Lavabit founder: 'If You Knew What I Know About Email, You Might Not Use It'

[MineralMan]

24. Very interesting.

The question I have is one of trust. I wonder about the wisdom of trusting communications to any vendor. Personally, I use Yahoo, and have no concerns because my emails are of no value to anyone except me and those with whom I communicate. I would not trust Yahoo with sensitive information sent via email. Frankly, I would not trust any email server. Since I send nothing of that sort via email, though, it doesn't really matter.

But, if my email required encryption, for some reason, I'd be very, very careful with that email. I certainly wouldn't rely on information provided by any vendor regarding security issues. Essentially, it is impossible to know, with any degree of certainty, whether a vendor is worthy of trust to that degree.

Luckily, I have no such communications to make, so it's not really an issue for me. My work product is not sensitive in nature, and of no interest to anyone but the clients I work with. My personal life is extraordinarily boring. My political communications are made only on DU, and are all posted publicly, so they're not encryption worthy.

If, however, I was doing something that was sensitive and would jeopardize anything in my life, I would not trust any vendor to act as an intermediary in any communications of that nature. Not any vendor. I would find ways to communicate that did not involve any third party at all. Any encrypted material would never be sent in the clear beyond my immediate control. I'd encrypt on a computer not connected to any network and either send the already encrypted material via email or via another communications method. The point is that it would simply never be available in unencrypted form to anyone in transit. Never.

It's amazing to me that anyone who requires encrypted communications would use any third party vendor to handle that encryption. That would make the encryption completely fallible from the moment it left my control.