4 ms·

Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo

by kebman 4y ago

Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo! Here is the knight in shining armour coming to the rescue (FHE)! Soon. Maybe.

foolfoolz 4y ago
fhe solves a ton of issues in sass products that don’t look great under audit. things where we sign off on audit today with fancy contracts called “data privacy agreements.” i think it will take some time (20 years?) but i expect zero knowledge for most of your data to be table stakes for saas offerings
- autoexec 4y ago
  Saas is all about collecting, controlling, and exploiting your data though. If they can still mine your data and leverage or sell the information they get out of it that's not really "zero knowledge". I don't expect companies will stop being interested in making money at all costs in 20 years, especially where the costs are mostly to you and your privacy.
  - solveit 4y ago
    Actually saas is about providing services for money.
    - autoexec 4y ago
      Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the rule.
      - rowanG077 4y ago
        This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.
        autoexec 4y ago
        I guess that's fair... ultimately money is everything, but I do think there are absolutely companies who highly value the control aspect as well. It can give them the ability to censor, act as a gatekeeper, and nickel and dime. Saas seems a lot more predatory and risky than most products/services. You hand over money, you hand over control, you hand over your data and all of it leaves you varying degrees of vulnerable. I guess I shouldn't expect a pragmatic view of saas to be popular around here (some of you are likely working on your own saas projects after all), but the reasons saas is attractive for companies to offer are the same reasons that make me hesitate to use them.
        dougk16 4y ago
        Money is the goal of the individual Cogs in the machine. Control is the goal of the machine itself, which uses money to incentivize (power) its Cogs. If you're a Big Tech company you essentially have endless free money to leverage compared to your Cogs. The machine itself doesn't care about money. That free money train is coming to an end though over the next decade. Or at least that's the reality I'm planning for. :)
    - bawolff 4y ago
      Typically that "service" involves doing something with the data server side (such as displaying it in a slick website). FHE does have potential applicability here, but i think the potential is a bit overblown because there are a lot of devil in the details issues.
not2b 4y ago
No, the point of FHE isn't that regular encryption is already compromised. It's that you can do processing on encrypted data while it's encrypted, without decrypting it. This opens up many more possibilities. For example, a cloud provider might store your data only in encrypted form and you can still do queries to pick out particular data or do some basic analysis, with the algorithm running on cloud computers, the result delivered to you in encrypted form, which you then decrypt with your private key. The only problem is that there's a large performance penalty still, though there has been major progress in making it more efficient.
- yazzku 4y ago
  The article does put quite a lot of emphasis on "soon broken" encryption algorithms, so can't blame kebman for that comment. It only mentions what you pointed out almost in passing. Also not an expert here, but if "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data", then you'd be a fool to believe this will protect your privacy, right? Or am I missing something? I want encryption that protects me from corporations, not encryption that protects the data corporations have from us and ups their surveillance game. I guess it's no coincidence a lot of research seems to be done by M$.
  - not2b 4y ago
    If FHE could be made to work (and we are a long way off), the cloud provider would not be able to see your data even though you're doing processing on the data that remains on the cloud provider's CPUs, so in that sense it would protect you from Amazon/Google/Microsoft/plug in your cloud provider here.
    - yazzku 4y ago
      Then how can they extract "insights" from the data if they can't see the data? At what point do the "insights" defeat the purpose of protecting your data from the cloud provider? Or are the claims in the article bogus?

by kebman 4y ago

foolfoolz 4y ago

fhe solves a ton of issues in sass products that don’t look great under audit. things where we sign off on audit today with fancy contracts called “data privacy agreements.” i think it will take some time (20 years?) but i expect zero knowledge for most of your data to be table stakes for saas offerings

autoexec 4y ago
Saas is all about collecting, controlling, and exploiting your data though. If they can still mine your data and leverage or sell the information they get out of it that's not really "zero knowledge". I don't expect companies will stop being interested in making money at all costs in 20 years, especially where the costs are mostly to you and your privacy.
- solveit 4y ago
  Actually saas is about providing services for money.
  - autoexec 4y ago
    Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the rule.
    - rowanG077 4y ago
      This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.
      - autoexec 4y ago
        I guess that's fair... ultimately money is everything, but I do think there are absolutely companies who highly value the control aspect as well. It can give them the ability to censor, act as a gatekeeper, and nickel and dime. Saas seems a lot more predatory and risky than most products/services. You hand over money, you hand over control, you hand over your data and all of it leaves you varying degrees of vulnerable. I guess I shouldn't expect a pragmatic view of saas to be popular around here (some of you are likely working on your own saas projects after all), but the reasons saas is attractive for companies to offer are the same reasons that make me hesitate to use them.
      - dougk16 4y ago
        Money is the goal of the individual Cogs in the machine. Control is the goal of the machine itself, which uses money to incentivize (power) its Cogs. If you're a Big Tech company you essentially have endless free money to leverage compared to your Cogs. The machine itself doesn't care about money. That free money train is coming to an end though over the next decade. Or at least that's the reality I'm planning for. :)
  - bawolff 4y ago
    Typically that "service" involves doing something with the data server side (such as displaying it in a slick website). FHE does have potential applicability here, but i think the potential is a bit overblown because there are a lot of devil in the details issues.

not2b 4y ago

No, the point of FHE isn't that regular encryption is already compromised. It's that you can do processing on encrypted data while it's encrypted, without decrypting it. This opens up many more possibilities. For example, a cloud provider might store your data only in encrypted form and you can still do queries to pick out particular data or do some basic analysis, with the algorithm running on cloud computers, the result delivered to you in encrypted form, which you then decrypt with your private key. The only problem is that there's a large performance penalty still, though there has been major progress in making it more efficient.

yazzku 4y ago
The article does put quite a lot of emphasis on "soon broken" encryption algorithms, so can't blame kebman for that comment. It only mentions what you pointed out almost in passing. Also not an expert here, but if "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data", then you'd be a fool to believe this will protect your privacy, right? Or am I missing something? I want encryption that protects me from corporations, not encryption that protects the data corporations have from us and ups their surveillance game. I guess it's no coincidence a lot of research seems to be done by M$.
- not2b 4y ago
  If FHE could be made to work (and we are a long way off), the cloud provider would not be able to see your data even though you're doing processing on the data that remains on the cloud provider's CPUs, so in that sense it would protect you from Amazon/Google/Microsoft/plug in your cloud provider here.
  - yazzku 4y ago
    Then how can they extract "insights" from the data if they can't see the data? At what point do the "insights" defeat the purpose of protecting your data from the cloud provider? Or are the claims in the article bogus?