Rollercoaster: Communicating Efficiently and Anonymously in Large Groups • Hacker News Board

Re: Rollercoaster: Communicating Efficiently and Anonymously in Large Groups

#11

Post by wolverine876 » Wed, Nov 10, 2021, 12:34 AM UTC

MattJ100 wrote: post #10

consumer451 wrote: post #9

Earlier quoted context omitted.

> Discussing Signal is somewhat unavoidable in this context though. In which case I feel the need to share this very interesting talk from Moxie about the negatives of decentralization from the POV of product. I have no education or horse in this race, but I found this talk very interesting and dare I say brave. https://www.youtube.com/watch?v=Nj3YFprqAr8 Would love to be pointed to the best counterarguments, but aga…

> Would love to be pointed to the best counterarguments, but again the focus on product was the interesting take for me. I attempted to summarize the trade-offs in this post: https://snikket.org/blog/products-vs-protocols/ There are also a number of responses written by others, such as: - An Objection to "The Ecosystem is Moving": https://gultsch.de/objection.html - "Re. The Ecosystem is Moving": https://blog.jabberh…

> I attempted to summarize the trade-offs in this post: https://snikket.org/blog/products-vs-protocols/

What an intelligent, honest, balanced analysis, thank you. It's hard to believe I read that on the Internet!

Re: Rollercoaster: Communicating Efficiently and Anonymously in Large Groups

#12

Post by _lambdalambda » Wed, Nov 10, 2021, 1:39 PM UTC

dhx wrote: post #8

wolverine876 wrote: post #2

Interesting goals ... > apps such as WhatsApp and Signal and billions of people around the world have the contents of their message protected against strong adversaries. However, while the message contents are encrypted, their metadata still leaks sensitive information AFAIK Signal already protects metadata and does group chats. What does Rollercoaster add? (I don't want to turn this into another thread about Signal.…

Rollercoaster has a decentralised traffic-analysis resistant architecture whereas Signal is centralised. With a centralised architecture such as Signal, Eve could monitor when Alice sends a message and correlate it over time to which endpoints receive a message soon thereafter. If Bob and Carol are in a group chat with Alice and they receive messages soon after Alice sends messages, Eve can assume over time that they…

Hi, paper author here :) thanks for providing a great answer to that question. I missed that the post/paper made its way to HN.

One thing I'd add for the benefit of the discussion is that the term "metadata privacy" is rather fuzzy and different people mean different things with it. That's where some confusion can come from.

I like to use "unobservable communication" to refer to absolute metadata privacy where no single bit of information is leaked - i.e. an adversary cannot even tell if any communication is happening at all at any point in time.

For most real-world use-cases and threat models, this absolute privacy goal is often a bit unpractical because it comes with high latency or bandwidth needs. For instance, Tor is popular and practical because they prioritise latency and throughput with a careful threat model that excludes a global network adversary. However, the right threat model really depends on the individual use-case and circumstances.

I think that Loopix (as linked above and what we use in our paper) does a great job in quantifying the achieved anonymity. See also https://bib.mixnetworks.org/pdf/serjantov2002towards.pdf for some more Information Theory in the context of Mix networks.

Re: Rollercoaster: Communicating Efficiently and Anonymously in Large Groups

#13

Post by _lambdalambda » Wed, Nov 10, 2021, 2:07 PM UTC

alexeldeib wrote: post #6

wolverine876 wrote: post #2

Interesting goals ... > apps such as WhatsApp and Signal and billions of people around the world have the contents of their message protected against strong adversaries. However, while the message contents are encrypted, their metadata still leaks sensitive information AFAIK Signal already protects metadata and does group chats. What does Rollercoaster add? (I don't want to turn this into another thread about Signal.…

AFAIK the signal protocol makes no guarantees about metadata. Signal the service makes claims about what they store (I.e., very little) but no properties of the protocol guarantee metadata anonymity (user X communicated with user Y). At the very least I believe signal metadata is vulnerable to traffic analysis which is in scope for the threat model for some alternate systems. Vuvuzela would be something closer to pro…

Hi paper author here :) thanks for the great comment. I'll add some thoughts for other potential future readers:

Generally, almost every protocol that does not do some form of traffic shaping is vulnerable to traffic analysis.

If an adversary just wants to confirm their suspicion that A talks to B, they can correlate the outgoing traffic patterns of A with the incoming traffic patterns of B. Doing this over a multiple rounds they can increase their confidence. This is something they can do on Signal or even between two Tor participants.

Note that starting with such a suspicion is easier than finding out _who_ A is talking to. In that case they'd need to either (a) follow network messages through the network or (b) collect traffic patterns from all potential communication partners. That's why Tor is nevertheless effective in hiding which websites you visit.

Thanks also for listening other anonymous network designs! There are many really interesting ones. And for some (e.g. DC nets) you can get broadcast that is only depending on the total network size and not the group size.

We chose Loopix because we were looking into mobile devices. Here, Loopix has the interesting concept of provider nodes which (i) can store messages if clients are offline and (ii) regulate access to the network e.g. against a fee to make it commercially viable. Also, Mix networks are very easy to scale up by simply adding more nodes.

When we tried to put decentralised collaboration (e.g. CRDTs) on top of Loopix we hit the problem that distributing the edit updates was rather inefficient. That's basically the problem from which the Rollercoaster idea developed.

Re: Rollercoaster: Communicating Efficiently and Anonymously in Large Groups

#14

Post by alexeldeib » Wed, Nov 10, 2021, 6:35 PM UTC

_lambdalambda wrote: post #13

alexeldeib wrote: post #6

Earlier quoted context omitted.

AFAIK the signal protocol makes no guarantees about metadata. Signal the service makes claims about what they store (I.e., very little) but no properties of the protocol guarantee metadata anonymity (user X communicated with user Y). At the very least I believe signal metadata is vulnerable to traffic analysis which is in scope for the threat model for some alternate systems. Vuvuzela would be something closer to pro…

Hi paper author here :) thanks for the great comment. I'll add some thoughts for other potential future readers: Generally, almost every protocol that does not do some form of traffic shaping is vulnerable to traffic analysis. If an adversary just wants to confirm their suspicion that A talks to B, they can correlate the outgoing traffic patterns of A with the incoming traffic patterns of B. Doing this over a multipl…

Appreciate the reply! Definitely not my area of expertise, private communication is just something I do enjoy nerding out on :)

Curious, re: traffic analysis. Were you highlighting the fact that systems which don’t deliberately try to prevent traffic analysis are generally vulnerable, or calling out a weakness in some of these systems themselves? E.g. I believe tor is susceptible to traffic analysis like you mentioned, but my understanding of some of the other solutions is that they were designed to be resilient to this in various ways, but most of those approaches involve e.g. always sending same size payloads at similar frequencies, even when there is no real payload to transmit (cover noise), and that gets expensive quickly? Or introduces high latency to maintain comparable anonymity guarantees?

Re: Rollercoaster: Communicating Efficiently and Anonymously in Large Groups

#15

Post by _lambdalambda » Wed, Nov 10, 2021, 10:04 PM UTC

alexeldeib wrote: post #14

_lambdalambda wrote: post #13

Earlier quoted context omitted.

Hi paper author here :) thanks for the great comment. I'll add some thoughts for other potential future readers: Generally, almost every protocol that does not do some form of traffic shaping is vulnerable to traffic analysis. If an adversary just wants to confirm their suspicion that A talks to B, they can correlate the outgoing traffic patterns of A with the incoming traffic patterns of B. Doing this over a multipl…

Appreciate the reply! Definitely not my area of expertise, private communication is just something I do enjoy nerding out on :) Curious, re: traffic analysis. Were you highlighting the fact that systems which don’t deliberately try to prevent traffic analysis are generally vulnerable, or calling out a weakness in some of these systems themselves? E.g. I believe tor is susceptible to traffic analysis like you mentione…

It's a great topic :) and with so many interesting ideas and constructions.

In my comment I was trying to make the more general statement that is (likely) impossible to achieve strong metadata privacy (or unobservable communication) without cover traffic.

However, metadata privacy is a bit of a spectrum (see my other comment above).

Adding latency at the relays/mixes already helps to make it harder for an adversary to correlate the traffic as their measurements get more noisy. This then very quickly gets to a level where we have "practically unobservable communication" as the signal to noise ratio is very low.

By increasing/decreasing the latency of the intermediate hops one can directly control the trade-off between latency and anonymity. Check-out e.g. Figure 6 in the Loopix paper (https://www.usenix.org/system/files/conference/usenixsecurit...).

Similarly, this holds for cover traffic. In an ideal scenario the rate of the outgoing traffic is fully independent of whether one communicates or not. In a less ideal scenario we just add some other requests on top (e.g. a random browser bot on Tor) to create noise. In some cases this might be good enough. However, it won't satisfy any theoretical definition of unobservable communication which indicates that an observer can mitigate the noise by extending their observation over a long-long time.