[Music]
thank you all for coming
it's nice to see people because this is
not a project that has a community yet
and that's why i'm here i'm hoping that
people will be interested and want to
work with me
um as you said my name is bjarni
this project is a spin-off from my work
on mailpile which was supposed to be a
secure email client
i've had some ups and downs there
project's not dead but there's not much
to use at the moment
done a few other things been around for
a while
um
this is a joke but you have to be as old
as me to get it
um
so i want to start with the funny story
about mailpile so mail pyle was an email
client and we wanted to
focus on privacy
from the very start we wanted to write
an application that took really good
care of people's data and information
and the obvious tool for that is
encryption so we wanted to download all
of your email from whatever providers
we're handling it for you
store it locally encrypt the storage
use tor use whatever tools are
applicable to
maintain privacy and
you know
we also took usability very seriously we
had people do tests we walked through
the setup of the app and and you know
when you're doing encryption locally
you always have to have some sort of key
and so one of the first things that
people had to do
in the setup phase so they were
installing this brand new app
and it asked them to choose a passphrase
and because
email is super important and this is
really sensitive data we encourage them
to choose a really really
long
strong passphrase you know four or five
words we even had a little generator
that would suggest passphrases for
people
and people did they chose a passphrase
and they typed it once and they typed it
in again and then they went and used the
app a bit
and they went back to log in and had
forgotten their passphrase
and this happened the majority of the
time
hello everybody welcome
so most people that went through this
particular usability test forgot the
passphrase that they had just chosen
within about a minute or two
it was amazing
um
there's a little happy ending there is
that there was something that came out
of these these tests and
what came out of it was a bug
so
the the application
the setup flow you want you type in your
passphrase and it's like okay now we can
encrypt everything lock it down
and it booted the user out it's like
okay the session is now invalid so now
they have to log in again
and it's like but i just typed in my
passphrase twice you want me to type it
in again
and that worked suddenly people stopped
forgetting their passphrase
so usability testing is great and
software design matters um
i'm already into this you know it's hard
to remember things repetition helps but
it took me a really long time to
reach this final insight that i've got
on the slide and
this is a problem that is common to so
many of the tools that we're using
we're asking our users now speaking we
developers of these tools and the
advocates of these tools
asking our users to make decisions about
security
way before they even know what the app
is for
like they haven't used it they have no
experience
and it has no information and it has no
data there's nothing of value there like
you know these bitcoins they're
worthless doesn't matter it's okay if i
forget the passphrase
where it's okay if i choose an insecure
one
and
then we don't revisit that so we ask
people to make really important
decisions
when they have absolutely
no ability to do so
so we're setting people up to fail right
there
and this brings me to
how the other guys deal with this stuff
um
there's always a way to undo stuff if
you're in the cloud if you've forgotten
your passphrase or lost your tokens
whatever there's usually a way to reset
and regain access
so
for the general public and for the
average person who is forgetful
the availability and the reliability of
putting your data in the cloud
is so much greater than encrypting it
and storing it locally
because there's just failure modes that
they've fixed and we don't have
solutions for
google microsoft all these big guys you
know even little guys i think wordpress
has a really nice password reset flow
built into it every single web app does
but when you enter the world of
encryption we're taking important
information and we're encrypting it
we don't have that if you forget your
passphrase to your pgp key you create a
new key
and you probably don't know how to
publish that new key in a way that other
people will find it it's
a bit of a nightmare
same for hard drive encryption
the bitcoin wallet stories everyone's
heard those a million times
some of us like to laugh some of us are
really sad
but i think there's this really
interesting duality here when we compare
cloud-based storage solutions having
other people hold our data
with doing it ourselves using strong
crypto
in that
the pros and the cons are the same thing
like
it's we consider it from a privacy point
of view we consider it a huge problem
that these big corporations have our
information
until we need access to it again and
then suddenly that's a huge feature
there's a benefit that there's this
really nice person who can give us
access to our data again when we forgot
our stuff
and then it goes we go over to the
crypto side and we consider it to be a
feature and a benefit that without the
keys nobody has access
math protects our data
the structure of the universe protects
our data it's wonderful
until we lose the key and then math
protects our data structure the universe
says no and our data is gone
so
i'm not saying this
i'm not asking crypto to be less secure
but
i would like some form of password reset
that normal users that do not have
extreme threat models
can use and trust and rely on and then
we can deploy crypto in more places
so i started working on this and
thinking you know how do we solve this
and these are sort of the building
blocks that i was working with um
the first one
show me your secret sharing how many
people in here
have heard of that algorithm
well about half of you it's pretty good
it's really interesting algorithm it
lets you
take basically a number
and you can ask it to generate
five other numbers
and if you have three of them you can
assemble the first one so keys are just
numbers keys are big numbers
and these parameters are tunable you can
say i want
all five to be found
or i want just one so you can have one
of five or you can have four or five or
you have one of ten
so you can just pick and choose how you
want to use this algorithm so it's very
flexible
the other thing i wanted to build on is
i want to build on the cloud accounts
that people already have they have these
things where there is an established
flow for
identifying and authenticating users
i just want to piggyback on top of that
and servers and storage are really cheap
so we have a lot of things that we can
build on and use
the design goals that i had
i want to solve this problem i want us
to be able to recover
a lost encryption key and although the
title of the talk is passwords
those boil down to the same thing
because usually a password is converted
into a key
using a hashing function or something
like that
there is ultimately a key that protects
access to your stuff and there can be
chains of them there can be a key that
encrypts another key that encrypts
another key and we can step in at some
point and say okay
this key we're going to make this key
recoverable
and the use cases for this it's not just
about forgetting things you know maybe
you lost something maybe you're using a
key card or a hardware token or
something and you've lost it
or it got broken
someone ran over it
or there's the use case where you're
dead
and you would like to have a way for
your family or your friends to gain
access to your digital
legacy really
so there are interesting use cases
important use cases
it needs to be secure enough i mean if
we're going to remove all of the
encryption
then why bother there it needs to be
something where people can tune it
for their needs and their threats
so that's one of the goals
has to be user friendly so people can
use it and not fail
and it has to be developer friendly
because i can invent this system
and be really proud of it but if nobody
builds it into their software then this
is all a wasted effort so
i want to reach out to any developers if
there are developers in the room come
talk to me
and finally because there is a server
component and i would like it to be not
just me running the server i would like
a community of servers i would like you
to be able to take fragments of your key
and put them here and there and there
and trust different people
we need a community of systems and so
the software needs to be accessible for
them and something that they're willing
to run and manage
so
those are the goals here's a really
dense one slide summary of how pascro
works
this is the this is the core of the
thing
so as i said earlier usually you have a
key that unlocks your information
what i want to do is i want to take that
key and i want to encrypt it with
another key so i generate a throwaway
key that is only used to encrypt this
really important secret
and that is then stored in the same
place as your encrypted data so those
things live together i don't take that
and put it anywhere else it's just
sitting there in the same place so
shared fate if that device functions
you've lost both things doesn't matter
they they're they
protect the same thing they're the same
thing
this recovery key which we use to
encrypt that little bit of information
we
split that using shamir so we split that
into these what i'm calling fragments
shamir calls them shares
we split into fragments and then we give
those fragments to the people running
the servers
but we do this carefully
the servers then make a promise so this
is a community and the server promises i
will not give you back this fragment
unless you prove who you are
using
an identity of your choice so you can
tell me i'm the server operator and you
say hey
only give me my fragment back if i can
verify that i have
the right telephone number or the right
email address
or a github account or something like
that
so what we have that's the core of the
idea i'm going to go back into it again
i'm going to give you a little demo show
you how the software behaves
today we have
most of the building blocks so basically
i have a first iteration of all of these
things
they're some documentation i've tried
really hard but
documentation is hard so if anyone wants
to read it and complain
that's very welcome
if it confuses you then i failed i need
to fix it
there's a client library for people that
are working in python
if this takes off there should be
libraries for other languages as well
but python is where i've started
there is a very simple server
implementation
doesn't perform very well it doesn't do
anything fancy but it doesn't work
and then there's a command line tool
because as i said
this isn't built into anyone's software
yet
so there is a command line tool so you
can experiment with it and play with it
you can set up manual recovery
yourself and imagine that we're in a
magical future where this is built into
our software
there's a website passport.org
it has a little intro
and has an overview of which servers are
live that will help with this recovery
process and at the moment there are two
both of which are run by me one of them
is for testing and the other one is for
more serious
or actual data if you trust it
that's
the url and the amazing logo that
crayon generated for me
so
if you were to go and install this i
decided to do a slideshow instead of
walking through on my laptop um
but
the first thing i'm doing there can
anyone can everyone see this
yeah
so
first thing is you can install it from
from pi pi so you just pip install
pascro
and then you run the first command would
you just be pascro init and what that
does it just sets up
a directory for storing information and
what i'm calling a default policy
and you can look at what's in that
default policy so that's that last line
there i'm opening it with vi because i'm
a hacker
you can see some interesting things here
like
i've edited the defaults
to add some bits
i'm specifying the ratio that's hard to
read it says three quarters three out of
four
so
if i give pastural four identities
it will require three of them for
recovery to succeed
by tuning the parameters to the shamir
algorithm as i mentioned earlier
and there are some timeouts i can say i
want this
data to expire in a year or in 10 years
or in five days or you know these are
things that can be tuned
and then there's a timeout
has anyone here not recovered a password
from something like gmail
everyone's done it so you're all
familiar with the fact that these little
codes that they send you are time
limited
that's that time out so we have the same
concept
i created a very valuable secret created
a file called secret.txt
and then i say passpro protect
secret.txt
and here i've given it my phone number
and my email address
and those are both correct so please
don't spam me
and
don't call me out of business hours
unless it's really exciting
we can ask the tool for a list and say
pascro list and then it will show you
which shares have been or which things
have been put in escrow
and
we're going to look inside one of these
files
it's just a json file
a bunch of parameters
there's a thing there line 4 is a secret
and that's a base64 encoded blob
and pasco doesn't care what's in there
but that is
that's the secret information that we
gave it to begin with
it says there that there's only
it has a
minimum of two shares because i only
gave it two identities
so it can't really do three out of four
so it approximates it does its best and
stores other things it needs to know to
recover things
this is what recovery looks like
passport recover and they tell
secrets.txt it remembers that's what it
was protecting before
it contacts the two servers and it asks
them to verify
and then it tells me i should expect to
receive an sms or a phone call and i
should expect to receive an email and it
gives hints about where those will be
sent to
and this is done server sides the server
side doesn't send the full identity back
wow i've talked way too slow
so
if someone else initiates recovery they
don't know exactly which accounts to
look at and again this is familiar from
recovery for other things
once i receive the codes i run passcode
recover again i give it the codes
and it
well it sent me an sms this works it
does goes through twilio an american
company i'm sure we all trust
um
sent me an email
that went there's mailpilot it totally
exists
i recover
and it's hard to see because there's a
bunch of other output but it shows the
input the contents of the file that i
gave it to begin with this is my secret
and then i can tell it to forget all
about it so then it goes and deletes the
local information and asks the servers
to delete the stuff they have on file as
well
so that's the tool this is all the tool
does you've seen the whole thing
and you can install it and play with it
so back to the design goals again secure
enough um
the way i'm doing that is obviously we
encrypt any communication that we do
when we talk to the server that's
encrypted
the password servers they don't have
your data
all they have is
an encrypted blob
which they cannot read to begin with and
inside that encrypted blob is your
identity and a fragment of the recovery
key not the whole thing
the reason these things are encrypted is
you know to protect your privacy so when
you initiate recovery when you say to
passpro i want to recover my stuff
password goes back to that recovery pack
which is stored locally
finds the key that was generated to
encrypt the thing the server has and
says here server now you're allowed to
decrypt your instructions
and so then it opens up the you know
recovery envelope thing
finds the identity
and sends you a code or asks you to
visit a website and log in through some
other things
and this
means in these little codes that we're
sending around
this means that these providers the
email providers twilio
they never see any key material at all
all they're seeing is this temporary
code that lasts 30 minutes or 20 minutes
or whatever the user decides
and
you know we're leaking very little
information
yeah as i said the user is in control of
those things
and
it's kind of important is that
because usually you would have three out
of four or something like that
servers can go offline pasco servers can
be dead and you can still probably
recover
and most of the time you're not
recovering so pascal servers don't have
to have very high uptime they can go
down for maintenance without the admins
being stressed out
and of course all of this is open source
hopefully peer review will contribute to
the security of things
user friendly
the main key that makes this
user-friendly is that this is a really
familiar pattern we already know how to
do this we don't have to teach users new
stuff
we just have to add these options to our
software
uh developer friendly you know docs
stuff i don't know if i'm succeeding at
this yet maybe you can tell me
and sis has been friendly i'm a little
more comfortable there i've been an
admin for a while
so i've made sure the admins themselves
don't feel at risk they don't have data
that has value
they don't know who their users are
their users are anonymous so
they're there's limited gain in hacking
a pascro server there's not much to find
there
um
so this relates to that i already
mentioned the uptime isn't a major thing
and uh you can do things like rate limit
because passcode isn't something which
you're using constantly
so you can have really strict rate
limits i can say you know
five requests per minute
and that will suffice to recover
but it will make it very hard for people
to put any load on the server
so that's most of the talk
thanks for listening
and i'm on time
i'm up here because this has reached the
point where i need help this
has
this whole effort has no meaning if
people don't use it
and
if it's only me then you know i'm just
another guy on stage saying hey trust me
instead of that other guy and that's not
how this stuff's supposed to work so
if you're interested in this please find
me after the talk or find me during camp
i'm here for all of camp
and i'm at the quarantine arms village
when i'm not wandering around looking
for fun
so that's my talk thank you for
listening and
[Music]
thank you can you hear me
yes okay thank you viana for great talk
um there is time for q a if you want to
ask a question please go to the mic i'm
already seeing somebody running
but mike is yours
oh
you hear me now
a little bit okay um i think you've hit
up an important problem it's good idea
to take power away from the cloud
services of course
um we're doing similar things with
authentication so we can speak up a tiny
bit um we're doing similar things with
authentication definitely want to talk
to you afterwards okay um but the big
question with these things is how
flexible is it as in if your sms number
new phone number changes or your email
address change can you without decoding
and re-encoding your uh documents which
may be many can you change over to to a
new retro system okay so the question
just repeating it for the stream
you're and i hope i get it right you're
asking whether people can easily change
which identities they're using um in the
middle of things so if they lose access
to an email address how easy it is it to
switch to another one
and
the thing is
yes and no like if you're working with
the information on a regular basis if
this is built into an app like an email
client that you're using that email
client can just do that automatically it
just re-registers you don't even have to
know it might do that automatically for
you
if you set up escrow for something like
an offline hard drive
you're going to have to know that you
need to go and do that again
and the way you do it is you just put
stuff in escrow again you throw away the
old keys
ask the servers to forget if you still
have access to the recovery pack and you
just set it up again and it's very cheap
these are tiny requests tiny amounts of
data so doing it again isn't a burden
okay
next question and please talk straight
into the microphone
one moment is the microphone
maybe now hi i was just wondering if you
could elaborate and maybe state more
explicitly your threat model in
particular around when servers are
compromised and if your three or four
verification thing is a little unclear
to me whether this was three or four
like emails and phone numbers or three
or four servers that are collaborating
and if you could just elaborate how that
is and intended to work
okay so to repeat back you'd like me to
elaborate a little bit on the threat
model of
how many servers are involved how many
identities are involved whether those
are linked
that kind of thing
and
i'm not actually prescribing anything
about that
the system is quite flexible and it ends
up being up to the application
so
the
developer of the application that ends
up using the passcode library
i assume that they know way better than
i do what kind of data they're
protecting and how valuable it is
and some of this is out of my control
because until we have more servers it's
all going through the same one
but if we had a hundred servers on
different continents and different legal
jurisdictions
a tool could make intelligent choices
and say okay i would like
i wouldn't i would like law enforcement
to not be able to subpoena all of the
pascro servers
easily so you could spread things around
the system is completely agnostic to
that
so it really depends on how much
momentum we get what kind of guarantees
we can give people how much security we
can provide
does that answer it
and you can always ask again after us
yes next question i have a
one remark and one question
let me start with the question
if i lose the recovery pack
i can't get my data back correct
yes that's correct if you lose the
recovery pack your data is gone all
right well you can't recover your data
hopefully you still have access to it to
other means yeah so but if i use this
for example to
do a backup of my hard drive encryption
secret and
the recovery pack is on my fully
encrypted hard drive but it's kind of
useless yeah of course you need the
recovery pack needs to be stored
clear text
and ideally on the same physical medium
as the encrypted data
so that they have shared fate so that
you know if if that male drive is
malfunctioned it doesn't matter whether
you can decrypt it or not
but if you put those things in two
different places if you put the recovery
pack over here and you put the data over
here
these things can start
behaving in ways that don't match and
and that's a lot harder to reason about
my remark was
you were using some your secret sharing
which for me almost never makes sense
the whole idea of shamir secret sharing
is to scale k out of n recovery to avoid
the k over n complexity
now how many authentication methods are
you going to have 100
do a 50 over 100
where do you get the scalability problem
that requires using of show me your
secret sharing you know if i have five
different authentication methods and i
say four out of five
you know i can
i don't need xiaomi a secret sharing to
do that and if you do show me your
secret sharing you limit me to k out of
n
and i can't use other kinds of
combinations
like saying you know two methods for him
and two methods for him or three methods
for this guy i think we're getting into
the weeds a tiny bit
the thing is it does what i need and
it's very likely the algorithm can do
other things as well
and when i started doing this i did not
use xiaomi secret sharing
i had my own little ad hoc thing where i
was doing xors of things against each
other and
it just became unwieldy
shamir does exactly what i want i can
say
i have four email addresses
any three of them suffice
and i can ask shamir to generate the
fragments that i need
and you know whether that is secure or
not that depends entirely on how many
identities the user is willing to go
through
and that becomes a usability issue and
it becomes a matter of threat modeling
for some users it doesn't make sense to
do this at all
okay
i see somebody else um i would say this
is the last one
so um
well two comments uh so one phillip
bragaway has a nice and some nice paper
phil brago is a very famous uh symmetric
cryptographer he's a very uh he has some
very nice papers uh are
and i can't remember the names of the
thing or anything at the moment maybe i
can help you find it later if you need
on
doing
he what he wanted is he wanted a
packet form
basically a format for
sharing data with journalists which was
also doing this kind of like
splitting the thing out and whatever
anyway um so it's using shamir secret
sharing and it's it it achieves he
basically sort of outlined about in a
very rigorous way a bunch of the goals
and non-goals and whatever so it
probably people working in this should
at least look at what he did and try and
understand it um
the but i haven't done that so i can't
give you uh uh concrete comments um
the other one is that there's a very
when you are using shamir there's a very
nice thing that you can do which is you
can construct new shares
um to give out to new service you know
services that are like holding the thing
the recovery services or whatever so you
can do that all asynchronous
thank you i'd be interested if you could
find me later and tell me all of that
again
so i'm sorry for that we have to cut it
short at some point i think this was a
great session so
can i have a warm applause for a speaker
[Music]
thank you
and he will be available for talking
afterwards so please
i just lost out please go and find him
and talk to him about any more topics
you want to discuss
thank you and see you in the next
session
you