Ephemeralizing the Web

by George Lawton 

Most data storage research focuses on how to keep data around for longer periods, but a University of Washington research team has undertaken the opposite challenge: how to make it disappear.

Disappearing ink is an idea that goes back to the beginning of writing. In the digital realm, it includes numerous research efforts to create disappearing messages and at least one commercial venture based on the technology. The novelty of Vanish, the research software tool in development, is its use of an architecture that eliminates the weakest link by storing the key outside any single trusted authority.

Hank Levy, chair of the University of Washington's computer science department and one of Vanish's creators, said researchers have developed several approaches for making data disappear automatically after it's been distributed. He cites Radia Perlman's work on Ephemerizer as an example. But systems that rely on an organization to destroy the key can have issues, he noted. For instance, Hushmail promised to encrypt users email, but was in fact providing unencrypted emails to the US government. Levy said the basic question is "whether it's possible to cause data to vanish—become unreadable—without any action on the part of the user or by any 'trusted' third party."

Terminal Email

Vanish is attempting to address the mismatch between the indiscriminate nature of the Web and the realities of perpetual storage. It can be challenging for someone to completely remove an off-color joke or unintended comment after it has been indexed by Facebook or Google.

"Today's email and other electronic communications systems put a chill on the freedom of thought and the freedom of speech. It's safer to practice extreme self-censorship than to engage in free and open discussion because you can never know how what you say may be reinterpreted or taken out of context later," said Jeff Ubois, a cofounder of Disappearing Inc., an early commercial provider of similar technology. "Cardinal Richelieu once said, 'Give me six lines written by the most honorable man, and I will find an excuse in them to hang him.' And that is all the more true with email."

Levy said his research group wants to bring the equivalent of the phone call to the Internet. "In the real world, we make distinctions between things that are private and things that are not," he explained. But as technology advances and all of our communication becomes digital, we lose that distinction and we need a way to control data lifetimes. Today all communication is via email, and therefore all communication—from the stupid to the inconsequential to the important—is archived and permanent. We need to have a way to still make distinctions of what should last and what shouldn't."

Vanish can erase messages posted on any electronic medium, including email, instant-messaging chats, or even social networking sites. Although still in an experimental phase, it could give users a medium for making ephemeral conversations evaporate on their own.

How It Works

Vanish users install the plug-in on their Firefox browser. When they enter text they would like to vanish, they hit the Vanish button, which uses public key cryptography to create a scrambled version of the text called a Vanish data object (VDO). They can then send this text in an email or post it to a social networking site. Unlike traditional public key cryptography, the key is not stored by either the sender or the recipient. Instead, it's encoded into multiple partially redundant files, which are stored in a distributed hash table (DHT), a specific kind of distributed database used for indexing the location of peer-to-peer files.

Recipients can decrypt a text if the Vanish client running on their browser can retrieve a predetermined portion of these files from the DHT. The current implementation runs on top of the Vuze BitTorent infrastructure, which distributes these key files across millions of Vuze clients. The Vuze software is implemented in a way that lets each client refresh its entire data cache every eight hours. As each client refreshes its cache, it throws away pieces of the VDO key. After enough pieces have been lost, it is no longer possible to decrypt the VDO.

A VDO's lifetime depends on the nature of the Vuze DHT algorithms. It's possible to keep messages alive for longer periods using a DHT caching server that's continuously connected to the network.

The Self-Deleting Data Challenge

Vanish is still in an early research phase. Levy said this implemenatation it has several weaknesses. Many of them are tied to the implementation on top of Vuze, which wasn't designed for this type of application. It has neither the properties to support different data lifetimes nor the security to prevent an adversary from making a long term copy of the key. In the future, it might be possible to harden the peer-to-peer infrastructure for storing the keys for improved security and more variable life spans. One hybrid approach is to distribute keys over several types of structures, such as multiple DHTs and multiple trusted services, in a way that would require an attacker to break all of those systems to find the keys.

Levy said they haven't thought about commercializing the technology. Rather, they want to inspire a conversation on how to create a truly ephemeral infrastructure. He explained, "We wanted to set out this challenge about self-deleting data that happens through some natural process and to give one model. Our hope is that others will follow with other ideas as well."

Download the Vanish client for Firefox at http://vanish.cs.washington.edu/download.html.