WisTex Network - WisTex Network

Thu, 26 May 2022 05:05:29 -0400

RockyIII wrote the following post Thu, 26 May 2022 05:05:23 -0400

Can a hub admin ruin an identity ??

nomadic identity depend on hubs which are depending on admins.

< ( What's this? A user doing something I don't agree with? I think I shall ban them, and silence them forever! )
( Ha ha, that's what you think! I have sent my private key to four other servers, so I will not be silenced! ) >
< ( Also I'll reveal their private key so anyone can make them post loads of gore porn. )
( ....shit ) >

https://mstdn.io/@cy/108364336181616784

Can an admin ruin a channel identity by not just ban a channel from a hub but by also publishing the privat Key of an identity - which he finds easily in the DB with two clicks ?

show all 23 comments

Hans van Zijst

Thu, 26 May 2022 05:12:27 -0400

Interesting question :thinking:

RockyIII

Fri, 27 May 2022 04:31:03 -0400

@Scott M. Stolz @Hans van Zijst

and extremely adept at how Hubzilla and its security works...

Not 100% sure, but I´m afraid it is more easy than we all wish and hope...

If you export the identity of a channel as a json file you will see that besides the private key all (?) of the included essential infos are public anyway .

So if the privat Key of a channel got public also, every body could build such kind of json file for that channel Identity and install a new Clone for that channel on any hub. If you have excess to a clone you can ruin the identity of a channel by a lot of ways.

I am not sure how Hubzilla handles it now, but there is a way to "Drop" one of your clones in Settings > Manage Channel Locations.

Clones can be "Droped" but the public and private keys stay always the same - they ARE the identity - right?

Looking from that prospective the ZOT nomadic identity is not really something you want to use if and want to build on a stable identity and can´t trust the hub admins. It is still a great way to back up your channels but you better have control over the hubs you sync your channels to.

So after all: If you want a stable identity you have to be the admin of the hub where your channel is hosted - ZOT nomadic identity does not help here.

Please tell and explain me that I´m all wrong. THANKS

RockyIII

Fri, 27 May 2022 09:01:21 -0400

@Scott M. Stolz

Or do you permanently have a key forever?

Yes - I thinks so

Or, you could just reissue the keys, and the bad clone doesn't have a valid key anymore.

No I don´t thinks so - that is not the way it works

RockyIII

Fri, 27 May 2022 10:44:05 -0400

@Scott M. Stolz other can answer this better for sure,

Your ID can change but not your keys - this are your identifier in the network, and make sure that you will get found and identified by other channels - if your key changes your have a new identity

RockyIII

Fri, 27 May 2022 12:27:25 -0400 last edited: Fri, 27 May 2022 12:34:16 -0400

@Scott M. Stolz i think the subject here it is more about a principle understanding of how we can use ZOT nomadic identity safety.

Is it an identity which belongs to you my design , and are you the only person how can control it?
My Keys for Email encryption are mine but the Keys of a ZOT account are always stored on someone else's Computer (if i´m not the hub admin) - and every time i clone my channel some other admin will have to be trusted.

I thought always with ZOT nomadic identity it is not possible to ban a channel form the Network for good but it seams now it is possible to ruin a channel for good.
It is like this: You can´t destroy a house of a person but you have the keys to the front door - and so you have the ability to go into the house every time you like and do messy things. - Is this a criminal act ? - maybe - or even for sure - but things should be set up better by design - or at least we should know how do deal and handle with ZOT nomadic identity - so we can minimize the risks.

You know i love all the ZOT Apps - `I have spend a lot of time the last years here and working with them - so i want to know what i have actually in my hands.

But i will stop now writing about all this before I did not tested thinks a bit better.
Scott I will pm you - and ask you to help me by this test.

Nolan

Fri, 27 May 2022 12:33:27 -0400

But what if the hub got cracked, and someone got admin acces? A secure protocole should resist to the compromise of one node.

emaxmax

Sat, 28 May 2022 09:05:03 -0400

@mike

Any server. Any product. Any operating system. Any protocol.

Wrong. See revocation or blockchain fork for instance.

Marshall Sutherland

Sat, 28 May 2022 11:47:36 -0400

And people think I am nutty for still running my own servers out of my house...

Hans

Sat, 28 May 2022 17:56:23 -0400

Well, if I would run a business I would never run it on home servers to be honest. I was part of our hosting team for a long time and I do see the benefits of using a remote hosting party. People tend to simply not look at customer data by default since it can kill your job. If there is a request (yes, even from law enforcement) then I would simply ask those in higher ranks to give me a written permission for releasing it or even looking at it. It is the customer data, not the hosting companies data.

To be honest I would be more afraid of having a web-server access data where user nobody is able to run the same queries as the user admin since there is are no data privacy rules that will prevent a visitor to get the same data as the admin besides some code. And yes, that is true for Hubzilla too. There is one database user.

Marshall Sutherland

Sat, 28 May 2022 19:06:27 -0400

Everything I run at home is personal. I don't have the sort of redundancy needed for business-critical infrastructure. I've got the UPS capacity to keep my network and server up for 4+ hours in case of power outage, but I've got no Internet redundancy.

RockyIII

Sun, 29 May 2022 03:37:32 -0400 last edited: Sun, 29 May 2022 08:03:49 -0400

@Scott M. Stolz

Unless you are breaking the law or violating the terms of service, you have little to fear from a reputable web hosting company.

The reality in the fediverse has a different nature. There are not many hosting companys but a lot of privat people which run a Server and offer services and most offten there is no contract and no terms of services.

RockyIII

Sun, 29 May 2022 12:37:12 -0400

@Scott M. Stolz
yaa ..most hubs run on shared host or a VPSs

"The hub itself might not have a terms of service, but their web host does, in that case."

hmm.. so you mean if i leak a privat key as an Admin of a hub i run on a shared host - the terms of service of the web host come into play ?

RockyIII

Sun, 29 May 2022 14:29:19 -0400

@Scott M. Stolz can you show me that parts of the "terms of service" which could settle this ?

RockyIII

Mon, 30 May 2022 12:18:10 -0400

@Scott M. Stolz

A violation of any of these will get your account terminated.

Ok - first your identity gets ruined - than you have to prove to the webhoster that the admin of a web space did seriously harm to you - if you are successful with your claim the admin has to move the stuff to an other webhoster but your identity is still ruined

BUT a frog is possible

Scott and I just did a little test - we would like to try to fork a ruined identity now

How do i do this @mike ? THANKS for Help.

RockyIII

Tue, 31 May 2022 03:44:36 -0400

to let every buddy know what we are testing: Scott set up a couple of channels on my hub and i was easily able to create clones of this channels on an other hub and post into the timeline of scotts channels with scotts channel identitys.

It appears dropping a clone doesn't work if the clone is still live.

Hmm... right the clones still exist... maybe it takes some time till dropping takes place

How to fork an identity? Do i have to exchange the privat and public keys it the exported json file and that´s it?

RockyIII

Tue, 31 May 2022 04:33:40 -0400

@Scott M. Stolz remember now that it was always advised to first delete a clone on the hub where the clone exists by a login to that account and after that delete the clone entry from the primacy hub account ...

So it seams you can´t delete a clone if you don´t have the pw to the account which created it.

RockyIII

Tue, 31 May 2022 04:50:26 -0400

@Scott M. Stolz

A violation of any of these will get your account terminated.

than you have to prove to the webhoster that the admin of a web space did seriously harm to you

this prove will not be that easy if you have cloned your channel to more than just one hub.

hEARt PhoniX

Tue, 31 May 2022 05:49:41 -0400

You can still download your channel data, remove everything online and restart later.

Malendur

Wed, 01 Jun 2022 06:42:01 -0400

This comparison is useless: those are centralised systems...
You should compare for example with elasticsearch cluster (does a corrupted slave could affect master? No), and other decentralised systems.

RockyIII

Wed, 01 Jun 2022 08:06:16 -0400

To create an identity there should be also an extra privat key needed which is just stored locally on your PC. Every time you want to create a new clone this key would be needed as well. This would insure that nobody but just your can create and clone your identity

Malendur

Thu, 02 Jun 2022 03:41:30 -0400

@Scott M. Stolz

The administrator of a system, by their very nature, has access to the system... including the data you put on that system about your identity.

You are quite confused....
The admin of a slave server has only access to the slave data. If he is not admin to master server, he can't corrupt the data on the master server. Stop reducing the problem to only testcase you understand, and accept that more advanced solutions exists...

Tejan Ausland

Tue, 07 Jun 2022 23:00:12 -0400

@Scott M. Stolz

Just because I said a rogue admin can corrupt data does not mean I think nothing can be done about it. There are techniques that you can use to reverse the damage and save the identity. But during the attack itself, because all copies of a channel are instantly mirrored, the bad data will propagate.

So, what can be done about it?

neue medienordnung plus

Sun, 12 Jun 2022 06:51:49 -0400

Maybe this should have been explained somewhere... that you should only clone your identity on hubs you trust. Because by cloning your identity, you are basically adding another administrator that has access to your identity.

#^https://wistex.biz/item/2cb950e8-4b9f-442d-82e2-6be82379a1cc

On the one hand, on the trivial level for a little savvy and thinking user, the statement

you should only clone your identity on hubs you trust

is self-explanatory. But if you take into account that you can NOT rely on the fact that for many, maybe for the majority of users the statement above is not self-explanatory, then I assume that the above-mentioned explanation can only understand the users when these users understand the unique selling propositions of Hubzilla or of #Fediverse solutions. And to explain these qualitatively new compared to conventional solutions unique selling propositions is a serious challenge.

Another interesting solution is adding a Web Authentication API ( #^https://webauthn.guide/ ) to Hubzilla, and requiring device authentication before allowing a clone (if enabled by the user).

Maybe I'm wrong, but I remember that @mike point of view is that no binding to hardware should be built into the Hubzilla framework.

#challengeFediverse #USP #UniqueSellingPropositions #cloneIdentity