5 ms·
Mylar: A platform for building secure web applications
- gphilip 13y agoFrom the blurb: Mylar protects data confidentiality even when an attacker gets full access to servers. Mylar stores only encrypted data on the server, and decrypts data only in users' browsers. Simply encrypting each user's data with a user key does not suffice, and Mylar addresses three challenges in making this approach work. First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys. Second, Mylar allows users to share keys and data securely in the presence of an active adversary. Finally, Mylar ensures that client-side application code is authentic, even if the server is malicious.
- gcb0 13y agoThe encrypted multikey keyword search is very interesting, but using a certificate for code is troubling... Also there is almost no info on the way they use the browser xss protections on the scheme. It's only briefly mentioned.
- deleted 13y ago[deleted]
- khafra 13y agoPaging tptacek; come in tptacek...
- Sharma 13y agoSo someone builds a nice secure and useful framework/platform which is great. But why not put some effort to mention some more details or documentation about how to use it, sample, tutorials etc?
- gphilip 13y agoThe first paper linked from the webpage describes how to use the framework. For a specific example, see Section 8 of the paper (Building a Mylar Application) which starts with "To demonstrate how a developer can build a Mylar application, we show the changes that we made to the kChat application to encrypt messages."
- vittore 13y agoSeems if they put it in github and instead of putting everything in pdf, they would write readme.md file, they would have couple hundreds of followers
- jessaustin 13y agoIf academics in general used Github much more, they'd do much better work. Especially when there are significant amounts of code and data (e.g. for statistical analyses or simulations), keeping it all hidden pretty much guarantees there are lots of errors.
- dvorak42 13y agoThe academic world in general tends to focus on collaboration with other academics, and people in their research groups, which tends to result in people using their own internal git repo hosting infastructure, rather than external ones like Github, where anyone who wants to commit would have to create and maintain a separate Github account. Other than having a GUI and nice web interface, what are the advantages of Github over the git repo Mylar is using?
- 13y ago
- ap22213 13y ago"First, Mylar allows the server to perform keyword search over encrypted documents, even if the documents are encrypted with different keys." I thought some big tech corporation owned the patent on that.
- stusmall 13y agoI would more love to read a paper on how they do it and how much information they leak through whatever indexes they form.
- SkyMarshal 13y agoAlso of note: * https://crypton.io/ https://crypton.io/ a zero-knowledge web framework from SpiderOak * http://hails.scs.stanford.edu/ http://hails.scs.stanford.edu/ a secure web platform framework for untrusted 3rd party plugins
- jamesshamenski 13y agoIt seems absolutely ridiculous that large piles of data are being stolen by small teams of hackers. If solutions like Mylar's prevent reading of the extracted data, that sounds promising. Sure, it's just another hurdle in an attack but it's something. I wonder if we're only a few years away where technologies and practices like this become standard?
- dangerlibrary 13y agoStandard for what? For 90% of web use cases, encryption like this is overkill. Serving a blog or static page does not require this level of security, and most e-commerce redirects to a handful of payments providers.
- jamesshamenski 13y agoRight. If the page is public, then security isn't needed. If it's gated content then a new approach is inevitable.
- justizin 13y ago"I wonder if we're only a few years away where technologies and practices like this become standard?" Businesses that store your data would likely have to stop being predicated on the ability to mine your data.
- 0xdeadbeefbabe 13y agoWell why not go to the next level and have the attackers host your services?
- kybernetikos 13y agoThat's not far off from what we have at the moment.