Secure Syndication

Joe Gregorio

bitworking.org

Goals

• Syndicate sensitive information for a select audience.
• Build reports
• Family info

Bonus Goals

• We will give ourselves bonus points for
• Ability to selectively protect just some information.
• Share as little information with intermediaries as possible.
• Require as little 'ocean boiling' as possible.

Environment

Environment

Just

• is a dangerous word.

'Just' use HTTP Authentication

• I have to give my password to the intermediary.
• Doesn't let me choose which entries get protected.

'Just' use Atom

• Maybe Atom will save?
• No.
• RFC 4287 Section 5.2: ""The root of an Atom Document (i.e., atom:feed in an Atom Feed Document, atom:entry in an Atom Entry Document) MAY be encrypted, using the mechanisms described by XML Encryption Syntax and Processing [W3C.REC-xmlenc-core-20021210].""
• This means I must give my key to my web based aggregator.
• Even if it would work, I would still have to convince bloglines, et al to support it.

Example Atom Feed

   <?xml version="1.0" encoding="utf-8"?>
   <feed xmlns="http://www.w3.org/2005/Atom">
     <title type="text">dive into mark</title>
     <updated>2005-07-31T12:29:29Z</updated>
     <id>tag:example.org,2003:3</id>
     <link rel="alternate" type="text/html" hreflang="en" href="http://example.org/"/>
     <entry>
       <title>Atom draft-07 snapshot</title>
       <link rel="alternate" type="text/html" href="http://example.org/2005/04/02/atom"/>
       <id>tag:example.org,2003:3.2397</id>
       <updated>2005-07-31T12:29:29Z</updated>
       <content type="xhtml">
         <div xmlns="http://www.w3.org/1999/xhtml">
           <p><i>This is content. </i></p>
         </div>
       </content>
       ...

Encrypting portions of a feed

• What if I encrypt just the title and content?
• Is the feed still usable by an intermediary?
• What if I encrypt the whole feed?

What have we learned so far?

• Everything we should have 'just' used requires passwords or keys to be given to an intermediary.
• The unprotected content is served up to my browser.
• Passwords and keys don't cut it, but encryption might if we keep it to the element level.
• Sure, we can encrypt our data and stuff it into a <div>, and it will survive all the way to the browser, but how to we decrypt it once it's there?

Enter the greasemonkey

Greasemonkey

A Firefox extension which lets you to add bits of JavaScript to any web page to change its behavior.

JavaScript and Math

• Let's not go there.

Blowfish - a low friction choice

• Free
• Fast
• Unpatented

Almost all the pieces

• Presume I can write my decrypter in JavaScript. How do I know what to decrypt?

Microformats

• Designed for humans first and machines second, microformats are a set of simple, open data formats built upon existing and widely adopted standards.
• Human readable today, machine readable tomorrow.

• <a href="http://technorati.com/tag/tech" rel="tag">tech</a>

• <div class="vcard">
    <a class="url fn" href="http://tantek.com/">Tantek Çelik</a>
    <div class="org">Technorati</div>
  </div>

Putting it all together

<div class="encrypted blowfish" 
 <p>The following data is encrypted. Please install
    the SecureSyndication Greasemonkey script to 
    view the encrypted content.
 </p>
 <div class="encdata">
    WORK:C7FDDC3...B86
 </div>
</div>
    

• We want all our info to pass through to the browser.
• Only div, p elements and class attributes.

Putting it all together - The Atom Feed

<?xml version="1.0" encoding="us-ascii"?>
<feed xmlns="http://www.w3.org/2005/Atom">

  <title>Secure Syndication Test Feed</title>
  <link rel="self" href="http://bitworking.org/projects/securesyndication/index.atom"/>
  <updated>2006-02-28T18:30:02Z</updated>
  <author>
      <name>Joe Gregorio</name>
  </author>
  <id>urn:uuid:602321c80-d399-11d9-b93C-0003939e0af6</id>

  <entry>
    <title>An entry with encrypted content.</title>
    <link href="http://bitworking.org/projects/securesyndication/"/>
    <id>urn:uuid:1225c695-1123-4ebb-aaaa-80da344efa6a</id>
    <updated>2006-02-28T18:30:02Z</updated>
    <content type="xhtml">
      <div xmlns="http://www.w3.org/1999/xhtml">
        <div class="encrypted blowfish">
          <p>The following data is encrypted. Please install
            the <a href="http://bitworking.org/projects/securesyndication/">SecureSyndication</a> Greasemonkey script to
            view the encrypted content.</p>
          <div class="encdata">WORK:C7FDDC3B50FF0BE0E6F47CBD54AC149FA6E42F1DD9C8AEA48F4D400B6970C14082858FF94901795DBE1C7D380ED6                </div>
        <div>The unencrypted content in this div should remain unchanged.</div>
      </div>
    </content>
  </entry>
</feed>
        

• We want all our info to pass through to the browser.
• Only div, p elements and class attributes.

Encrypted

Decrypted

What did we just accomplish?

• We hit our goals.
• We gave bloglines an upgrade in the process.
• This works for any old web page.

Where does this work today?

Request to aggregator builders

• Pass full content
• Be kind to 'safe' markup

(Not) The End

• Dangers
• Malicious Content
• The visibility of decrypted content
• Greasemonkey vs XPI
• I'm not a cryptographer.
• Opportunities
• This is plumbling
• hCard, hCalendar, etc.
• APP