Privacy Engineering for Social Networks
Total Page:16
File Type:pdf, Size:1020Kb
UCAM-CL-TR-825 Technical Report ISSN 1476-2986 Number 825 Computer Laboratory Privacy engineering for social networks Jonathan Anderson December 2012 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2012 Jonathan Anderson This technical report is based on a dissertation submitted July 2012 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Trinity College. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 Privacy engineering for social networks Jonathan Anderson In this dissertation, I enumerate several privacy problems in online social net- works (OSNs) and describe a system called Footlights that addresses them. Foot- lights is a platform for distributed social applications that allows users to control the sharing of private information. It is designed to compete with the performance of today’s centralised OSNs, but it does not trust centralised infrastructure to en- force security properties. Based on several socio-technical scenarios, I extract concrete technical problems to be solved and show how the existing research literature does not solve them. Addressing these problems fully would fundamentally change users’ interactions with OSNs, providing real control over online sharing. I also demonstrate that today’s OSNs do not provide this control: both user data and the social graph are vulnerable to practical privacy attacks. Footlights’ storage substrate provides private, scalable, sharable storage using untrusted servers. Under realistic assumptions, the direct cost of operating this storage system is less than one US dollar per user-year. It is the foundation for a practical shared filesystem, a perfectly unobservable communications channel and a distributed application platform. The Footlights application platform allows third-party developers to write so- cial applications without direct access to users’ private data. Applications run in a confined environment with a private-by-default security model: applications can only access user information with explicit user consent. I demonstrate that practical applications can be written on this platform. The security of Footlights user data is based on public-key cryptography, but users are able to log in to the system without carrying a private key on a hardware token. Instead, users authenticate to a set of authentication agents using a weak secret such as a user-chosen password or randomly-assigned 4-digit number. The protocol is designed to be secure even in the face of malicious authentication agents. 3 4 ACKNOWLEDGEMENTS I gratefully acknowledge the sponsorship of the Rothermere Foundation. The 2nd Viscount Rothermere, first Chancellor of Memorial University of Newfound- land, endowed the Rothermere Fellowship to aid Memorial students in their pursuit of higher degrees in the United Kingdom. Without this generous support, I would not have been able to pursue my PhD in Cambridge. I am also grateful for the sponsorship I received from the Natural Sciences and Engineering Research Council of Canada (NSERC). The US Defence Advanced Re- search Projects Agency (DARPA) supported projects that I was involved with dur- ing my PhD, although that work is not part of this dissertation. I thank my supervisor, Frank Stajano, for his guidance and mentorship dur- ing my PhD. You gave me freedom to explore my research horizons but kept me grounded in reality when I needed to communicate those ideas or even when I needed to Just Finish. I remember clearly the advice you gave me on the first day I sat in your office; I hope to share it with my own students one day. They say it takes a village to raise a child. My development as a researcher has been immeasurably spurred by collaborations and conversations with many col- leagues. Joseph Bonneau, Claudia Diaz and I collaborated on the work that grew into this dissertation’s subject. Robert Watson once poked his head in my office door to ask, “have you ever hacked OS kernels?”; the subsequent collaboration has greatly influenced my thinking about operating systems and application confine- ment. Luke Church helped open my eyes to alternative viewpoints on security, as well as the existence of users as people rather than rhetorical devices. I am grateful to co-authors Ben Laurie, Kris Kennaway, George Danezis, Sören Preibusch and all of the CTSRD team. My thinking on both security and the nature of research has been aided immeasurably by early advice I received from Ross Anderson, Bruce Christianson and Saar Drimer. I have also received very helpful feedback on drafts of this dissertation from Ross Anderson, Robert Watson, Joseph Bonneau, Anil Mad- havapeddy, Richard Clayton, Wei Ming Khoo and Bjoern Zeeb. Thank you all. I acknowledge my PhD examiners, Bart Preneel and Jon Crowcroft, who en- gaged with and validated my work; our conversation was stimulating and idea-rich, although when it comes to a viva voce examination, I believe that once is enough. 5 I would also like to thank my friends Tom & Julie and Will & Jackie, whose footprints along the doctoral road helped me trace the path to my own PhD. Thanks to Mom & Dad for buying me Lego and for having patience when I took things apart and couldn’t put them back together again. You’ve always supported my creative and academic pursuits, encouraged me to follow my dreams and be- lieved that I could get there. Thank you. I also thank Earl & Barbara and Russell & Cara for believing in me and encour- aging us to go to Cambridge, even though it took Chrissy so very far away. Finally, to Chrissy, my wife: thank you for your love, support, encouragement and constant companionship. When I wasn’t sure I could finish this work, you were there with words of comfort, strength and purpose. I can’t imagine a better friend. I’ve loved every day we’ve spent together, and I look forward to loving every day we spend together in the years to come. Soli Deo gloria. 6 1 AUTHOR PUBLICATIONS JOURNALS [1] R.N.M.WATSON, J. ANDERSON, B. LAURIE, AND K. KENNAWAY. A taste of Capsicum: practical capabilities for UNIX. Communications of the ACM, 55(3):97, Mar. 2012. doi:10.1145/2093548.2093572. CONFERENCES [2] J.ANDERSON, C. DIAZ, J. BONNEAU, AND F. STAJANO. Privacy-enabling social networking over untrusted networks. In WOSN ’09: Proceedings of the Second ACM Workshop on Online Social Networks. ACM, Aug. 2009. doi:10. 1145/1592665.1592667. [3] J.ANDERSON AND F. STAJANO. Not that kind of friend: misleading diver- gences between online social networks and real-world social protocols. In SPW ’09: Proceedings of the Seventeenth International Workshop on Security Proto- cols, Apr. 2009. URL: http://www.cl.cam.ac.uk/~jra40/publications/2009/ SPW-misleading-divergences.pdf. [4] J.ANDERSON AND F. STAJANO. On storing private keys "in the cloud". In SPW 2010: Proceedings of the Eighteenth International Workshop on Security Proto- cols, Mar. 2010. URL: http://www.cl.cam.ac.uk/~jra40/publications/2010/ SPW-key-storage.pdf. [5] J.ANDERSON, F. STAJANO, AND R. N. M. WATSON. How to keep bad papers out of conferences (with minimum reviewer effort). In SPW 2011: Proceedings of the Nineteenth International Workshop on Security Protocols, Mar. 2011. doi: 10.1007/978-3-642-25867-1_34. 7 AUTHOR PUBLICATIONS [6] J.ANDERSON AND R. N. M. WATSON. Stayin’ alive: aliveness as an alterna- tive to authentication. In SPW 2012: Proceedings of the Twentieth International Workshop on Security Protocols, Apr. 2012. URL: http://www.cl.cam.ac.uk/ ~jra40/publications/2012/SPW-stayin-alive.pdf. [7] J.BONNEAU, J. ANDERSON, R. J. ANDERSON, AND F. STAJANO. Eight friends are enough: social graph approximation via public listings. In SNS ’09: Pro- ceedings of the Second ACM EuroSys Workshop on Social Network Systems, pages 13–18. ACM, Mar. 2009. doi:10.1145/1578002.1578005. [8]J.B ONNEAU, J. ANDERSON, AND G. DANEZIS. Prying data out of a so- cial network. In Proceedings of the 2009 International Conference on Advances in Social Networks Analysis and Mining (2009), pages 249–254, 2009. doi: 10.1109/ASONAM.2009.45. [9] R.N.M.WATSON, J. ANDERSON, B. LAURIE, AND K. KENNAWAY. Cap- sicum: practical capabilities for UNIX. In Proceedings of the 19th USENIX Se- curity Symposium. USENIX Association, Aug. 2010. URL: http://portal.acm. org/citation.cfm?id=1929820.1929824. WORKSHOPS (NO PROCEEDINGS) [10] J.ANDERSON. Psychic routing: upper bounds on routing in private DTNs. In Hot Topics in Privacy Enhancing Technologies (HotPETS), 2011. URL: http: //petsymposium.org/2011/papers/hotpets11-final9Anderson.pdf. [11] J.ANDERSON, J. BONNEAU, AND F. STAJANO. Security APIs for online ap- plications. In ASA-3: Third International Workshop on Analysing Security APIs, July 2009. URL: http://www.cl.cam.ac.uk/~jra40/publications/2009/ASA- security-apis-for-online-applications.pdf. [12] J.ANDERSON, J. BONNEAU, AND F. STAJANO. Inglorious installers: security in the application marketplace. In WEIS ’10: The Ninth Workshop on the Eco- nomics of Information Security, pages 1–47, 2010. URL: http://www.cl.cam.ac. uk/~jra40/publications/2010/WEIS-inglorious-installers.pdf. [13] J.BONNEAU, J. ANDERSON, AND L. CHURCH. Privacy suites: shared pri- vacy for social networks (poster). In SOUPS ’09: Symposium on Usable Privacy 8 AUTHOR PUBLICATIONS and Security, 2009. URL: http://cups.cs.cmu.edu/soups/2009/posters/p13- bonneau.pdf. [14] L.CHURCH, J. ANDERSON, J. BONNEAU, AND F. STAJANO. Privacy stories: confidence in privacy behaviors through end user programming (poster). In SOUPS ’09: Symposium on Usable Privacy and Security, 2009. URL: http:// cups.cs.cmu.edu/soups/2009/posters/p3-church.pdf. [15] R.N.M.WATSON AND J.