4 ms·

It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Whether it's an author's novel or a shopper's purchase

by lukifer 14y ago

It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Whether it's an author's novel or a shopper's purchase history, once the data is released to someone in a readable format, they are unable to stop the recipient from doing something they don't like with that data. Granted, the issue can be mitigated with trust networks, social conventions, or laws, but it comes down the same issues faced by DRM media formats: if someone can consume the content, they can find a way to duplicate the content.

anthonyb 14y ago
I think security of data is where a lot of the open source networks have fallen down. (I'm thinking Diaspora and their SSL-encypted node). Because you shouldn't be trying to close the analog hole, it's essentially impossible (just look at sites like failbook). Instead you should be trying to be about as secure as email, and allow other people to secure it if that's what they want to try and do.
knowtheory 14y ago
I've discussed this in the past with tent's authors, and that is a characteristic they not only tolerate but encourage (for better or worse). Operating with these assumptions means that the things that you make public are totally and incontrovertibly public. It is, in a manner of speaking, playing for keeps.
gizmo686 14y ago
Just because you cannot prevent all threat models, does not mean you through privacy out the window. For example, if Alice wants to send Bob a message, in the current system: 1) Alice tells Facebook she wants to friend Bob 2) Facebook tells Bob, who accepts 3) Alice sends Facebook the message addressed to Bob (I think in plaintext) 4) Facebook sends the message to Bob. 5) The message is still unencrypted on Facebook servers, where it is available to Facebook, advertisers, hackers, and government agencies Using known cryptographic methods, we can construct a system that works as follows: 1) Alice looks up Bob's public key (or gets it from Bob to avoid needing a trusted key service) 2) Using Bob's public key, Alice encrypts a message 3) Alice sends the encrypted message into the network, addressed to Bob 4) Using his private key, Bob decrypts the message In the second example, the recipient (Bob) is the only one who can release the data. In the first example, a number of potentially malicious parties have access to the data without corporation from Alice or Bob. I used a direct message for simplicity, but we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it.
- e12e 14y ago
  Just FYI: With facebook now (for quite some time) integrating/implementing Jabber/XMPP -- OTR (Off the record messaging) works fine with facebook messages right now, if both users connect to facebook chat with something like Pidgin. I guess the deniability part is sort of out the window, seeing as how facebook will be logging the traffic pattern(s) -- but you might at least claim that "no, that wasn't what I said".
- graue 14y ago
  > we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it. This doesn't solve the problem you're responding to: "once data is given out, it can never be retracted". That remains the case. If you encrypt your photo so that each of your 770 friends can decrypt it, but then you unfriend Bob for being a jerk, he's still got the key and the encrypted data. So he still sees that photo. In contrast, although you could theoretically save every photo and update anyone ever lets you see on Facebook, it would be difficult enough that in practice no one does.
  - gizmo686 14y ago
    > In contrast, although you could theoretically save every photo and update anyone ever lets you see on Facebook, it would be difficult enough that in practice no one does. Actually, facebook does, and that information is (potentially) available to third parties. The intent of my system is that in order for information to leek, you would need to have one of your trusted recipients be compromised.
    - graue 14y ago
      If you're thinking in terms of Facebook showing deleted updates to law enforcement to track down activists — or some rogue employee at Facebook HQ taking a peek — then we're talking about totally different levels of paranoia. Sure, that is a legitimate concern for the relative few who have something to fear from powerful governments. For the rest of us, though, someone we unfriend (an ex-partner, for example) being able to archive and still access all of our old photos/updates is a much bigger concern. I argue that distributed social software should follow Facebook's lead and offer a sane default of not having such an archiving feature, and not going out of its way to make it particularly easy to add one, either. Otherwise the "creepy" aspect of not being able to rescind access to your photos/updates is going to be a serious downside to this new network, and could keep people from using it. Edited to add: Also, what's more secure in theory isn't always more secure in practice. Moxie Marlinspike observed that the original version of Cryptocat (which did end-to-end encryption in JS) was potentially less safe than Gchat. Why? Because if you compromised Cryptocat's server, you could make it serve JS with a hidden backdoor. And Cryptocat, being a one-man shop, would likely be a softer target than a company like Google, which has had plenty of time and expertise hardening their systems. How much do you trust the guy behind Cryptocat, versus Google with their reputation to protect? Along the same lines, imagine you use a hosted Tent server for social networking — you don't have time to bother running your own server, but you've heard Tent keeps your data safe from Facebook, so it'll protect your privacy better, right? But then the random guy hosting your Tent account turns around and leaks your info. Or he's running old software with a vulnerability in it, and gets pwned. Suddenly hackers have all your data. Would that have happened on Facebook? When I was curious about signing up with Diaspora, one of the open community pods had a cheeky note from the server admin saying basically that he would peek in and read your stuff if he felt like it. So this is not entirely hypothetical. I'm a huge fan of efforts like Tent, but let's not forget there are upsides to Facebook and Google's stewardship, and an alternative system can easily have as many privacy/security cons as it does pros. Tread carefully.
radtad 14y ago
This may be naive but isn't this just an endemic problem for all social networks. Anything I share on a social network can be copied by people allowed to view it and dispersed. Doesn't it just fall on trusting those you share with? If not, what is the difference?
nahname 14y ago
I think the issue of everyone storing data in their own custom format would kill it well before that surfaced.
wamatt 14y ago
> It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Isn't Twitter the same though? Deleted tweet's have a way of staying around... :P
deleted 14y ago
[deleted]
rhinosix 14y ago
In this scenario instead of releasing a novel, it would be more like allowing a manuscript to be read with an attached NDA. If an individual owns their own data, they can make a service click the 'I agree' button, and set their own standards on security, data handling, sharing with third parties, and so on. Yes, they may be able to copy parts of your data and share it with third parties, but you would have grounds to hold them accountable.

by lukifer 14y ago

anthonyb 14y ago

I think security of data is where a lot of the open source networks have fallen down. (I'm thinking Diaspora and their SSL-encypted node). Because you shouldn't be trying to close the analog hole, it's essentially impossible (just look at sites like failbook). Instead you should be trying to be about as secure as email, and allow other people to secure it if that's what they want to try and do.

knowtheory 14y ago

I've discussed this in the past with tent's authors, and that is a characteristic they not only tolerate but encourage (for better or worse). Operating with these assumptions means that the things that you make public are totally and incontrovertibly public. It is, in a manner of speaking, playing for keeps.

gizmo686 14y ago

Just because you cannot prevent all threat models, does not mean you through privacy out the window. For example, if Alice wants to send Bob a message, in the current system: 1) Alice tells Facebook she wants to friend Bob 2) Facebook tells Bob, who accepts 3) Alice sends Facebook the message addressed to Bob (I think in plaintext) 4) Facebook sends the message to Bob. 5) The message is still unencrypted on Facebook servers, where it is available to Facebook, advertisers, hackers, and government agencies Using known cryptographic methods, we can construct a system that works as follows: 1) Alice looks up Bob's public key (or gets it from Bob to avoid needing a trusted key service) 2) Using Bob's public key, Alice encrypts a message 3) Alice sends the encrypted message into the network, addressed to Bob 4) Using his private key, Bob decrypts the message In the second example, the recipient (Bob) is the only one who can release the data. In the first example, a number of potentially malicious parties have access to the data without corporation from Alice or Bob. I used a direct message for simplicity, but we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it.

e12e 14y ago
Just FYI: With facebook now (for quite some time) integrating/implementing Jabber/XMPP -- OTR (Off the record messaging) works fine with facebook messages right now, if both users connect to facebook chat with something like Pidgin. I guess the deniability part is sort of out the window, seeing as how facebook will be logging the traffic pattern(s) -- but you might at least claim that "no, that wasn't what I said".
graue 14y ago
> we do have crystallographic methods to encrypt a message such that an arbitrary group of people can decrypt it. This doesn't solve the problem you're responding to: "once data is given out, it can never be retracted". That remains the case. If you encrypt your photo so that each of your 770 friends can decrypt it, but then you unfriend Bob for being a jerk, he's still got the key and the encrypted data. So he still sees that photo. In contrast, although you could theoretically save every photo and update anyone ever lets you see on Facebook, it would be difficult enough that in practice no one does.
- gizmo686 14y ago
  > In contrast, although you could theoretically save every photo and update anyone ever lets you see on Facebook, it would be difficult enough that in practice no one does. Actually, facebook does, and that information is (potentially) available to third parties. The intent of my system is that in order for information to leek, you would need to have one of your trusted recipients be compromised.
  - graue 14y ago
    If you're thinking in terms of Facebook showing deleted updates to law enforcement to track down activists — or some rogue employee at Facebook HQ taking a peek — then we're talking about totally different levels of paranoia. Sure, that is a legitimate concern for the relative few who have something to fear from powerful governments. For the rest of us, though, someone we unfriend (an ex-partner, for example) being able to archive and still access all of our old photos/updates is a much bigger concern. I argue that distributed social software should follow Facebook's lead and offer a sane default of not having such an archiving feature, and not going out of its way to make it particularly easy to add one, either. Otherwise the "creepy" aspect of not being able to rescind access to your photos/updates is going to be a serious downside to this new network, and could keep people from using it. Edited to add: Also, what's more secure in theory isn't always more secure in practice. Moxie Marlinspike observed that the original version of Cryptocat (which did end-to-end encryption in JS) was potentially less safe than Gchat. Why? Because if you compromised Cryptocat's server, you could make it serve JS with a hidden backdoor. And Cryptocat, being a one-man shop, would likely be a softer target than a company like Google, which has had plenty of time and expertise hardening their systems. How much do you trust the guy behind Cryptocat, versus Google with their reputation to protect? Along the same lines, imagine you use a hosted Tent server for social networking — you don't have time to bother running your own server, but you've heard Tent keeps your data safe from Facebook, so it'll protect your privacy better, right? But then the random guy hosting your Tent account turns around and leaks your info. Or he's running old software with a vulnerability in it, and gets pwned. Suddenly hackers have all your data. Would that have happened on Facebook? When I was curious about signing up with Diaspora, one of the open community pods had a cheeky note from the server admin saying basically that he would peek in and read your stuff if he felt like it. So this is not entirely hypothetical. I'm a huge fan of efforts like Tent, but let's not forget there are upsides to Facebook and Google's stewardship, and an alternative system can easily have as many privacy/security cons as it does pros. Tread carefully.

radtad 14y ago

This may be naive but isn't this just an endemic problem for all social networks. Anything I share on a social network can be copied by people allowed to view it and dispersed. Doesn't it just fall on trusting those you share with? If not, what is the difference?

nahname 14y ago

I think the issue of everyone storing data in their own custom format would kill it well before that surfaced.

wamatt 14y ago

> It's a great concept, but here's where it breaks down: once data is given out, it can never be retracted. Isn't Twitter the same though? Deleted tweet's have a way of staying around... :P

deleted 14y ago

[deleted]

rhinosix 14y ago

In this scenario instead of releasing a novel, it would be more like allowing a manuscript to be read with an attached NDA. If an individual owns their own data, they can make a service click the 'I agree' button, and set their own standards on security, data handling, sharing with third parties, and so on. Yes, they may be able to copy parts of your data and share it with third parties, but you would have grounds to hold them accountable.