LWN: Comments on "Ubuntu to store copies of all users' address books"

AES security

pharm — Sun, 18 Oct 2009 16:08:00 +0000

Yes, a thinko on my part.

AES security

ABCD — Fri, 16 Oct 2009 20:08:54 +0000

> Just using the same encryption algorithm twice with two different keys of
> size N does not increase the exhaustive search time from 2^n to 2^2n,
> thanks to meet-in-the-middle attacks, which reduce the time to 4^n.

I think there is a mistake somewhere in there, because 2^(2n) = (2^2)^n = 4^n.

Ubuntu to store copies of all users' address books

mmahut — Fri, 16 Oct 2009 19:58:55 +0000

Not really, I'm sure many head hunters would love to have my address book which is full of specific targets, mostly of colleagues and friends with same technical/career orientation.

AES security

brouhaha — Fri, 16 Oct 2009 19:22:09 +0000

The meet in the middle attack reduces the time from 2^(2n) to 2^(n+1). This is why 3DES (even with 168 bits of keying) only effectively gives 112 bits of security. That's why I didn't propose 4DES, which wouldn't have any improvement in security over 3DES. However, my proposed 6DES would give 168 bits of security, or 8DES sould give 224, etc. 6DES has the advantage that you can use an existing 3DES implementation twice.

However, that's just the time complexity. The meet in the middle attack also requires storage for 2^n blocks, which is obviously not available for n=112, let alone larger values of n.

AES security

pharm — Fri, 16 Oct 2009 13:02:35 +0000

Just using the same encryption algorithm twice with two different keys of size N does not increase
the exhaustive search time from 2^n to 2^2n, thanks to meet-in-the-middle attacks, which reduce
the time to 4^n. IOW in return for doubling your key size you've increased the search time by a
factor of 2: That doesn't seem a good tradeoff.

Leave designing encryption algorithms to the experts: Personally, I know just enough to know that I
don't know anything like enough to start designing my own encryption schemes.

Ubuntu to store copies of all users' address books

cas — Fri, 16 Oct 2009 10:32:04 +0000

to me, blocking spam and ignoring/filtering advertising is extracting the tiny signal from all the noise.

if i want to buy something, i'll go looking for it. until then, i DO NOT WANT TO HEAR ABOUT IT. EVEN IF IT'S EXACTLY THE KIND OF THING I MIGHT WANT.

ads have one of two different effects on me:

1. i ignore them, filter them out, just plain don't notice them.

2. if they get past my mental filter, it's invariably because they're excruciatingly annoying or offensive. that product and company gets blacklisted by me, instantly, until i forget the annoyance (usually permanent because i have a good memory).

the creepiness factor of targeted advertising definitely qualifies as offensive for these purposes. that results in not only the product/company being boycotted but also whoever they got my details from - e.g. if it was a company i've bought from in the past, i am instantly and permanently an ex-customer.

from my POV, all advertising is spam (because 1. it drowns out the signal and 2. it's unsolicited - i *never* ask for advertising) and i don't want any of it. email spam, phone spam, tv spam, door-knocking spam, political spam, religious spam, pamphlet and flyer spam, billboard and other street spam - it's all the same, it's all just spam.

AES security

brouhaha — Fri, 16 Oct 2009 07:40:50 +0000

I'm sufficiently paranoid that I much prefer 3DES to either AES128 or AES256. AES hasn't been subjected to anywhere near the amount of cryptanalysis as DES. If I didn't think 112 bits of key was enough to withstand brute-force attacks, I'd use two rounds of 3DES with different sets of keys (6DES).

Howto fix the problem:

dlang — Thu, 15 Oct 2009 17:39:08 +0000

you are not the common case (neither am I), we can and do take steps like this so that we do not have a single point of failure.

we also don't need a service like this because we can replicate and protect things ourselves.

this service is intended for people who otherwise are not backing things up, let alone replicating an encryption key for the backup.

Howto fix the problem:

dlang — Thu, 15 Oct 2009 17:37:03 +0000

you would be amazed at the number of people so do not protect their important documents like this.

Howto fix the problem:

dlang — Thu, 15 Oct 2009 17:36:16 +0000

and a flood or fire would destroy your printout as well as your computer.

Howto fix the problem:

drag — Thu, 15 Oct 2009 16:33:23 +0000

I save my important passwords on a LUKS-encrypted SD card. (it is small and
fits in my wallet and my laptops have SD support)

The LUKS password is relatively simple (plain english phrase), but it
should be enough to protect it if I drop it somewhere.

When you plug it into a Linux Gnome desktop automatically prompts you for
the password and opens up the folder for you. So it is very convenient.

I can't recommend this approach to normal folks because it only works if
you plug it in rarely. If you leave it plugged in all the time then it is
no better then having it in a folder.

But what is better (in terms of security) would be to print out keys into
ascii armor format or write down passwords to a hard copy. That way they
are impossible to hack! A person would have to physically break into my
house and search through my drawers and filing tower to find it.

Howto fix the problem:

drag — Thu, 15 Oct 2009 16:23:28 +0000

> do you want to run the risk of loosing everything if you loose the
password? or are you willing to take the risk that someone will break in
through the Canonical security, download your data, dig through it to find
something interesting, and take action on it?

It is easy to keep a password or key safe. Print it out into a hard copy
and put it in a secure place with the rest of my critical documentation
(automobile title, birth certificate, mortgage information, etc etc)

Then it is win on both sides. As long as you make it absolutely known that
Canonical has no knowledge and cannot ever retrieve the password for you
then I think that is acceptable.

I suppose if customers trust Canonical then they can just send them the
key/password to keep track of. It would be a lot easier to keep that safe
then a "cloud".

Howto fix the problem:

zooko — Thu, 15 Oct 2009 16:01:15 +0000

Tarsnap seems like a well-engineered system, from reading the author's blog, but as far as I know
the server-side code is proprietary. The Tahoe-LAFS project (I'm a contributor) has excellent
encryption and erasure-coding features and if you like duplicity you can use Tahoe-LAFS as a
backend for duplicity. Also Tahoe-LAFS comes with its own integrated backup system which has
different trade-offs than the duplicity backend. (Duplicity does deltas for you, but you can't view or
download your files without going through duplicity. The Tahoe-LAFS integrated backup doesn't do
deltas, but it stores the files in a time-machine-style layout which you can browse and download
through the web.)

Ubuntu to store copies of all users' address books

zooko — Thu, 15 Oct 2009 15:57:16 +0000

Hm, actually Tahoe-LAFS might fit into that use case pretty well... But again I'm pushing my own
idea here when this thread is about Canonical's UbuntuOne. If you are interested in exploring
privacy-compatible storage and sync and then maybe join the tahoe-dev mailing list. :-)

Regards,

Zooko

Ubuntu to store copies of all users' address books

jengelh — Thu, 15 Oct 2009 15:00:31 +0000

They do not even need to tapper it in; since it's not handwritten, OCR should do.

Howto fix the problem:

sourcejedi — Thu, 15 Oct 2009 13:19:52 +0000

Won't help. They still need their launchpad password.

If you can trust someone to hold your launchpad password in escrow, you can surely trust them to do the same with your encryption password.

In practice, I suspect you can just reset your launchpad password by email. So you have to rely on your ISP resetting your email password when you forget _that_. And that they don't go bust or disconnect you for using too much bandwidth making online backups :-)...

Yes, many people are likely to accept this service given the choice. But this is a pretty low bar to pass. We can and should do better.

Howto fix the problem:

sourcejedi — Thu, 15 Oct 2009 13:09:10 +0000

Try encfs + rsync. Encfs will encrypt both file content and names. (It won't hide filesizes, directory topology, permissions, and the approximate _lengths_ of filenames).

http://ubuntuforums.org/showthread.php?t=148600

Ubuntu to store copies of all users' address books

sourcejedi — Thu, 15 Oct 2009 12:46:51 +0000

From experience, I don't recommend it though :-). There's another one-liner that goes 'Ubuntu is African for "person who cannot configure debian'. You have to plan on a spending some time up-front on configuration.

E.g. on Ubuntu, setting automatic updates works out of the box. On Debian, "anacron" isn't part of the default desktop task (only the laptop one). If you turn your computer off to save your electricity bill, it won't pick up the updates at midnight or whenever they are scheduled for. You need "anacron" to catch up on the scheduled task(s) which you "missed" while the computer was turned off.

-
Back on-topic... this sounds really ignorant to me. Mozilla have already shown you can do sync with encryption, (it's a labs project called Weave); there's no need to pass the server my personal data in plaintext.

Check out Tarsnap

fghorow — Thu, 15 Oct 2009 12:26:51 +0000

From Colin Percival, the (Free?)BSD Security officer.

Just a happy user of the service.

(Be aware, it is a *for a fee* service, but the micropayments are truly micro!)

Howto fix the problem:

endecotp — Thu, 15 Oct 2009 11:06:10 +0000

> I am very uninterested in any sort of "cloud" backup
> scheme that does not integrate encryption on the client
> side.

Does anyone know how to get rsync-like functionality with the data at the other end stored encrypted?

I currently use rsync over ssh for some of my backups, so the data is encrypted on the wire but unencrypted on the remote disk. When I set this up I tried to find a way of storing the remote copy encrypted without losing rsync's efficient incremental transfers, but I didn't find anything satisfactory. Any ideas?

Howto fix the problem:

nix — Thu, 15 Oct 2009 10:14:00 +0000

If the encryption key is relatively 'bare' (i.e. it's not made clear in the keyfile what service's data it's encrypting), just keep the encryption key on a USB key. Even if you drop it on a train, nobody who picks it up will have a clue what it's meant to decrypt.

(Now everyone else can tell me how stupid this idea is.)

Ubuntu to store copies of all users' address books

jamesh — Thu, 15 Oct 2009 09:51:27 +0000

One of the planned offerings is mobile synchronisation (via the SyncML found in most handsets capable of synchronisation). I'm not sure how client side encryption would work with that.

But all the client code is free software, so if you didn't care about the mobile sync feature you could implement something like this.

AES security

job — Thu, 15 Oct 2009 08:25:13 +0000

If you are paranoid you should use AES128 instead of 256 as there are indications that the larger key isn't diffused properly.

Howto fix the problem:

ekj — Thu, 15 Oct 2009 08:02:39 +0000

I have a laptop, it does backups to a fileserver in the basement. It also does encrypted backups to a backup-service on the internet. The latter is there for the case that our house is burglarised, or burn down, or some other disaster destroys BOTH laptop AND fileserver at the same time.

And yes, if that happens AND I've forgotten the password for the encryption, it's acceptable for me to suffer data-loss. We're talking miniscule probabilities here. (I'd have to forget the password I use for logging in every day at the precise same time that something catastrophic happens at home. That's a level of risk that is entirely acceptable to me.)

Sending my entire digital world to some random company on the internet, for them and anyone that aquires, breaks into, subpoenas or otherwise gains access to their servers ? No thank you, not interested.

Howto fix the problem:

dlang — Thu, 15 Oct 2009 07:22:18 +0000

do you want to run the risk of loosing everything if you loose the password? or are you willing to take the risk that someone will break in through the Canonical security, download your data, dig through it to find something interesting, and take action on it?

I would not use their service personally (I would do the client-side encryption and keep track of the key), but I know a lot of users who I would recommend use something like this so that when they trash their system badly enough that they need to reinstall their systems they will still have their data. Many of these users have trouble remembering one password for their system, let alone taking appropriate actions to protect an encryption key.

Howto fix the problem:

drag — Thu, 15 Oct 2009 05:33:21 +0000

For important things I write down my passwords and put them in my wallet.
Then I also save another copy somewhere else.

The choice is simple really.

Do you want to keep track of a password..
or depend on the security of every machine in Canonical, every workstation
in the data center that people come into contact with that people use to
access administrative portions of the "cloud"? Do want to trust the
security of every machine on the cloud? Do you want to trust every
employee, every administrator, every janitor that access to the machines
that house your data?

All in all it is a massive undertaking trying to keep data safe and
security for what will be practically forever if you take the approach that
users should take no responsibility for their data!

And it's hugely expensive undertaking, to boot. It is virtually impossible
to do in correct manner if you think about it.

Meanwhile if your job is to handle already encrypted data then it is much
simpler. You could post your customer's data to craigslist and not have to
worry about it.

It is not difficult to print out copies of your keys into ascii armor
format and put a hard copy in a secure place. People do that shit all the
time with all sorts of documents. They rent out lock boxes in banks, go and
get fire-proof safes at Walmart for 50 bucks, and all sorts of stuff like
that.

(and, frankly, the notion that you should never write down your passwords
or create hard copies of your keys is one of the worst pieces of security
"common sense" I have had the misfortune to run into over and over again.)

If you value your data and want to be able to use Ubuntu's cloud service
for anything other then a toy or a cheap way to sync address books then
client-side encryption is just the obvious way to go from my perspective.
I could be wrong, but it makes sense to me.

Ubuntu to store copies of all users' address books

lacostej — Thu, 15 Oct 2009 05:10:32 +0000

To me, targeted advertising is signal out of the random advertising noise...

Ubuntu to store copies of all users' address books

lysse — Thu, 15 Oct 2009 04:25:25 +0000

But nor do I particularly want to give anyone else the opportunity to examine in forensic detail just how sad and featureless my life is...

Traffic analysis can surprise

dlang — Thu, 15 Oct 2009 04:15:16 +0000

if someone is after you specifically, _anything_ you do can be significant.

however, if someone is not after you specifically, but is just after things that they can sell, it becomes much easier to have reasonable defenses

"I don't have to outrun the bear, I just have to outrun you"

with "you" being enough other users that the bad guys don't get around to bothering with me.

yes, this is security by obscurity, and if someone decides to go after you it doesn't help much, but the reality is that for the vast majority of people this really is good enough.

Howto fix the problem:

dlang — Thu, 15 Oct 2009 04:09:32 +0000

the only issue with encrypting the data before you send it up to the cloud is where you store your encryption keys.

if you loose those keys you loose your data, so it does no good to store your data in multiple places if your keys only exist on one machine.

for many people who do not have good ways to store the keys, they are actually better of in many ways with the data in the clear so that they can pull it back down to a replacement machine if something happens to the first one.

yes, this is not good from a security point of view, but in this case the security risks need to be balanced against the availability risks. which one is more important will vary from person to person.

Ubuntu to store copies of all users' address books

rahvin — Thu, 15 Oct 2009 04:02:31 +0000

While you are at it, include all your bookmarks so your hobbies and interests can be indexed and categorized and targeted advertising delivered.

Traffic analysis can surprise

jreiser — Thu, 15 Oct 2009 02:27:28 +0000

The date and time of contact with the database are useful to those who might want to track you and those with whom you communicate. A Snoop can learn a lot by correlating that data with all the other data that is available. Many times the result is "only" classification into broad categories, but sometimes a very specific inference can be drawn.

Howto fix the problem:

drag — Thu, 15 Oct 2009 02:18:40 +0000

Yeah. I don't think that couchdb does any sort of encryption either.

I am very uninterested in any sort of "cloud" backup scheme that does not
integrate encryption on the client side.

Why? (a person may ask) A few reasons. Whether or not a person should trust
a third party corporation is entirely up to debate... when the encryption
on the client side then it is not a matter of debate; whether you trust
them or not is irrelevant.

The other thing is that it makes storage side a lot cheaper and a lot
easier to implement. I don't have to worry so much about security... A
attacker could break the system and corrupt my data, but there is no
information leakage possible. So while things like TLS and hashing of the
data is important from a identity management and data integrity point of
view it is entirely unimportant to prevent things like identity theft or
whatever. The worst thing that could possibly happen is a DOS attack.

This makes things cheaper; I only have to keep a database of hashes and
check those periodically and authenticate writes, but reads can be done by
anybody and I wouldn't really care... so data preservation techniques like
"lots of copies all over the place" is easy to implement and can be spread
out over lots of organizations without having to care exactly what those
organizations are doing.

As you can imagine that if I was a third party provider of storage that
this sort of approach would massively reduce the amount of headaches I have
to deal with.

Ubuntu to store copies of all users' address books

sitaram — Thu, 15 Oct 2009 01:36:07 +0000

awesome... I hate to decrease SNR on LWN, but this was a fantastic one-liner :)

Howto fix the problem:

msebast — Thu, 15 Oct 2009 01:19:18 +0000

Yes. Encryption should be part of the marketing message. Make it clear that the only thing Canonical knows is that you stored some data and they can't tell what's in there.

I guess Elilot Murphy's email was intended for people who already know what couchDB is.

I've heard about couchDB a few times but never seen any mention of encryption. So I've always assumed this is something I don't want and didn't investigate further.

Howto fix the problem:

drag — Thu, 15 Oct 2009 00:11:23 +0000

Like what? That I use Evolution or not? How much information I feel like
backing up?

I really doubt there is much useful information that anybody could gleam from
syncing to a online backup share other then the location of the firewall I
was operating behind at the time I did my last sync.

Howto fix the problem:

gdt — Wed, 14 Oct 2009 23:42:42 +0000

Even with encryption, traffic analysis can still reveal information you'd rather keep private.

Yes, encryption option would solve all problems

coriordan — Wed, 14 Oct 2009 22:04:36 +0000

I'm also interested to hear if this has been discussed.

Ubuntu to store copies of all users' address books

coriordan — Wed, 14 Oct 2009 21:54:25 +0000

No. You can transition without planning :-)

I'll take privacy over innovation

coriordan — Wed, 14 Oct 2009 21:53:22 +0000

When I sit down at my computer, I don't think to myself "Oh, I hope the applications I'm using are innovative".

My privacy, on the other hand, is something I do think about.