e open privacy stack: privlyoscon 2013 priv.ly/pages/download this is a demonstraon of privly’s...
TRANSCRIPT
![Page 1: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/1.jpg)
@privlyLeadDeveloper:SeanMcGregor@seanmcgregorCommunityManager:JenniferDavidson@jewifer
The Open Privacy Stack: Privly
![Page 2: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/2.jpg)
Outline
1. Howthewebisbrokenforsecurity2. "InjectableApplicaJons"asasoluJon3. HowPrivlyimplementsinjectableapplicaJons4. MoreoninjectableapplicaJons5. ThePrivlyFoundaJonandthewayforward
OSCON 2013 �
priv.ly/pages/download� 2
![Page 3: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/3.jpg)
HowSecurityontheWebisBroken• PRISM:Onlineserviceproviderscannotprotectusersfromthegovernmentsunderwhichtheyoperate
• Hushmail:Onlineservicescannotprotectusersfromthemselves
• Facebook“Like”Bu9on:SecurityandfuncJonalityaredifficulttocombine
OSCON 2013 �
priv.ly/pages/download� 3
![Page 4: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/4.jpg)
TextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBeTextisText,WhereveritMayBe
SoluJon:StopReinvenJngSecurity
OSCON 2013 �
priv.ly/pages/download� 4
• Yoursiteisunique,butyourdataisnot!• WrapcontentinitsownapplicaJonviewedinsideyourwebapplicaJon
TheApplicaJon!==TheData
![Page 5: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/5.jpg)
5
TextisText,WhereveritMayBe
OSCON 2013 �
priv.ly/pages/download�
![Page 6: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/6.jpg)
6
ThatWasPrivlyatWork
OSCON 2013 �
priv.ly/pages/download�
1. BrowserExtensiondiscoversspeciallyforma]edlink
2. “Injects”thelink
![Page 7: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/7.jpg)
7
ThisisaCompleteWebApplicaJon
TextisText,WhereveritMayBe
ThisisaCompleteWebApplicaJon
OSCON 2013 �
priv.ly/pages/download�
![Page 8: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/8.jpg)
8
ThePrivlyURL
privlyalpha.org/apps/PlainPost?privlyApp=PlainPost&privlyDataURL=privlyalpha.org/posts/1.json
OSCON 2013 �
priv.ly/pages/download�
1Thehostedapppath
2App
specifier
3Data
address
privlyApp=ZeroBinprivlyApp=PGP
![Page 9: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/9.jpg)
9
ExtendedBrowser
Server
HostPage
h]ps://Privlyalpha/apps/PlainPost?privlyApp=PlainPost&privlyDataURL=h]ps://privlyalpha.org/posts/2342536674.json
OSCON 2013 �
priv.ly/pages/download�
ThisisademonstraJonofPrivly’scapabiliJes.Thehostpage,Twi]er,doesnothaveaccesstotheTweet’scontents.ItisalsonotlimitedbythelengthimposedbyTwi]er.
![Page 10: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/10.jpg)
10
NoExtension
ExtensionJenDavidson
JenDavidson
OSCON 2013 �
priv.ly/pages/download�
@jewifer
ThisisademonstraJonofPrivly’scapabiliJes.Thehostpage,Twi]er,doesnothaveaccesstotheTweet’scontents.ItisalsonotlimitedbythelengthimposedbyTwi]er.
privlyalpha.org/apps/PlainPost…
@jewifer
![Page 11: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/11.jpg)
OSCON 2013 �
priv.ly/pages/download� 11
JavascriptCryptographyPotenFallyNotHarmfulPrivly
Pre-DistributetheApps
?privlyApp=PlainPost&
2App
specifier
![Page 12: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/12.jpg)
WhatiftheUserDoesn’tHavetheApp?• OpJonalhostedfallback– PosJnguserscanchooseanappwherehostedfallbackispossible
– Youdonotprotectusersfromthehost
– Bestcase,youhostityourself
– ZeroBinAppisacompromiseOSCON 2013 �
priv.ly/pages/download� 12
privlyalpha.org/apps/ZeroBin
1Thehostedapppath
![Page 13: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/13.jpg)
MoreAboutthese“InjectableApps”
• Current– PlainPost:MostuniversalapplicaJon– ZeroBin:Encryptedbytheanchortext
• InDevelopment– PGP:StrongPublicKeyCrypto– IndieData:PersonalSemanJcDatastore
• Planned– OTR:EncryptedchatapplicaJon– variousotherspecificusecases
OSCON 2013 �
priv.ly/pages/download� 13
![Page 14: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/14.jpg)
CoolPotenJalFuncJonality• HostpageAPI• Hooksintodistributedhashtable• SeamlessintegraJonwithsocialnetworksforsharinglists
OSCON 2013 �
priv.ly/pages/download� 14
Client-SideMessageInterface
![Page 15: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/15.jpg)
AreWebsitestheAdversary?
• OnlyfromasecurityperspecJve– Havetoaccountforworstcasescenarios
• PrivlyincreasesJme-on-site– Increasedaddrevenues– Time-on-siteismorevaluablethanbeingabletotargetadverJsingtoprivatemessagecontents
OSCON 2013 �
priv.ly/pages/download� 15
![Page 16: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/16.jpg)
PrivlyDevelopmentStatus
16
Soph
isJcaJo
n
• GoogleChromeExtensionisthemostadvanced• UsetheChromeExtensiontodevelopInjectableApps• GoogleSummerofCodestudentsaredevelopingiOSandAndroidversion
16
![Page 17: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/17.jpg)
ContentServers
OSCON 2013 �
priv.ly/pages/download� 17
Soph
isJcaJo
n• Datadriven• AdverJsesextensions• Privly-applicaJonsrunsfromstaJcfolder
![Page 18: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/18.jpg)
What’sNext
• Securityishard,innovaJonisdangerous• Putwarningsoneverythingandrelease/iterate
OSCON 2013 �
priv.ly/pages/download� 18
![Page 19: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/19.jpg)
MakinganInjectableApplicaJon
• StartwiththeChromeextension:github.com/privly/privly-chrome• EasiestwaytostartisbyediJngthePlainPostapplicaJon
OSCON 2013 �
priv.ly/pages/download� 19
![Page 20: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/20.jpg)
Resources
• Info/Download:priv.ly• Communicate:privly.org• Code:h]ps://github.com/privly• LatestContentServer:h]ps://privlyalpha.org• Slides:github.com/privly/privly-organizaJon/tree/master/presentaJons/2013-07-25-OSCON/OSCON.ppt
OSCON 2013 �20
![Page 21: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/21.jpg)
GetConnected
#privlyonirc.freenode.netJoinourmailinglist,h]p://bit.ly/privly-group
OSCON 2013 �
priv.ly/pages/download� 21
![Page 22: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/22.jpg)
Techno-AcJvism3rdMondays
• AugustEvent:h]p://ta3m-pdx-3.eventbrite.com
• TA3MWiki:h]p://wiki.openitp.org/events:techno-acJvism_3rd_mondays
OSCON 2013 �
priv.ly/pages/download� 22
![Page 23: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/23.jpg)
Free(AsinBeer)
• ThehandoutsatthefronthavedirecJonsforgetngcredenJalsononprivlyalpha.org
23
OSCON 2013 �
priv.ly/pages/download�
![Page 24: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/24.jpg)
Wait…what?
• Privlyallowsyoutopost“private”contentanywhereontheweb
• PrivlyallowsyoutoofferyourusersprotecJonfromyourservers(becausewhatiftheygetcompromised?Onooo!)
• Privlyisaflexibleframework–youcanaddallkindsofapplicaJons
OSBridge 2012 �
priv.ly/pages/download� 24
![Page 25: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/25.jpg)
Legal
• AlllogosarepropertyoftheirrespecJveowners
• GraphicsinthispresentaJonareusedunderaCreaJveCommonsLicense
• ThispresentaJonislicensedunderA]ribuJon-ShareAlike3.0Unported(CCBY-SA3.0)(h]p://creaJvecommons.org/licenses/by-sa/3.0/)
25
OSCON 2013 �
priv.ly/pages/download�
![Page 26: e Open Privacy Stack: PrivlyOSCON 2013 priv.ly/pages/download This is a demonstraon of Privly’s capabiliJes. The host page, Twi]er, does not have access to the Tweet’s contents](https://reader035.vdocument.in/reader035/viewer/2022071502/612261748554f00d0274e0e9/html5/thumbnails/26.jpg)
QuesJons?
Thanks to O’Reilly Media! h]ps://priv.lyh]ps://groups.google.com/group/privly@privlySean:@seanmcgregorJen:@jewifer
26
OSCON 2013 �
priv.ly/pages/download�