Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CipherCloud Responds to the Crypto StackExchange Controversy

blog.ciphercloud.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#41

Post by betterunix »

pi18n wrote: post #32
betterunix wrote: post #21

Earlier quoted context omitted.

"Searching encrypted data is impossible without fully homomorphic encryption" That is not true; a private information retrieval protocol can be used to search encrypted data: https://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=568331... You could also use an oblivious RAM, although I do not think that is practical yet: http://eprint.iacr.org/2010/366.pdf

Don't those require that the client actually do the searching? (I couldn't devote enough time to read them now, so I only read the abstracts. Thank you, by the way, for sending the links; this kind of stuff is really interesting.) To be specific I mean a second party being able to search the data for arbitrary strings would mean the security of it was broken completely, and I thought this service was storing and sear…

I am not really sure what it is that CipherCloud provides or even claims to provide; it looks like a big pile of buzzwords but few details. I am not sure what sort of a service would be searching ciphertexts without some input from the client -- at the very least, the service will need to know what to search for.

You are correct that the PIR and ORAM protocols involve the client performing some of the work of the search. The point is that the client does not need to store or scan the entire database (for ORAMs there is usually a one-time setup that involves scanning the database, but this can be viewed as "uploading" the data to the server; this may not be acceptable for all use-cases). With FHE, the client will perform less work, but still has to at least encrypt its query and decrypt the result. However, FHE is still many years from practicality, whereas PIR is practical now (but maybe not for database search) and ORAMs are nearly practical.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#42

Post by wyck »

rdl wrote: post #29

This is a good example of bad legal/PR turning a company from a fairly well respected new security company to a joke. Tokenization, which CipherCloud does, could actually be done fairly securely if you had a decent amount of local storage. They IIRC use a FIPS HSM for local key storage in their local appliance (I talked to one of their founders as a security event a year or two ago and was initially suspicious of the…

It sounds like they don't have anyone with actual PR experience. The standpoint they are taking is very old school and stems from an angry reaction.

If instead they had entered the discussion with a sliver of respect and honesty it would have been great. Instead many people have been introduced to them via a negative and untrustworthy atmosphere, this has certainly tarnished their reputation. Despite what they say not all exposure is good exposure.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#43

Post by rdl »

wyck wrote: post #42
rdl wrote: post #29

This is a good example of bad legal/PR turning a company from a fairly well respected new security company to a joke. Tokenization, which CipherCloud does, could actually be done fairly securely if you had a decent amount of local storage. They IIRC use a FIPS HSM for local key storage in their local appliance (I talked to one of their founders as a security event a year or two ago and was initially suspicious of the…

It sounds like they don't have anyone with actual PR experience. The standpoint they are taking is very old school and stems from an angry reaction. If instead they had entered the discussion with a sliver of respect and honesty it would have been great. Instead many people have been introduced to them via a negative and untrustworthy atmosphere, this has certainly tarnished their reputation. Despite what they say no…

People should learn from their example.

I'm not sure if it's that they have no PR experience in the company, or just don't consider StackExchange/HN/Reddit to be worthy of a serious effort.

IMO, this is the kind of thing founders should handle personally once it happens. Maybe guided by a PR person or an investor, but a founder giving an adequate response gets graded on a curve, and is thus a lot more effective than a completely polished PR/marketing person.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#44

Post by dchest »

lwf wrote: post #33

looking at the page in Google's cache, it looks like they have a bunch of spam on their site :) https://webcache.googleusercontent.com/search?q=cache%3Ablog... "A couple of recent discussions in a few board threads contributed to by our competitors have questioned CipherCloud’s small online payday loans. same day payday loans. easy online payday loan. direct lender payday loans online. approach to delivering cloud in…

Looks like your usual WordPress malware.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#45

Post by rdl »

zapdrive wrote: post #37
TillE wrote: post #26

Earlier quoted context omitted.

> their desire to suppress the use of their copyrighted IP in critiques of their product Which is a textbook case of fair use. They may want to do that, but legally, they almost certainly can't.

An example needs to be set. They should be sued for issuing a DMCA notice in bad faith.

I'm curious who has standing. One of the people who posted/commented in the original thread? A user who wanted to learn about CipherCloud? StackExchange itself?

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#46

Post by analog »

zapdrive wrote: post #37
TillE wrote: post #26

Earlier quoted context omitted.

> their desire to suppress the use of their copyrighted IP in critiques of their product Which is a textbook case of fair use. They may want to do that, but legally, they almost certainly can't.

An example needs to be set. They should be sued for issuing a DMCA notice in bad faith.

The damage to their reputation should be quite a good example. Nowhere near so many would have heard of this if they hadn't issued the takedown.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#47

Post by signifiers »

zapdrive wrote: post #38

Here is a link to the DMCA notice, in case anyone cares. Its not just a DMCA notice, it contains claims against slander and defamation too. http://www.pdf-archive.com/2013/04/20/notice130419/

“The statement is patently false. Sid implies that what was perceived from a public demo is CipherCloud's product offering.”

http://www.pdf-archive.com/2013/04/20/notice130419/preview/p...

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#48

Post by pchowdhry »

rdl wrote: post #29

This is a good example of bad legal/PR turning a company from a fairly well respected new security company to a joke. Tokenization, which CipherCloud does, could actually be done fairly securely if you had a decent amount of local storage. They IIRC use a FIPS HSM for local key storage in their local appliance (I talked to one of their founders as a security event a year or two ago and was initially suspicious of the…

Agreed, no magic here. I rolled a quick version using Squid and greasy spoon. Got it to work on SFDC and Gmail inside of a day. Using tags around the encrypted content and regex you could then feed the content into the decryption engine. Search works, etc. You could even using a unique IV per user to add a level of security, but it is by no means rock solid. It would however address some of the frequency analysis concerns, since if the encryption (tokenization??) was cracked it would only reveal the contents for a single user. That would work for the gmail side, but doing in in SFDC is a whole other issue, and unless the have some Harry Potter stuff going on, is likely huff and puff.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#49

Post by zapdrive »

rdl wrote: post #45
zapdrive wrote: post #37

Earlier quoted context omitted.

An example needs to be set. They should be sued for issuing a DMCA notice in bad faith.

I'm curious who has standing. One of the people who posted/commented in the original thread? A user who wanted to learn about CipherCloud? StackExchange itself?

I think it should be StackExchange. I wouldn't mind pooling in for legal fees, if they start a fund or something.

Re: CipherCloud Responds to the Crypto StackExchange Controversy

#50

Post by rdl »

pchowdhry wrote: post #48
rdl wrote: post #29

This is a good example of bad legal/PR turning a company from a fairly well respected new security company to a joke. Tokenization, which CipherCloud does, could actually be done fairly securely if you had a decent amount of local storage. They IIRC use a FIPS HSM for local key storage in their local appliance (I talked to one of their founders as a security event a year or two ago and was initially suspicious of the…

Agreed, no magic here. I rolled a quick version using Squid and greasy spoon. Got it to work on SFDC and Gmail inside of a day. Using tags around the encrypted content and regex you could then feed the content into the decryption engine. Search works, etc. You could even using a unique IV per user to add a level of security, but it is by no means rock solid. It would however address some of the frequency analysis con…

Maybe the correct response here is an open source version of CipherCloud, built on open/published principles (to make it easy to verify the level of security provided).
Post reply on HN