fast computer, and it made visiting HTTPS URLs unbearably slow, with many sites timing out.

Anonymous Coward says:

If they’re going to do it they should be doing it by actively seeking out certs in use that may be compromised.

Sadly a bunch of morons will look at this action and think GoDaddy is going to bat for them. Anyone with an elementary understanding of what happened will know just how much this reeks of complete bullshit.

GoDaddy has accomplished absolutely nothing. It’s a damn shame because they have the power to do so much in this area.

Postulator (profile) says:

The negative answer solution

There is a very easy solution to government-compromised certificates. The certificate authority sends an email once a month (more or less time depending on the importance of the certificate holder – so Google (which I understand complicates things by issuing its own certificates) may be once a week). That email asks the certificate holder’s chief executive to:

“Confirm that your certificate remains secure, and to your knowledge your private key has not been provided to or accessed by any third party”.

A separate annual email would ask the chief executive to:

“Confirm that all certificates issued to you, including those that have now expired, remain secure, and confirm that to your knowledge no private key issued to you has been provided to or accessed by any third party”.

These questions would exclude any certificates that are known to have been leaked, but there would need to be an extra question about what arrangements have been made to protect any data that is insecure because of lost certificates.

The way these questions are phrased, chief executives could indicate by refusing to answer them that they have been forced to hand over private keys. They don’t need to disclose anything that is prevented by super-secret “we cut off your balls” court orders.

Shawn says:


It amazes me how many people are blowing this off because the site was already shut down. That doesn’t matter if there were any effort by third parties (govt) to record all traffic (black hole, social anthropoid, samuel pepys, karma police) to and from the target server in advance in order to be able to decrypt it in a replay attack.

It’s not paranoia when they’re really out to get you.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...