Very Good Security • Hacker News Board

Re: Very Good Security

#31

Post by lisper » Tue, Aug 28, 2018, 6:56 PM UTC

mdpopescu wrote: post #13

I find it interesting that Stefan Brands [1] solved the zero-knowledge authentication problem a couple of decades ago and his tools are still not widely applied. Given my bias against imaginary property, I believe that's because his patents on them are still valid -- and apparently owned by Microsoft at the moment [2]. [1] https://en.wikipedia.org/wiki/Stefan_Brands [2] http://financialcryptography.com/mt/archives/00…

> Stefan Brands [1] solved the zero-knowledge authentication problem a couple of decades ago

Reference? If you want people to take you seriously when you claim that someone's solution to a problem has been overlooked you have to provide a link to the (alleged) solution, not just to the author's biography.

Re: Very Good Security

#32

Post by danenania » Tue, Aug 28, 2018, 6:56 PM UTC

EnvKey[1] takes a somewhat similar approach to securing credentials/config in that we effectively replace your config with a short token that can be set as an environment variable. This then 'expands' into your full configuration when it's needed.

But the crucial difference is that instead of storing sensitive data in plaintext ourselves and then sending out access tokens, we manage an OpenPGP PKI/web-of-trust for you behind the scenes so that we're only storing encrypted data, and only the token (which we never see in its entirety) can decrypt it.

End-to-end encryption is much harder to implement for these kinds of use cases than simple tokenization, but there's also the huge benefit of not needing to trust your storage layer.

With credit cards, for example, an approach like this could hypothetically remove PCI-compliance as an issue entirely because no one is actually storing the cc # in the clear. To me this is a lot more interesting than simply shifting the burden of trust. That said, anything is better than our current status quo of spraying secrets all over the place.

1 - https://www.envkey.com

Re: Very Good Security

#33

Post by skybrian » Tue, Aug 28, 2018, 6:57 PM UTC

dpeck wrote: post #8

This old guy appreciates the nod to Pretty Good Privacy, well done on naming.

It's a nice reference but seems likely to cause jokes after their first security hole. "Pretty Good" is modest. "Very Good" can be seen as arrogant, unless you are reading it as ironic.

But no worse than "Best Buy" I suppose.

Re: Very Good Security

#34

Post by grenoire » Tue, Aug 28, 2018, 7:01 PM UTC

mahmoudimus wrote: post #17

robert204 wrote: post #3

Doesn't this mean VGS becomes the single point of failure and a larger target for malicious actors?

(disclaimer: I work for VGS) Hi robert204, Your question has two specific parts that I want to address: 1) Single Point of Failure 2) Larger target for malicious actors Regarding point #1: - We have invested significant amount of resources in making our product as stateless as possible and our core product can live on different cloud providers' edge networks. - We conduct failover tests every 2 weeks to ensure we hav…

Here in HN, we all know what happened whenever a large actor took on the liability. The answers here are almost insulting given the category of the service provided; dismissive even.

Re: Very Good Security

#35

Post by mark_m » Tue, Aug 28, 2018, 7:03 PM UTC

nodesocket wrote: post #29

If an organization is deciding between interacting with VGS hashes/tokens having to proxy requests or deploying a secret store like HashiCorp vault what are the pros/cons? > When it’s time to bill your insurance company, their “reimbursement” code goes through VGS which “reveals” the token and sends the real version to the insurance company. Forgive me if I am wrong, but that means all 3rd party integrations that req…

the biggest pros of VGS: 1) tokenization/detokenization through their proxies does not require any code changes, you don't need to change your architecture ( which happens if you decided to add some secret storage like HashiCorp etc) 2) Compliances, VGS provides you: PCI, EI3PA, SOC2, HIPAA, GDPR

Re: Very Good Security

#36

Post by erpellan » Tue, Aug 28, 2018, 7:06 PM UTC

lisper wrote: post #31

mdpopescu wrote: post #13

I find it interesting that Stefan Brands [1] solved the zero-knowledge authentication problem a couple of decades ago and his tools are still not widely applied. Given my bias against imaginary property, I believe that's because his patents on them are still valid -- and apparently owned by Microsoft at the moment [2]. [1] https://en.wikipedia.org/wiki/Stefan_Brands [2] http://financialcryptography.com/mt/archives/00…

> Stefan Brands [1] solved the zero-knowledge authentication problem a couple of decades ago Reference? If you want people to take you seriously when you claim that someone's solution to a problem has been overlooked you have to provide a link to the (alleged) solution, not just to the author's biography.

Although I hadn't heard of Stefan Brands before, I wasn't surprised he'd worked with David Chaum, who is the person I first think of regarding zero-knowledge proofs: http://sceweb.sce.uhcl.edu/yang/teaching/csci5234WebSecurity...

Then I get depressed because we had anonymous digital cash 20 YEARS AGO and fucked it up.

Software patents are bad, crypto patents are worse. It's (almost) literally patenting math.

Re: Very Good Security

#37

Post by drdaeman » Tue, Aug 28, 2018, 7:06 PM UTC

vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

This sounds weird.

What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice.

Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to find a legal immigration venue to a first-world country (probably not to the US, though) - so, why do stupid things like that?

Re: Very Good Security

#38

Post by wepple » Tue, Aug 28, 2018, 7:09 PM UTC

fefe23 wrote: post #27

mahmoudimus wrote: post #17

Earlier quoted context omitted.

(disclaimer: I work for VGS) Hi robert204, Your question has two specific parts that I want to address: 1) Single Point of Failure 2) Larger target for malicious actors Regarding point #1: - We have invested significant amount of resources in making our product as stateless as possible and our core product can live on different cloud providers' edge networks. - We conduct failover tests every 2 weeks to ensure we hav…

You had me at "cloud providers". If you store the data on some cloud provider, then you are just as bad as what your prospective customers are doing. I don't want any of my sensitive data stored on "some cloud provider". Also, your security strategy apparently boils down to "we'll be REAL CAREFUL, pinky swear!" That strategy does not work, and has never worked before. The whole reason why you think your product is ne…

I’m curious, what’s wrong with storing this type of data in a cloud provider?

Also, security aside wouldn’t a16z have invested because the business isn’t “do it more securely”, but “outsource PCI compliance entirely”?

Re: Very Good Security

#39

Post by jamestimmins » Tue, Aug 28, 2018, 7:11 PM UTC

segmondy wrote: post #19

jamestimmins wrote: post #2

It's mind-boggling to me that this didn't already exist. I wonder if that's because there's a lot of low hanging fruit in security/privacy, low hanging fruit in healthcare, or a combination of the two.

It exists, it's called tokenization https://en.wikipedia.org/wiki/Tokenization_(data_security)

Specifically, I mean for this specific purpose, as a service.

Re: Very Good Security

#40

Post by amag » Tue, Aug 28, 2018, 7:13 PM UTC

throwawaymath wrote: post #16

I can see why this is an attractive idea to fund, but in my opinion it's the wrong way to resolve the problems highlighted in the article. This is not a technical problem, it's a usability problem. We have had the cryptography necessary to technically fix this for a long time. Replace the single human-memorable token (SSN) with a unique public/private key pair. Then you provide safe authentication by signing verifica…

> Replace the single human-memorable token (SSN) with a unique public/private key pair

There are governments that work on solutions to give each citizen a certificate. What I would love to see would be the possibility to issue your own sub-identities that only exhibit as much information as you want/need to share for that specific use case. E.g. if you need to make $20k/yr for a new mobile phone plan, you can issue an identity that makes $20k/yr as long as you make at least that.