Vuvuzela: private messaging system that protects metadata • Hacker News Board

Re: Vuvuzela: private messaging system that protects metadata

#11

Post by throwaway09987 » Wed, Nov 30, 2016, 7:01 PM UTC

mi100hael wrote: post #7

> To hide metadata, messages are routed through multiple servers, and each server adds noise. This makes the metadata incomprehensible, even to powerful nation-state adversaries. I'm interested to learn more about these servers. Can anyone host one? How are they discovered/networked? Personally I'm still more inclined to stick with Ricochet.IM since it piggybacks Tor so there are already tons of servers out there.

I'm curious about ricochet, but not excited about a service that is integrated with Tor...I've heard a lot of things recently about Tor's insecurity. If this new thing is better about protecting users (as it seems it might be), then I'd definitely stay away from something interfacing with Tor.

Re: Vuvuzela: private messaging system that protects metadata

#12

Post by mooneater » Wed, Nov 30, 2016, 7:02 PM UTC

Awesome. What I want in addition, is for others to never know Vuvuzela has been downloaded, installed, or used. That has implications up and down the stack of course. But otherwise, this knowledge is enough to flag users of privacy protecting technology.

Re: Vuvuzela: private messaging system that protects metadata

#13

Post by ycmbntrthrwaway » Wed, Nov 30, 2016, 7:15 PM UTC

Kenji wrote: post #3

I love this! The only thing it would require in addition is if it was serverless and p2p, like torrent.

It is impossible to build anonymity system without some sort of centralization due to possibility of Sybil attack. You need some trusted entity beforehand, otherwise your ISP can just simulate the whole network for you and never let you connect to the real network without you even noticing this.

Re: Vuvuzela: private messaging system that protects metadata

#14

Post by ycmbntrthrwaway » Wed, Nov 30, 2016, 7:18 PM UTC

The paper was published October 2015: https://pdos.csail.mit.edu/papers/vuvuzela:sosp15.pdf

Also, previous discussion: https://news.ycombinator.com/item?id=10668494

Re: Vuvuzela: private messaging system that protects metadata

#15

Post by niftich » Wed, Nov 30, 2016, 7:19 PM UTC

I read their slides, and am reading through their paper. How is this different from steganography?

In my understanding, the set of all communiqués between every user and the Vuvuzela network approaches pseudorandom noise, among which the actual conversations are hidden.

Re: Vuvuzela: private messaging system that protects metadata

#16

Post by nickpsecurity » Wed, Nov 30, 2016, 7:21 PM UTC

zmanian wrote: post #10

Vuvuzela seems great except your anonymity is guaranteed by a set of high availability and capacity servers. Those servers need to independently operated and resistant to global compromise. We don't really have a good template for a system like this. We have centralized HA systems and decentralized high churn systems like Bittorrent and Tor. I've been intrigued by the observation that forthcoming "proof of stake" blo…

My model was using ideologically different people in competing jurisdictions whose company's products are used by governments and big business for critical stuff. Such reducing subversion risk plus aligning incentives of attack and defense a bit better.

Diverse, hardened OS's & CPU's too. Verified protocol stack. The usual.

Re: Vuvuzela: private messaging system that protects metadata

#17

Post by ozi » Wed, Nov 30, 2016, 7:28 PM UTC

niftich wrote: post #15

I read their slides, and am reading through their paper. How is this different from steganography? In my understanding, the set of all communiqués between every user and the Vuvuzela network approaches pseudorandom noise, among which the actual conversations are hidden.

steganography is a concept; vuvuzela is an implementation of that concept

Re: Vuvuzela: private messaging system that protects metadata

#18

Post by vxNsr » Wed, Nov 30, 2016, 7:34 PM UTC

mooneater wrote: post #12

Awesome. What I want in addition, is for others to never know Vuvuzela has been downloaded, installed, or used. That has implications up and down the stack of course. But otherwise, this knowledge is enough to flag users of privacy protecting technology.

Could you comment on how that would work?

I'm trying to imagine how I would hide that I downloaded an app on a phone using the appstore (unless you want this to end up like PGP, which is used by the crypto community and no one else because of the perceived complications vis-a-vis implementation.)

Re: Vuvuzela: private messaging system that protects metadata

#19

Post by arkadiyt » Wed, Nov 30, 2016, 7:41 PM UTC

FWIW here is the only data that Signal had available to turn over when requested by the government: https://twitter.com/whispersystems/status/783325788883955713

Re: Vuvuzela: private messaging system that protects metadata

#20

Post by ape4 » Wed, Nov 30, 2016, 7:51 PM UTC

ozi wrote: post #17

niftich wrote: post #15

I read their slides, and am reading through their paper. How is this different from steganography? In my understanding, the set of all communiqués between every user and the Vuvuzela network approaches pseudorandom noise, among which the actual conversations are hidden.

steganography is a concept; vuvuzela is an implementation of that concept

With steganography you make your message look like something else (eg a text message inside a JPEG). But vuvuzela isn't doing that. They are making it look like noise, I guess. But who transmits noise.