January 14 Computational Differential Privacy
Speaker: Ilya Sherman
Abstract:The definition of differential privacy has recently emerged as a gold standard of privacy guarantees for algorithms on statistical databases. We offer several relaxations of the definition which require privacy guarantees to hold only against efficient — i.e., computationally-bounded — adversaries. We establish various relationships among these notions, and in doing so, we observe their close connection with the theory of dense subsets of pseudorandom sets from FOCS'08 paper by Reingold et al.
We extend the dense model theorem to demonstrate equivalence between two definitions (indistinguishability- and simulatability-based) of computational differential privacy. An immediate consequence of our definitions is that they allow more accurate constructions.
Joint work with: Omkant Pandey (UCLA), Omer Reingold (Weizmann) and Salil Vadhan (Harvard)
January 21 Anti-virus in the cloud
Speaker: Wei Yan (Trend Micro)
Abstract: To effectively handle the scale and magnitude of new malware variants, Anti-Virus (AV) functionality is being moved from the user desktop into the cloud. AV In-the-Cloud service is becoming the next-generation security infrastructure designed to defend against virus threats. It provides reliable protection service delivered through data centers worldwide which are built on virtualization technologies. Nowadays, cloud-based security services are gaining bullish projections in both consumer and enterprise markets. However, security vendors are facing various challenges regarding how to secure cloud service. In this talk, the architecture of AV cloud service is described. The challenges and solutions are discussed and illustrated from practical applications.
January 28 Organizational meeting
Organizational meeting: Sign up to give a talk!
February 4 No talk
February 11 Leveraging legacy code to deploy desktop apps on the web
Speaker: John Howell
Abstract: Xax is a browser plugin model that enables developers to leverage existing tools, libraries, and entire programs to deliver feature-rich applications on the web. Xax employs a novel combination of mechanisms that collectively provide security, OS-independence, performance, and support for legacy code. These mechanisms include memory-isolated native code execution behind a narrow syscall interface, an abstraction layer that provides a consistent binary interface across operating systems, system services via hooks to existing browser mechanisms, and lightweight modifications to existing tool chains and code bases. We demonstrate a variety of applications and libraries from existing code bases, in several languages, produced with various tool chains, running in multiple browsers on multiple operating systems. With roughly two person-weeks of effort, we ported 3.3 million lines of code to Xax, including a PDF viewer, a Python interpreter, a speech synthesizer, and an OpenGL pipeline.
February 18 No talk
February 25 Embracing weak passwords
Speaker: Hristo Bojinov
Abstract: Today, passwords are stored and managed by a variety of client "agents": browsers and smart phones being two good examples. Meanwhile, users have continued to use relatively poor "password hygiene": selecting weak passwords, reusing passwords across web sites, and predictably adapting passwords to web site strength requirements. In addition, often password management software encourages the selection of a weak master password (e.g. 4-digit PIN on iPhone), which makes it easy for an attacker to both explore the space of master passwords, and verify each guess off-line, by looking at the format of the decrypted data.
In this work we seek to extend our knowledge of user password-selection behaviors, and apply that knowledge in order to provide better end-to-end protection of cached user passwords. We develop techniques for forcing attackers on-line, which gives web services the opportunity to react to the threat.
Joint work with: Dan Boneh, Elie Bursztein and Xavier Boyen
March 4 Global authority in a portable password
Speaker: Xavier Boyen
Abstract: Is it safe to login to multiple sites with a single password and no help or token of any kind? Certainly not on today's internet; and even the best asymmetric protocols cannot prevent insider "cross-site" offline dictionary attacks unless the password is inherently strong.
In this talk, I will take a fresh look at remote authentication using weak and reusable passwords, review security and usability from a user-centric perspective, and propose a modular approach based on "halting functions" that addresses all relevant threats: from network interlopers to malicious sites. The protocol is very practical, decentralized, untethered, certificate-free, user-controled, server-scalable, can be deployed incrementally, and avoids several difficulties that befell earlier generations of password authentication.