[Seeks-users] P2P Network and Software Security Method

[Alexandre CABROL PERALES]

This topic is already opened.
But i would like to relocate this discussion.

Before start to define how to protect an information system we have to
talk about:
* which method we will use to secure the system
* what is the scope
* what is the risk assesment

More over technical solutions are not enougth.

I can take as example Tor project which has to practice awareness on
usage of it's network. Tor main security issue is social engineering
like phishing.

[Emmanuel Benazera]

Hi,

sorry for the delay in the answer.

Seeks needs to protect both data and people.

On the data front:
1a- queries should be protected as much as possible on the network.
1b- local (personal) data such as ratings and URIs, should be
protected from phishing and eavesdropping.
1c- data should be served from identified / secure sources, avoiding
man-in-the-middle type of attacks.

On the people front:
2a- people's identity on the network should be protected.
2b- association of query and people should be made difficult.

There may be other situations to take into account. Most of these issues
are challenging because Seeks' aim is to have people collaborate through
an intense exchange of data fragments.

Some of the issues above are already taken into account in Seeks' design.
Thus 1a is made easier because Seeks exchanges queries in the form of
hashed query fragments. This is similar to content encryption. It is even
slightly more robust since the breaking into fragments allows to partially
fulfill 2b: Seeks makes it very difficult, if not impossible to infer the
_exact_ query sent by a user.
1b is very partially fulfilled as data transits in the form of compressed
protocol buffers. Adding encryption is required for true protection though.

The path to a very secured application is likely to be long. I am interested
in listing technical solutions for all the issues above.

Em.

Post by Alexandre CABROL PERALES
This topic is already opened.
But i would like to relocate this discussion.
Before start to define how to protect an information system we have
* which method we will use to secure the system
* what is the scope
* what is the risk assesment
More over technical solutions are not enougth.
I can take as example Tor project which has to practice awareness on
usage of it's network. Tor main security issue is social engineering
like phishing.