magma

I had an account at the time! He gave the govt the key, handwritten on paper, to stall for time so he could delete everything. I wish every admin had that sort of integrity. He had a followup project, magma (https://github.com/lavabit/magma), that was supposed to be a secure email alternative. It's a shame it never took off.

If you're having déjà vu, it's because there is also an encrypted email service called Magma: https://github.com/lavabit/magma

I'm actually kind of surprised to see the only reference to lavabit, in all of the comments, is that it was shutdown. It seems to be back and their server is open source: https://github.com/lavabit/magma although you can pay for their hosted version also: https://lavabit.com

Lavabit: https://lavabit.com It looks like you can run the server on your own hardware, but I have not tried this so YMMV. https://github.com/lavabit/magma

>scanning a c project for buffer overflows is relatively trivial compared to scanning tons of libraries for flaws so obfuscated they made it through review You would have to scan the C project for buffer overflows and memory leaks in addition to scanning the tons of C libraries that it uses[0] for buffer overflows and memory leaks (note that openssl is in that list, among other massive libs). This is not even taking logic errors into account. There is simply too much to consider all at once, and being in C just makes it that much harder have a reasonable sense of security. You're also implying that it's easier to spot intentionally backdoored C than intentionally backdoored Python, Go, Java, etc, but I have no reason to believe that that's true. Furthermore, the number of eyes that have been on those projects is far higher than the number

There's a difference-- point-to-point encryption is what you're talking about. Anytime a message is transferred, it's done via TLS, but you can't be guaranteed that at any one point the message is kept encrypted. You can have this today -- just about any MTA has a configuration to only allow TLS connections, and then you can set up an IMAP server to only allow encrypted connections. End-to-end encryption is the system whereby the moment the message leaves the sender's hands (phone, desktop, whatever) it's encrypted until it gets into the receiver's hands. This is your OpenPGP/etc. You could think of that as "Signal for email". This is apparently not what Magma is doing. Here's the relevant line from Github: https://github.com/lavabit/magma/blob/develop/src/providers/... You can see that Magma is writing the email message to a file and ins

Code for Magma Mail Server: https://github.com/lavabit/magma Code for DIME (Dark Internet Mail Environment):https://github.com/lavabit/libdime