Re: [Seeks-users] P2P Network and Software Security Method

[Emmanuel B. <ebe...@se...>]

Hi,

sorry for the delay in the answer.

Seeks needs to protect both data and people.

On the data front:
1a- queries should be protected as much as possible on the network.
1b- local (personal) data such as ratings and URIs, should be
  protected from phishing and eavesdropping.
1c- data should be served from identified / secure sources, avoiding
  man-in-the-middle type of attacks.

On the people front:
2a- people's identity on the network should be protected.
2b- association of query and people should be made difficult.

There may be other situations to take into account. Most of these issues
are challenging because Seeks' aim is to have people collaborate through
an intense exchange of data fragments.

Some of the issues above are already taken into account in Seeks' design.
Thus 1a is made easier because Seeks exchanges queries in the form of 
hashed query fragments. This is similar to content encryption. It is even
slightly more robust since the breaking into fragments allows to partially
fulfill 2b: Seeks makes it very difficult, if not impossible to infer the 
_exact_ query sent by a user.
1b is very partially fulfilled as data transits in the form of compressed
protocol buffers. Adding encryption is required for true protection though.

The path to a very secured application is likely to be long. I am interested
in listing technical solutions for all the issues above.

Em.

On Sun, Jan 23, 2011 at 03:58:06PM +0100, Alexandre CABROL PERALES wrote:
> This topic is already opened.
> But i would like to relocate this discussion.
> 
> Before start to define how to protect an information system we have
> to talk about:
> * which method we will use to secure the system
> * what is the scope
> * what is the risk assesment
> 
> More over technical solutions are not enougth.
> 
> I can take as example Tor project which has to practice awareness on
> usage of it's network. Tor main security issue is social engineering
> like phishing.
>