4 ms·

Just wondering, is it possible to design software where the data is visible to the software but not to a human (the programmer). I could see a system where the

by boznz 9y ago

Just wondering, is it possible to design software where the data is visible to the software but not to a human (the programmer). I could see a system where the private key is generated and stored in RAM and all the data is encrypted but the first update or power event would destroy the data. Just a thought experiment.

pjc50 9y ago
Two approaches: "trustzone"-style systems where the data is inaccessible to everything but the secure processor, or homomorphic encryption. But on the first, software updates present a problem. You can make the system only accept signed updates, but then the programmer can just replace the program with "please print all your secure data". Variants of this technique have been used to break all sorts of things, from arcade machines to payment cards. So if you want the data not to be visible to the programmer, you can never update the software. Homomorphic encryption theoretically hides the data from the program, but is extremely inefficient and I'm not aware of any widely deployed use.
- kobeya 9y ago
  Homomorphic encryption is behind some crypto currency stuff like zcash, but that’s about it. It is many orders of magnitude slower.
kelnos 9y ago
There was mention of the idea of data being (or not being) accessible to someone while in the US. It seems like it would be possible to design the system so no one in the US has "admin access" to the data in question. VPNs and firewalls restrict access to the data such that only someone physically in the EU can access it. An end-user with the account password could access their email or whatever through normal means from anywhere, but that would be it. Not sure if this is possible, considering you can always make the argument that the employees in the EU with access are subordinate at least to the US-residing CEO, who could order them to fetch and send the data.
user5994461 9y ago
No, there is always a programmer, a sysadmin or an operator who is in control of a program. Software cannot deploy and maintain themselves. It's possible to completely cut access to a system, for example you lose the only SSH key. It would continue to run and service users, but it is inoperable on an operational point of view.
- boznz 9y ago
  What about a shared key (like launching a nuke) so long as everyone in the key-list distrusts each other wouldn't something like that work ? (Totally outside my technical comfort zone here so forgive stupidity!)
- kobeya 9y ago
  This is incorrect. Research homomorphic encryption sometime. It’s very inefficient though.
bigiain 9y ago
While this is an interesting thought experiment - technical solutions to political/government overreach are not the right answer.

by boznz 9y ago

pjc50 9y ago

Two approaches: "trustzone"-style systems where the data is inaccessible to everything but the secure processor, or homomorphic encryption. But on the first, software updates present a problem. You can make the system only accept signed updates, but then the programmer can just replace the program with "please print all your secure data". Variants of this technique have been used to break all sorts of things, from arcade machines to payment cards. So if you want the data not to be visible to the programmer, you can never update the software. Homomorphic encryption theoretically hides the data from the program, but is extremely inefficient and I'm not aware of any widely deployed use.

kobeya 9y ago
Homomorphic encryption is behind some crypto currency stuff like zcash, but that’s about it. It is many orders of magnitude slower.

kelnos 9y ago

There was mention of the idea of data being (or not being) accessible to someone while in the US. It seems like it would be possible to design the system so no one in the US has "admin access" to the data in question. VPNs and firewalls restrict access to the data such that only someone physically in the EU can access it. An end-user with the account password could access their email or whatever through normal means from anywhere, but that would be it. Not sure if this is possible, considering you can always make the argument that the employees in the EU with access are subordinate at least to the US-residing CEO, who could order them to fetch and send the data.

user5994461 9y ago

No, there is always a programmer, a sysadmin or an operator who is in control of a program. Software cannot deploy and maintain themselves. It's possible to completely cut access to a system, for example you lose the only SSH key. It would continue to run and service users, but it is inoperable on an operational point of view.

boznz 9y ago
What about a shared key (like launching a nuke) so long as everyone in the key-list distrusts each other wouldn't something like that work ? (Totally outside my technical comfort zone here so forgive stupidity!)
kobeya 9y ago
This is incorrect. Research homomorphic encryption sometime. It’s very inefficient though.

bigiain 9y ago

While this is an interesting thought experiment - technical solutions to political/government overreach are not the right answer.