No. Lavabit had fundamental flaws where passwords were sent to the server so anyone who could decrypt the HTTPS traffic could basically access the content [1].
Skiff's password mechanism actually solves this flaw cryptographically using known, established primitives.
We use argon2id to take password and turn it into two cryptographic keys. One key is used for an SRP scheme to prove you have the password in a signing flow that bootstraps session management. The other key is actually the data encryption key. These keys are never sent to Skiff's servers and this generation happens all in the browser.
Lavabit really failed fundamentally in having actual end to end encryption because the password was sent to the server.
Skiff's password mechanism actually solves this flaw cryptographically using known, established primitives.
We use argon2id to take password and turn it into two cryptographic keys. One key is used for an SRP scheme to prove you have the password in a signing flow that bootstraps session management. The other key is actually the data encryption key. These keys are never sent to Skiff's servers and this generation happens all in the browser.
Lavabit really failed fundamentally in having actual end to end encryption because the password was sent to the server.
[1] https://arstechnica.com/information-technology/2013/11/op-ed....