What is Digg?Sponsored by Sony Pictures
Do you believe the 2012 Mayan Prophecy? view!
whowillsurvive2012.com - The Mayan Calendar predicts the end of time: 2012. See the trailer for 2012, opening November 13.
54 Comments
- krystofr, on 07/21/2009, -1/+31Will this work with my student loans???
- latrosicarius, on 07/21/2009, -1/+15and then there are ***** like me who would copypasta and archive the vanished text
- morcheeba, on 07/21/2009, -0/+10The big criticism of these types are systems is that they are easy to hack by simply printing out the data, or saving it to a file. I was interested to see how they had solved this. The article addresses that:
"It is technically possible to save information sent with Vanish. A recipient could print e-mail and save it, or cut and paste unencrypted text into a word-processing document, or photograph an unscrambled message. Vanish is meant to protect communication between two trusted parties, researchers say."
So, basically what they are saying is that they don't address this issue at all... if you have two trusted parties, then you can use standard PGP encryption. The only difference is that with this system, the receiver must decrypt it in a fixed time period... but this doesn't do anything to make the data go away.
The only useful situation I can think of is that you're communicating with someone you trust now (trust not to save a copy), but don't think you'll trust in the future. But, then using this system is a tip-off that you don't trust them in the future & when they realize that, they might make a copy just in case. - netneutrality, on 07/21/2009, -1/+11There's sure to be some annoying anonymous bot that would crawl the web posting everything back to some new fangled web 2.0 site for the purpose of collecting and archiving Vanish'd strings (with ads on it of course). And the cycles continues.
- 3rdDay, on 07/21/2009, -2/+10Very useful. More & install instructions here:
http://vanish.cs.washington.edu/ - Vostok, on 07/21/2009, -1/+7I know a few senators and politicians that are going to love this.
- parestrep, on 07/21/2009, -3/+8This is brilliant, but do I really want to post an encrypted string of gibberish as a status every time I update Facebook?
I went to their site, and just converting the simple phrase "hello there" gave me over one thousand characters. - rmxz, on 07/21/2009, -0/+5"I am sure you all have heard of PGP in email. That fad is gone. "
Surely not. It's required by one of my employers when I send email with any sensitive information. - ng007, on 07/21/2009, -0/+5A more pertinent question would be: How would one stop someone else from saving a copy of the secured items while access is still available? Nothing could stop that, as far as I can tell. For business and personal secrets this would prove to be a very serious problem for the communication because the information leaked is more important than its authenticity in many cases. It may have some advantage for legal purposes, however, if unverifiable messages are thrown out of court (as they should be).
- ng007, on 07/21/2009, -0/+5There are reasons to use PGP for "boring" communication, believe it or not. First, it makes people aware of the technology. If you get in a bind, and have to send a secret message to a friend or coworker, it's pretty inconvenient to use PGP when nobody knows how to read it and nobody has keys (much less signed keys) yet.
The other reason is that simply using PGP probably makes a person suspect to anyone who sees that a PGP string is in the message, which is very undesirable for someone with a real secret to share. If such an email were sent within a company doing something illegal, for example, that company would know who leaked the info. Sure, the message itself might still be secret at the moment the communication is discovered, but it singles one out as an "interesting" person. Further investigation could press parties to the conversation to give up the secret. - Louis11, on 07/21/2009, -0/+4I think he meant to build it into the browser so that there is no need to go and decode the message. Instead, when the browser loads it automatically decodes the message. Unless of course it's expired, in which case no message could be displayed.
Setting your clock back wouldn't have any affect . . . That would be a stupid expiration system, now wouldn't it? - gerobo, on 07/21/2009, -1/+5it would be so nice if people like you would actually take the time to read what the system actually does and HOW it does it. Well, I guess it's too much to ask.
- BxBoy, on 07/21/2009, -1/+5Interesting, but seems like an unnecessary extra step.
If it was built into the browser and automatically decoded (unless it's expired), then it would be more useful. - teamgwho, on 07/21/2009, -0/+4"people think if they hit delete, the information is gone."
then there are morons who never think to even hit delete. I was talking about a way to better collect photographs people take at an event, and rather then having them email them or post them to the website (which few people will do), just ask people before they leave to visit a designated person w/a laptop. They take your memory card, offload the photos, then give you back your card. Now we've got all the photos and it's quick and easy.
except people forget to delete photos from their memory cards. One woman told me she did this at a wedding and you wouldn't believe all the photos she got that she wished she could unsee. "like private photos?" "yes" "candid photography? ay-ay-nudge nudge wink wink say no more?"
"yes, oh good lord yes."
People amaze me. - Wavemancali, on 07/21/2009, -0/+4While the theory is great, it will not work in practice for the simple fact that it takes effort, time and resources.
People will get sick of the effort and time it takes to encrypt the data, and other people will worry, what if the resources used to perform the encryption disappear at some point? - JantjePietje, on 07/21/2009, -1/+4the only problem is that others need to install vanish to to be able to read anything
- yaminohikari, on 07/22/2009, -0/+3@4AntiStupid
Go back and read the article more carefully. The encryption is NOT time-based. The system works by encrypting the message and scattering parts of the encryption key to dozens of computers via P2P, but only a subset of the pieces are needed to decrypt the message. Computers on the P2P network are set to clear their key fragments every 8 hours, hence the 8-hour expiration. It wouldn't matter if one or a few computers built a P2P program that violated the 8-hour rule, because your fragment is not enough to decrypt the message, let alone finding out which message the key belongs to would be a pain in itself (by the way, the scope of this project DOES NOT include authorization or authentication). And even if you did find out, it'd be much easier to copy-paste the original message. - Barackalypse, on 07/21/2009, -0/+3Yes, but because of the encryption it would have to be someone else re-posting it under their account, and once the post expires there is no way to authenticate what the original poster actually said in the message, since the re-poster could easily have photo shopped any text in there.
- parestrep, on 07/21/2009, -1/+4Not at all. The article explains the decoding method.
"Vanish creates a secret key, which it never reveals to the user, and then encrypts the message with that key. It then divides the key into dozens of pieces..." which eventually are written over and lost. - krisrm, on 07/21/2009, -2/+4I'm going to use this, just to be a jerk to all my Facebook friends who'll never have the slightest clue what the word "key" has to do with why my message is a bunch of random characters :)
- kaelyiesta, on 07/22/2009, -0/+2It's still a web service request. The data is not stored locally, so changing ones own system clock would not allow the encrypted text to be read if it has 'expired'.Think of it as a URL to the text in question. That's not quite how it works, but they share the same principle of non local data access.
- MrRtd, on 07/22/2009, -0/+2It's a nice idea, but there will be ways to work around it. For instance, if you suspect the info is going to self destruct, then better print it out, take a screen shot, or however else you want to make a copy.
Seriously, if your information that is so confidential, better to avoid the internet altogether, or if you don't want any trace of your information lingering around for years, then again avoid the internet, don't write it down, don't use your cell, or regular phone, don't even speak it. - kavaliro, on 07/22/2009, -0/+2It would be cost-prohibitive to try and recover "vanished" data unless you knew in advance to grab the p2p data. It's not fool-proof, but it's at least as reliable as the lock on your front door. It's better than not having a lock, if just barely.
- SystemicThought, on 07/21/2009, -4/+6If only this would work with the google searches that Google archives along with your IP.
- 4AntiStupid, on 07/21/2009, -0/+2It doesn't sound very practical. No one will bother with the setup to view your encrypted messages so might as well just not post them in the first place. It also would tend to be slow and have a high failure rate if you have to hit so many sites to get the key.
- Spyder2k, on 07/22/2009, -0/+2Great! Can someone modify this to work with exgirlfriends.
- DaEmEoNd, on 07/21/2009, -0/+2Ummmm how about the print screen key, now I have a hard copy...
- RachelJTM, on 07/27/2009, -0/+1with all the back-up and time machines and mobile me's--- you are certainly not alone!
- Tellie, on 07/22/2009, -0/+1Thank you for your clarification, although I perfectly understand the purpose of Vanish already. While my post tried to be mostly humorous, my viewpoint is that this product is entirely pointless. The weakness here lies in the facts that a) anyone can convert the ciphertext to plaintext, even Google/Facebook should they choose to do so and b) it implies trust in the distributed network it utilizes.
Regarding a), if Google, Facebook (or any other site for that matter) wishes to retain your message for future use, it would be trivial to write an application that detects when users upload Vanish'd text, convert it to plaintext and then store it. Any other user overseeing the ciphertext could also do this. If one does not accept this as a point of fallacy, one must also forfeit the need for Vanish in itself: By using it, you are highlighting otherwise plain information as being sensitive and drawing attention to it, thereby undermining the purpose of the system. In addition, if one choses to argue the need for this system, one must also accept that this need arises from the fact that social networking sites wants or seeks to retain your information for future use. If we accept this then we must also accept that the site may employ any mean to achieve this goal, part of this being the timely decryption and storing of the plaintext message.
In regard to b): Trust on this scale is very difficult. As I mentioned earlier, the use of such a tool draws attention to your message, and the creators of these tools might (now or in the future) be inclined to create backdoors or ways to recover outdated messages. The fact that the system is distributed makes this even more complicated. One would have to assume that such a tool would be primarily used for sensitive information, and again this might incline either the operator of the network or government agencies to seek access to this data. In addition, there is no reason to trust this network any more than you should trust a porn site asking for your credit card number: We know nothing about the people or organizations behind either, and it is unlikely that there will be an independent review from a credible source to support it.
I guess that the bottom line of my post is essentially that this product renders itself useless. - ng007, on 07/21/2009, -0/+1It's been tried to some extent already with Napster, I believe. Pay monthly for music that expires if you don't pay, that kind of thing. ITunes has a DRM system that could easily introduce expiration, but they'd never do it because people wouldn't buy it nearly as much. Hell, the MPAA is even realizing that they can make more with DRM-free music than with DRM-protected music.
The expiry feature of Vanish is the subject of research because they want to ensure that the data will expire even if they are compelled by law to make it stop expiring. In other words, they want to make sure that it will expire no matter what anyone tries to do to stop it. This doesn't have to be so complicated with music stores, they can make the music expire or not if they want. They won't get a warrant interfering with their business. - 4AntiStupid, on 07/21/2009, -0/+1It addresses the issue of someone searching for your name 10 years later and finding the dumb stuff you posted as a teenager. I still think simply not using your real name works better. Just wait until the next generation of politicians have to deal with all their old quotes.
- mr_ziy, on 07/23/2009, -0/+1copypasta
- ng007, on 07/21/2009, -0/+1lol, RIAA, not MPAA . . . wasn't paying attention.
- mikael110, on 07/23/2009, -0/+1I guess you haven't actually read the article
- gerobo, on 07/21/2009, -0/+0It looks to me like the point of using this is not for your everyday messages. The kind of messages I want encrypted and eventually gone from the web might be worth the extra effort.
- FastTadpole, on 07/22/2009, -1/+1@ng007 A agree, the saving of secured items with an app like this can lull someone into a sense of false security about their privacy.
- pauldy, on 07/21/2009, -3/+3This is idiotic and everyone who reports on this should be slapped IN THE FACE for being morons. Best case this group is made up of a bunch of high college students who really think they have solved a problem. More than likely they are looking to get money from stupid people who look at the problem and think these geniuses have the solution, sad.
- 4AntiStupid, on 07/21/2009, -0/+0It's not about erasing. It's about encryption and a kind of "Internet entropy" to make the key unavailable as sites are changed. Reading the message depends on the parts of the key being available at a collection of URLs.
- Tellie, on 07/21/2009, -3/+3Learn to Ctrl-C Ctrl-V.
It's kinda like sending your message written as icing on a cake, hoping that the recipient will eat the cake after reading it or the cake will rot to the point where it's illegible. Also, no taking pictures of the cake or baking a replica.
I like cake. - bb112266, on 07/21/2009, -3/+3I doubt this will work as stated. I am sure you all have heard of PGP in email. That fad is gone. the average person had nothing to worry about. Only the government has the money, technology, or reason to look at your stuff. I am sure that 99.9% of what we send online is so boring to read that we would not care if others read it. Any bank accounts or other personal information is done on a secured (https://) web page. That cannot be read by anyone else.
- yaminohikari, on 07/22/2009, -1/+1I'm not sure if you understand the point. It's not so much of a problem if the recipient writes a few notes or even archives the entire message, because s/he is assumed to be a trusted partner (read the second-to-last paragraph). The problem that Vanish tries to resolve is when online services like Google/GMail or Facebook retain the message, and you have very little control over its propagation. The hope is that archives in the cloud would be in encrypted form, so even if you lose track of it, it's scrambled and effectively useless. Vanish does not concern itself about how well you or your friends can keep a note/picture in a pocket, nor does it test how loyal your friends are; that's your job. Another thing about copy-paste, if you decided to QFT someone, then you would end up reposting it as someone else, and thus would have very little backup for authenticity (Barackalypse pointed this out in response to Joxterthemighty above).
- ggolem, on 07/22/2009, -2/+2Been there, done that. This has already been invented, implemented and applied in the marketplace. And everybody hated it, so it's going away. They called it DRM, Digital Rights Management.
- tgc1, on 07/21/2009, -5/+5Everytime a bit travels through the pipes it is copied. Therefore every THING you put on the Internet is copied. Therefore you cannot ever ensure that it is completely erased when you want to take it down. I have ***** up from 1996 in the Internet Archives. 1996! I deleted that ***** wayyyyyyyyyyyyyyyyyyyy back there and the site is still copied all over the net. IMO, if you think you can put stuff online and then decide to take it down -- you're insane.
The stuff you put online will more than likely outlive you! - Joxterthemighty, on 07/21/2009, -3/+2Just hit the print screen button or use ctrl-c/ctrl-v
The moment anyone hits the SEND button or the POST button the data is permanently on the web with no control on who can distribute it. - rmxz, on 07/21/2009, -2/+1I've been using http://searchfuscate.com to hide from sites invading privacy through archiving search terms.
Rather than obscuring my search terms from Google, Searchfuscate will randomly search for things on Google (and msn, etc) while my computer is idle; so if anyone asks my answer could be "it wasn't me, it was my screensaver who did that search". - voitenko, on 07/21/2009, -5/+3I want my data on my credit cards to expire , lol.
- 4AntiStupid, on 07/22/2009, -2/+0Go back and read the thread. It was a proposed alternate solution that used encryption with an expiration date.
- inactive, on 07/21/2009, -5/+3I'm certain both Al Queda and Pete Townsend will be overjoyed.
- ntulip, on 07/21/2009, -5/+2wow - now for porn with a 1 second expiration window.
-
Show 51 - 55 of 55 discussions
© Digg Inc. 2009
— Content created and posted by Digg users is