Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vuvuzela: private messaging system that protects metadata

vuvuzela.io

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Vuvuzela: private messaging system that protects metadata

#31

Post by Canada »

arkadiyt wrote: post #19

FWIW here is the only data that Signal had available to turn over when requested by the government: https://twitter.com/whispersystems/status/783325788883955713

There is actually more than that stored in the server's database. Push messaging IDs are there, for example. But ignoring that, let's say the attacker is watching all the Signal server's connections. Who is talking to who can be determined based on size, direction and timing of traffic between clients and the server. The server could also be modified to log it.

The idea with projects such as Vuvuzela is to make metadata less usable.

Re: Vuvuzela: private messaging system that protects metadata

#32

Post by tn_ »

ycmbntrthrwaway wrote: post #14

The paper was published October 2015: https://pdos.csail.mit.edu/papers/vuvuzela:sosp15.pdf Also, previous discussion: https://news.ycombinator.com/item?id=10668494

|Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis

Their server is throwing a 500 error

Re: Vuvuzela: private messaging system that protects metadata

#33

Post by netik »

ape4 wrote: post #20
ozi wrote: post #17

Earlier quoted context omitted.

steganography is a concept; vuvuzela is an implementation of that concept

With steganography you make your message look like something else (eg a text message inside a JPEG). But vuvuzela isn't doing that. They are making it look like noise, I guess. But who transmits noise.

Well, that's exactly the problem with systems like this.

If you transmit something that looks like noise, and no one else sends something that looks like that particular kind of noise, then you are raising a flag that says "No, really, please, capture this data, it's interesting."

Re: Vuvuzela: private messaging system that protects metadata

#34

Post by digi_owl »

wheelerwj wrote: post #30
mi100hael wrote: post #23

Earlier quoted context omitted.

A lot of the high profile stories about people being busted over Tor recently have been related to vulnerabilities in FireFox/Tor Browser Bundle and the FBI running honeypots that can exploit those vulnerabilities. Ricochet works by essentially starting up a Tor Hidden Service and then listening for messages from other users, so there's no exposure to browser-based attacks. It's end-to-end encrypted and less suscepti…

honeypot has to be the most generous name for "federal government controlled and operated pedophilia distribution network" ever.

Brings new meaning to the adage about how online men are men, women are men, and kids are fbi agents...

Re: Vuvuzela: private messaging system that protects metadata

#35

Post by telesilla »

vxNsr wrote: post #18
mooneater wrote: post #12

Awesome. What I want in addition, is for others to never know Vuvuzela has been downloaded, installed, or used. That has implications up and down the stack of course. But otherwise, this knowledge is enough to flag users of privacy protecting technology.

Could you comment on how that would work? I'm trying to imagine how I would hide that I downloaded an app on a phone using the appstore (unless you want this to end up like PGP, which is used by the crypto community and no one else because of the perceived complications vis-a-vis implementation.)

Embed the app in seemingly innocent other apps? If there were a raft of say, free useless game apps, there would be the element of innocence there, such as "My mother downloaded Patience, no idea it contained Vuvuzela"

Re: Vuvuzela: private messaging system that protects metadata

#36

Post by estebank »

netik wrote: post #33
ape4 wrote: post #20

Earlier quoted context omitted.

With steganography you make your message look like something else (eg a text message inside a JPEG). But vuvuzela isn't doing that. They are making it look like noise, I guess. But who transmits noise.

Well, that's exactly the problem with systems like this. If you transmit something that looks like noise, and no one else sends something that looks like that particular kind of noise, then you are raising a flag that says "No, really, please, capture this data, it's interesting."

How can you differentiate between different "types of noise"? If the traffic is cryptographically sound, the signal is indistinguishable from the noise. If the messages from multiple people have a guessable seed, in such a way that you can identify what is noise, it just means that the system is not cryptographically sound.

Re: Vuvuzela: private messaging system that protects metadata

#37

Post by dom0 »

estebank wrote: post #36
netik wrote: post #33

Earlier quoted context omitted.

Well, that's exactly the problem with systems like this. If you transmit something that looks like noise, and no one else sends something that looks like that particular kind of noise, then you are raising a flag that says "No, really, please, capture this data, it's interesting."

How can you differentiate between different "types of noise"? If the traffic is cryptographically sound, the signal is indistinguishable from the noise. If the messages from multiple people have a guessable seed, in such a way that you can identify what is noise, it just means that the system is not cryptographically sound.

> How can you differentiate between different "types of noise"? If the traffic is cryptographically sound, the signal is indistinguishable from the noise.

Message length, relative timing, average bandwidth, ports used, source/destination addresses, activity punch-card.

I'd assume that this kind of traffic is identifiable to within near perfect certainty, which would also make it easy to block.

The situation is a bit similar to early crypto-analysis: it's totally easy to devise a cipher that makes text look random to the eye, but is still easily cracked using statistics (eg. frequency method). Just because traffic patterns look all complex and random doesn't mean that there is a meaningful amount of entropy in it (but you need a lot of entropy to hide all the metadata - who with whom and when). Just because bandwidth or packet frequency looks independent of user activity it doesn't mean that it actually is.

Re: Vuvuzela: private messaging system that protects metadata

#38

Post by probinso »

tn_ wrote: post #32
ycmbntrthrwaway wrote: post #14

The paper was published October 2015: https://pdos.csail.mit.edu/papers/vuvuzela:sosp15.pdf Also, previous discussion: https://news.ycombinator.com/item?id=10668494

|Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis Their server is throwing a 500 error

that means that its working with perfect privacy

Re: Vuvuzela: private messaging system that protects metadata

#40

Post by 0xmohit »

aftbit wrote: post #39

There's very little on the Github page - 18 commits, with the last "real" commit (not just an organizational change) being in September. This might be a thing some day, but right now it's just another clever idea.

There may be even lesser activity now, given that the author has moved to Google.
Post reply on HN