[tahanteada]

Silma jäi uudis turvalise interneti teemal:
New Approach Could Stop Websites from Leaking or Stealing Your Data
A system called Mylar makes it possible to build online services that can never decrypt or leak your data.
Reminders that data entrusted to online services can easily be leaked or stolen aren’t hard to find. Major companies commonly have passwords and other data taken by attackers, while governments have their own ways to get hold of user data.

Researcher Raluca Popa of MIT thinks many online services should and could be redesigned to guard against that. “Really, there’s no trusting a server,” she says. Popa has led the development of a system called Mylar for building Web services that puts that philosophy into practice. Services built using it keep data on their servers encrypted at all times and only ever decrypt it on a person’s computer.

“You don’t notice any difference, but your data gets encrypted using your password inside your browser before it goes to the server,” Popa says. “If the government asks the company for your data, the server doesn’t have the ability to give unencrypted data.” Popa developed the software with colleagues from MIT and a Web development software company, Meteor Development Group. A paper on Mylar will be presented at the Usenix Symposium on Networks Systems Design and Implementation next month.

The idea of designing Web services that always keep data encrypted while it resides on their servers has been around for years, and researchers have developed tools to demonstrate how it might be done. But Popa says Mylar is more practical than previous efforts and could even be used to build services today.

The software is designed to work with a popular Web service building tool called Meteor, to make it easy for Web developers to use. Mylar’s design has code running inside a person’s browser take on most of the processing and presenting of information—work that a conventional service would do on its servers. But Mylar also includes some new cryptographic tricks that allow a server to do useful things with user data without having to descramble it. It is possible for a service built with Mylar to search across encrypted data stored on its servers, for example, so a person could search documents they had uploaded to a file storage service.

Mylar also lets individuals share data with other users, thanks to a system that can distribute the necessary encryption key in a way that protects it from ever being disclosed either to the server or to someone monitoring communications. An optional browser extension can be used to protect against the server stealing the key needed to decrypt a person’s data, in the event it has been taken over by an attacker or malicious insider.

Terve jutt siis lingil:
http://www.technologyreview.com/news/525651/new-approach-could-stop-websites-from-leaking-or-stealing-your-data/