15 Jan 2015 - Ian Goldberg

Abstract

Users of social applications like to be notified when their friends are online. Typically, this is done by a central server keeping track of who is online and offline, as well as of the complete friend graph of users. However, recent NSA revelations have shown that address book and buddy list information is routinely targetted for mass interception. Hence, some social service providers, such as activist organizations, do not want to even possess this information about their users, lest it be taken or compelled from them.

In this talk, we present DP5, a new suite of privacy-preserving presence protocols that allow people to determine when their friends are online (and to establish secure communications with them), without a centralized provider ever learning who is friends with whom. DP5 accomplishes this using an implementation of private information retrieval (PIR), which allows clients to retrieve information from online databases without revealing to the database operators what information is being requested.