6 ms·
How are you going to figure out a specific user's content size (of a specific app or content type) from a sea of encrypted exabytes? What about this is practic
by manigandham 5y ago
How are you going to figure out a specific user's content size (of a specific app or content type) from a sea of encrypted exabytes?
What about this is practical?
- fulafel 5y agoI'm just sketching something, I'm not claiming to have developed a vulnerability research result here from my arm chair. But there's a lot of terrain between "it's encrypted so there are no attack" and "you haven't presented a fully developed attack" especially about a system we don't know much about. Anyway, there are many scenarios that come to mind for knowing their IO sizes. Apps probably have IO fingerprints. Or you could send the set of suspected users differently sized files to probe them. Etc.
- manigandham 5y agoBasic batching or partitioning of data before offloading to storage would defeat this analysis, and that’s assuming you can access and query so much data regularly. I asked for practical examples. I don’t need an in-depth report to see that this doesn’t qualify. Most of this crypto stuff is completely impractical risk, especially compared to some phishing emails.
- fulafel 5y agoIn security engineering we have the standard the other way around - the proponents of a design have the burden of responsibility to argue the system is secure beyond reasonable doubt, and address and elucidate any potential cracks in the security design. The subthread was about potential pitfalls even in presence of encryption.