6 ms·

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry ab

by kgilpin 11y ago

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

valarauca1 11y ago
But then you can't leverage customer data to sell to advertisers. The problem is, you are the product for most internet companies. Think of a Cow in a barn. The food/water/shelter is free, because you are what's to be sold.
- reitanqild 11y ago
  This meme got old faster than I expected. I am the only one that is aware of symbiosis?
  - Super_Jambo 11y ago
    Well it doesn't seem inaccurate to suggest that livestock has a symbiotic relationship with humans. Yes we do slaughter them for food but think of the benefits during the cows life!
    - reitanqild 11y ago
      I give you points for that. Still arguing that life in Googles and lately Microsofts barn is quite comfortable and a whole lot a safer than outside because those companies has a huge interest on securing their users
      - EGreg 11y ago
        Security is one of the hardest things to decentralize. Would you rather trust Google or a rinkydink website with your data? They may not have even installed the latest patches of their open source software! Bitcoin decentralized money. Until now, social has not been decentralized effectively. Security is even harder, perhaps! Because it requires authentication but also a clear definition of guarantees, including availability! Perhaps your data could be stored on your computer and other replicas can be stored encrypted in the network, like freenet, but encrypted only by you. And your key would be a hash of your passphrase like "all horses are fine". If that guy's bitcoin key had been a result of a hashed passphrase, he wouldn't have lost $3 million in the garbage!
  - valarauca1 11y ago
    >symbiosis It exists in 3 forms. 1) Both benefit (I.E.: mutualistic) 2) Only 1 benefits while the other has no clue of its usage (I.E.: commensalism). Vultures and Lions more or less, or hermit crabs and shell fish which are dead. 3) One actively benefits while the other is consumed by the active particpant (I.E.: Paracitism). :.:.: Your argument is that webscale logging is mutualistic. To an extent I'll agree. But this isn't the case. Google is mutualistic when using say GWallet, Docs, Mail, search etc. But Like/Plus buttons, as well as cookie sniffing isn't mutualistic. Its commensalism. I have no say if another organism uses what I leave behind, it doesn't directly effect me, but it benefits another organism.
- Karunamon 11y ago
  If by "you", you mean aggregated data about you in lieu of cash payment. Google/Facebook/etc are not selling your data, they are not selling you, they are selling access to you via advertisers, more specifically, they are selling access to people who like certain things and who live in certain areas who have certain demographic profiles. If you're curious about this, go sign up for an Adwords account and see how the targeting works - what you see there is the limit of what any advertiser using Google sees about its users. Facebook is much the same. Get it right. Any ad-backed company of note does not "sell your data" and characterizing it as such is so divorced from reality as to be a blatant, willful lie.
  - deleted 11y ago
    [deleted]
    - Karunamon 11y ago
      Any inferring is being done by the ad company, not the advertiser. And framing this as discrimination (a loaded term nowadays) is just more hyperbole, IMO. People of different races, orientations, religions etc are very likely to view different things as relevant, and at the end of the day, relevance is what any advertising company's mission in life is. Best of all, it's all supposed to be data driven, so those nasty human biases don't even creep in. If demographic X clicks on a thing more than demographic Y, at the end of the day, that is what matters, and we can sidestep any discussions of bias, regardless if the demographic under consideration is young/old, black/white, atheist/religious, rich/poor, male/female.
  - notahacker 11y ago
    Not only would "selling your data" as opposed to access to you or a per click basis be a less profitable business model, it'd also be strictly illegal in many jurisdictions without explicit opt-in permission.
    - belorn 11y ago
      In those countries that it is illegal to sell personal data, what kind of abuse are they intending to prevent? Any abuse which is possible by having direct access to private data is also possible to do by going through a intermediate which does the data mining for you.
lallysingh 11y ago
The larger issue is that you now have to push key management to the user, and the support problems that go with that. Key management is hard and painful. Telling a customer that they can't access their data on your service because they broke their laptop is going to make them very unhappy. Otherwise, there'd be plenty of services competing with Drive, DropBox, etc, that did just that.
- pdkl95 11y ago
  > push key management to the user There is no other way. Unfortunately, there has been a serious lack of r&d in this area, so we have a lot of catching up to do. I believe it can be made to work, though, because this is not entirely a new idea for most people: they already understand physical keys and the problems associated with losing them. Moving to digital (public-)keys isn't a perfect match, but it is entirely possible to leverage the skills and experience that people already have. For example, contrary to the advice used a decade ago, Schneier recommends[1] that people write down their passwords (avoiding the memorization problem). This can provide good enough security most of the time, because people already understand how to provide security for their wallet. Incidentally, I always liked the basic idea of the Java Ring[2]. It was basically a fancy (for the time) smart card, but the idea of storing the chip in a ring is an attempt to make security management personal, which is an idea that had potential. [1] https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... [2] http://www.javaworld.com/article/2076641/learn-java/an-introduction-to-the-java-ring.html http://www.javaworld.com/article/2076641/learn-java/an-intro... edit: forgot a link
  - NoGravitas 11y ago
    I generally agree with you, but there's one problem with the physical key analogy. The security of physical keys is weak enough that there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. You can't do this with digital keys because a digital key that is weak enough for this strategy to be usable is also too weak to protect you from the main class of attacks it's supposed to be protecting you from.
protomyth 11y ago
Tarsnap (a service that acts like your description) is quite nice, but the problem of "customer lost the keys" is a very real one. I love the idea, but someone really needs to come up with some decent key management (and offline backup and key migration) to make this consumer friendly.
- bertomartin 11y ago
  Then, we need a good service to store keys, with a key to get to your key
  - toyg 11y ago
    And that will be a sweet, sweet target...
  - jfindley 11y ago
    I wrote a PoC app [0] a while ago to do just this - allow storing and sharing of keys, with the server holding the encrypted keys never seeing the decryption key. Sharing a key involves downloading it from the server, asymetrically encrypting it with the public key of the reciever, and uploading to the server again. It also allowed sharing with groups via intermediate keys decrypt-able by multiple users. Obviously it's just a PoC - noone should use it for actually important data, and I certainly don't promise that it's actually secure - but it does (more or less) work. As it requires client-side crypto, it's not an ideal candidate for a web-service either (although one could potentially use browser extensions to make that more reasonable). 0: https://github.com/jfindley/skds https://github.com/jfindley/skds
  - kgilpin 11y ago
    Can't this just be my phone?
    - Filligree 11y ago
      And when your phone breaks...?
- 11y ago
ddlatham 11y ago
If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.
- rayiner 11y ago
  There is no reason that stuff can't be done on the client side. Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.
  - dogma1138 11y ago
    Outlook also downloads and stores the emails locally, if the emails isn't in the PST the search takes ages and if you don't use recent versions of Exchange with all their bells and whistles and full indexing then finding anything is near impossible (e.g. searching within attachments). No one will use Gmail if they need to download GB's of Junk they haven't cleared in 10 years to find an email for 2 months ago, not to mention that any type of sharing will force major duplication as well as require you to download and generate new copies with each person you want to share it with.
  - ddlatham 11y ago
    Not true - there are reasons not to do it on the client instead. Consider a web email client instead. It's not feasible to login to the site, download a full archive of your email, decrypt it, and index it before being able to do a search.
    - xj9 11y ago
      IndexedDB[1] sort of makes that a non-issue, doesn't it? [1]: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_A...
      - Klathmon 11y ago
rayiner 11y ago
What's crazy is that it often just isn't an option. Precisely for some of the reasons outlined in the above article (third party records are subject to subpoena pretty much everywhere, not just the U.S.) it's untenable in certain fields to keep sensitive information on the cloud. Those concerns would be dramatically mitigated if at least there was an option to do client-side encryption. That way the government has to get jurisdiction over your person to get you to turn over the encryption keys, which puts you on much stronger legal footing.
jo909 11y ago
That works for file and message/mail contents, and there already are functional external solutions for that (f.e. GPG). I agree that needs to be better integrated and supported. But Google needs to know my search query to be able to serve me a results page. Google will know my phones location if I use their WiFi-positioning-system. Google needs to know my address and payment information to have me buy apps. Encryption can not help me here. I need to be able to trust Google not to collect that data without my consent, that they do not store that data longer than needed to provide me the service and that they do not share that data with anybody that has no right to it. That can only be guaranteed by laws. This is about laws, and the need for such laws will not go away by encryption alone.
MichaelGG 11y ago
Right, and how would that be implemented, in, say, a web browser? Do you really think that the government that's forcing all this secret spying would just give up? Or more likely, would they require modifications to the software to leak the key or plaintext? How would users verify that the software was working securely? A webmail provider would need to publish a full client-server API and protocol spec, so that you could run some independent software to audit what was being sent to be sure no leakage was happening. This is simply untenable. Oh and what would really happen is that everyone would lose access to their data since, in general, nobody is able to maintain keys. It's pretty understandable that companies have little desire to redesign their whole systems to provide a crappy experience to a nearly non-existent market segment.
phkahler 11y ago
>> If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. There is no value to the company in doing that. They can't mine the communications to determine what ads to serve you, or anything else. At that point they'd just be offering a free service. Why?
- kgilpin 11y ago
  Sure they can. They want to run a job, they can get the key from me and run it. This can be transparent to me; eg my phone could transmit them the key every day until I decide to stop. So many people are saying "your proposal breaks cloud services or requires client side compute", but that's not true. Be more imaginative and get outside the current model.
fauigerzigerk 11y ago
They also wouldn't make any money from advertising and the government would pretty soon outlaw the practice.
- morninj 11y ago
  Some actors in the US government have been trying to outlaw consumer cryptography for decades, and so far they haven't succeeded. See, e.g., the Clipper Chip battle from 1994.
  - fauigerzigerk 11y ago
    Exactly, but that's because so few people are actually using end to end cryptography. Now imagine the internet giants had petabytes of encrypted data in their data centers. Apart from the fact that it's completely impractical because that data can't be used for anything other than downloading, it would give a huge boost to those in the government (or governments actually) who want to outlaw it. From a somewhat elitist perspective I actually prefer the status quo. At least, today, we have backup services like SpiderOak or tarsnap and we can use encrypted email (I don't) or other communications software.
vilmosi 11y ago
But then a lot of things wouldn't be able to exist. Siri needs collective anonymous data to work and improve itself. Ads, like them or not, cannot function without large collections of data. No attempt to predict customer behaviour is possible, no usage analytics, no cutting edge improvements, a lot of cool things wouldn't be possible. It's just how it is.

by kgilpin 11y ago

valarauca1 11y ago

But then you can't leverage customer data to sell to advertisers. The problem is, you are the product for most internet companies. Think of a Cow in a barn. The food/water/shelter is free, because you are what's to be sold.

reitanqild 11y ago
This meme got old faster than I expected. I am the only one that is aware of symbiosis?
- Super_Jambo 11y ago
  Well it doesn't seem inaccurate to suggest that livestock has a symbiotic relationship with humans. Yes we do slaughter them for food but think of the benefits during the cows life!
  - reitanqild 11y ago
    I give you points for that. Still arguing that life in Googles and lately Microsofts barn is quite comfortable and a whole lot a safer than outside because those companies has a huge interest on securing their users
    - EGreg 11y ago
      Security is one of the hardest things to decentralize. Would you rather trust Google or a rinkydink website with your data? They may not have even installed the latest patches of their open source software! Bitcoin decentralized money. Until now, social has not been decentralized effectively. Security is even harder, perhaps! Because it requires authentication but also a clear definition of guarantees, including availability! Perhaps your data could be stored on your computer and other replicas can be stored encrypted in the network, like freenet, but encrypted only by you. And your key would be a hash of your passphrase like "all horses are fine". If that guy's bitcoin key had been a result of a hashed passphrase, he wouldn't have lost $3 million in the garbage!
- valarauca1 11y ago
  >symbiosis It exists in 3 forms. 1) Both benefit (I.E.: mutualistic) 2) Only 1 benefits while the other has no clue of its usage (I.E.: commensalism). Vultures and Lions more or less, or hermit crabs and shell fish which are dead. 3) One actively benefits while the other is consumed by the active particpant (I.E.: Paracitism). :.:.: Your argument is that webscale logging is mutualistic. To an extent I'll agree. But this isn't the case. Google is mutualistic when using say GWallet, Docs, Mail, search etc. But Like/Plus buttons, as well as cookie sniffing isn't mutualistic. Its commensalism. I have no say if another organism uses what I leave behind, it doesn't directly effect me, but it benefits another organism.
Karunamon 11y ago
If by "you", you mean aggregated data about you in lieu of cash payment. Google/Facebook/etc are not selling your data, they are not selling you, they are selling access to you via advertisers, more specifically, they are selling access to people who like certain things and who live in certain areas who have certain demographic profiles. If you're curious about this, go sign up for an Adwords account and see how the targeting works - what you see there is the limit of what any advertiser using Google sees about its users. Facebook is much the same. Get it right. Any ad-backed company of note does not "sell your data" and characterizing it as such is so divorced from reality as to be a blatant, willful lie.
- deleted 11y ago
  [deleted]
  - Karunamon 11y ago
    Any inferring is being done by the ad company, not the advertiser. And framing this as discrimination (a loaded term nowadays) is just more hyperbole, IMO. People of different races, orientations, religions etc are very likely to view different things as relevant, and at the end of the day, relevance is what any advertising company's mission in life is. Best of all, it's all supposed to be data driven, so those nasty human biases don't even creep in. If demographic X clicks on a thing more than demographic Y, at the end of the day, that is what matters, and we can sidestep any discussions of bias, regardless if the demographic under consideration is young/old, black/white, atheist/religious, rich/poor, male/female.
- notahacker 11y ago
  Not only would "selling your data" as opposed to access to you or a per click basis be a less profitable business model, it'd also be strictly illegal in many jurisdictions without explicit opt-in permission.
  - belorn 11y ago
    In those countries that it is illegal to sell personal data, what kind of abuse are they intending to prevent? Any abuse which is possible by having direct access to private data is also possible to do by going through a intermediate which does the data mining for you.

lallysingh 11y ago

The larger issue is that you now have to push key management to the user, and the support problems that go with that. Key management is hard and painful. Telling a customer that they can't access their data on your service because they broke their laptop is going to make them very unhappy. Otherwise, there'd be plenty of services competing with Drive, DropBox, etc, that did just that.

pdkl95 11y ago
> push key management to the user There is no other way. Unfortunately, there has been a serious lack of r&d in this area, so we have a lot of catching up to do. I believe it can be made to work, though, because this is not entirely a new idea for most people: they already understand physical keys and the problems associated with losing them. Moving to digital (public-)keys isn't a perfect match, but it is entirely possible to leverage the skills and experience that people already have. For example, contrary to the advice used a decade ago, Schneier recommends[1] that people write down their passwords (avoiding the memorization problem). This can provide good enough security most of the time, because people already understand how to provide security for their wallet. Incidentally, I always liked the basic idea of the Java Ring[2]. It was basically a fancy (for the time) smart card, but the idea of storing the chip in a ring is an attempt to make security management personal, which is an idea that had potential. [1] https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... [2] http://www.javaworld.com/article/2076641/learn-java/an-introduction-to-the-java-ring.html http://www.javaworld.com/article/2076641/learn-java/an-intro... edit: forgot a link
- NoGravitas 11y ago
  I generally agree with you, but there's one problem with the physical key analogy. The security of physical keys is weak enough that there's always a fallback if you lose all the copies of your key: you pay a locksmith to come pick the lock and rekey it. You can't do this with digital keys because a digital key that is weak enough for this strategy to be usable is also too weak to protect you from the main class of attacks it's supposed to be protecting you from.

protomyth 11y ago

Tarsnap (a service that acts like your description) is quite nice, but the problem of "customer lost the keys" is a very real one. I love the idea, but someone really needs to come up with some decent key management (and offline backup and key migration) to make this consumer friendly.

bertomartin 11y ago
Then, we need a good service to store keys, with a key to get to your key
- toyg 11y ago
  And that will be a sweet, sweet target...
- jfindley 11y ago
  I wrote a PoC app [0] a while ago to do just this - allow storing and sharing of keys, with the server holding the encrypted keys never seeing the decryption key. Sharing a key involves downloading it from the server, asymetrically encrypting it with the public key of the reciever, and uploading to the server again. It also allowed sharing with groups via intermediate keys decrypt-able by multiple users. Obviously it's just a PoC - noone should use it for actually important data, and I certainly don't promise that it's actually secure - but it does (more or less) work. As it requires client-side crypto, it's not an ideal candidate for a web-service either (although one could potentially use browser extensions to make that more reasonable). 0: https://github.com/jfindley/skds https://github.com/jfindley/skds
- kgilpin 11y ago
  Can't this just be my phone?
  - Filligree 11y ago
    And when your phone breaks...?
11y ago

ddlatham 11y ago

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

rayiner 11y ago
There is no reason that stuff can't be done on the client side. Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.
- dogma1138 11y ago
  Outlook also downloads and stores the emails locally, if the emails isn't in the PST the search takes ages and if you don't use recent versions of Exchange with all their bells and whistles and full indexing then finding anything is near impossible (e.g. searching within attachments). No one will use Gmail if they need to download GB's of Junk they haven't cleared in 10 years to find an email for 2 months ago, not to mention that any type of sharing will force major duplication as well as require you to download and generate new copies with each person you want to share it with.
- ddlatham 11y ago
  Not true - there are reasons not to do it on the client instead. Consider a web email client instead. It's not feasible to login to the site, download a full archive of your email, decrypt it, and index it before being able to do a search.
  - xj9 11y ago
    IndexedDB[1] sort of makes that a non-issue, doesn't it? [1]: https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_A...
    - Klathmon 11y ago

rayiner 11y ago

What's crazy is that it often just isn't an option. Precisely for some of the reasons outlined in the above article (third party records are subject to subpoena pretty much everywhere, not just the U.S.) it's untenable in certain fields to keep sensitive information on the cloud. Those concerns would be dramatically mitigated if at least there was an option to do client-side encryption. That way the government has to get jurisdiction over your person to get you to turn over the encryption keys, which puts you on much stronger legal footing.

jo909 11y ago

That works for file and message/mail contents, and there already are functional external solutions for that (f.e. GPG). I agree that needs to be better integrated and supported. But Google needs to know my search query to be able to serve me a results page. Google will know my phones location if I use their WiFi-positioning-system. Google needs to know my address and payment information to have me buy apps. Encryption can not help me here. I need to be able to trust Google not to collect that data without my consent, that they do not store that data longer than needed to provide me the service and that they do not share that data with anybody that has no right to it. That can only be guaranteed by laws. This is about laws, and the need for such laws will not go away by encryption alone.

MichaelGG 11y ago

Right, and how would that be implemented, in, say, a web browser? Do you really think that the government that's forcing all this secret spying would just give up? Or more likely, would they require modifications to the software to leak the key or plaintext? How would users verify that the software was working securely? A webmail provider would need to publish a full client-server API and protocol spec, so that you could run some independent software to audit what was being sent to be sure no leakage was happening. This is simply untenable. Oh and what would really happen is that everyone would lose access to their data since, in general, nobody is able to maintain keys. It's pretty understandable that companies have little desire to redesign their whole systems to provide a crappy experience to a nearly non-existent market segment.

phkahler 11y ago

>> If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. There is no value to the company in doing that. They can't mine the communications to determine what ads to serve you, or anything else. At that point they'd just be offering a free service. Why?

kgilpin 11y ago
Sure they can. They want to run a job, they can get the key from me and run it. This can be transparent to me; eg my phone could transmit them the key every day until I decide to stop. So many people are saying "your proposal breaks cloud services or requires client side compute", but that's not true. Be more imaginative and get outside the current model.

fauigerzigerk 11y ago

They also wouldn't make any money from advertising and the government would pretty soon outlaw the practice.

morninj 11y ago
Some actors in the US government have been trying to outlaw consumer cryptography for decades, and so far they haven't succeeded. See, e.g., the Clipper Chip battle from 1994.
- fauigerzigerk 11y ago
  Exactly, but that's because so few people are actually using end to end cryptography. Now imagine the internet giants had petabytes of encrypted data in their data centers. Apart from the fact that it's completely impractical because that data can't be used for anything other than downloading, it would give a huge boost to those in the government (or governments actually) who want to outlaw it. From a somewhat elitist perspective I actually prefer the status quo. At least, today, we have backup services like SpiderOak or tarsnap and we can use encrypted email (I don't) or other communications software.

vilmosi 11y ago

But then a lot of things wouldn't be able to exist. Siri needs collective anonymous data to work and improve itself. Ads, like them or not, cannot function without large collections of data. No attempt to predict customer behaviour is possible, no usage analytics, no cutting edge improvements, a lot of cool things wouldn't be possible. It's just how it is.