Osiris (Serverless Portal System)

[Dr.Flay]

I think I may have stumbled onto the very thing I've been looking for
http://wikipedia.org/wiki/Osiris_(Serve ... al_System)

You run your server setup configured for your needs, but it is hosted by the p2p network, and presented as a normal web page.
DDoSing is dealt with because it would be like pushing a bubble around under wall-paper.
Your site is just served from somewhere else, or even multiple somewhere elses.

I haven't had a chance to play with this, but I thought I should bring it to your attention.
Potentially we can end bandwidth, storage, and geographic limitations.

I knew this was technically possible, but now I can stop trying to convince you lot, and just show a working site.
The home page hosts several forums using it, and is itself running on the backbone of p2p.

[Feralidragon]

It's a highly insecure system.
There's a reason why sites aren't hosted in P2P, and that's the extremely high insecurity of whole concept behind it.
To put things in perspective: hosting a site in P2P is actually more insecure than having a regular centralized site open to SQL injection, XSS and all sorts of attack vectors. The only thing P2P is better at is that is impossible to do a DDoS to the service, other than that is a failed concept when it comes to a website.

[Dr.Flay]

It is currently being discussed by the bods in the GRC security newsgroup I use, so we''ll see how big a hole they can tear in it.

Do you have experience with Osiris ?
I was under the impression that using eD2k error-checked hashed files, was more secure than just fetching file-names with no form of checking ?
If the system was built around torrent, I would not consider it anyway, as torrent can be poisoned and interfered with or just replaced.

Security is always an issue with any system, but these things get dealt with (hopefully)
Just looking at their security section now.

Basic concepts
Osiris differs from classic P2P programs in that it is focused on security and distributed data management.
Security
The system is anonymous. It's not possible to make an association between a user and their IP address, hence one cannot trace the person who created a content.

Even with physical access to an Osiris installation it is impossible to trace the actual user without knowing his password.

2048-bit digital keys guarantee the authenticity of content (digitally signed in order to prevent counterfeiting) and the confidentiality of private messages (encrypted between the sender and recipient).

To prevent the ISP from intercepting traffic, connections and data transfer to a portal (called alignment), Osiris uses random ports which are cloaked during handshake and encrypted point-to-point via 256-bit AES.

The P2P distribution allows content to be present in multiple copies as a guarantee of survival in case of hardware failure or nodes off-line.

As the portals are saved locally, one can read the contents even if one works off-line.

It seems to me, that the biggest threat is sloppy site creation (or being too over ambitious), just the same as any normal site.
I am fairly sure Anonymous don't want the NSA injecting or intercepting stuff into their system, so as issues arise would deal with it, or abandon it.

Just the same as using TOR, if you avoid certain security holes, like exposing info via flash or java, not using any plugins, and just sticking with simple requirements, cuts away more risks.
e.g. I suppose you could simply make a file-host for only the downloads, and have all your site front-end on a traditional server. In practice this would behave just like Mapraider.

I will take your security concerns back to GRC and maybe a bit of extra testing will be done.

[Feralidragon]

Let me put it simply: the website's sensitive data would be in several *client* machines. No matter what kind of encryption, it doesn't matter how complex that encryption is, the fact is that your data is spread and not within full control.

Example: for a website you generally need a database to store users and stuff like that, therefore think about it, would you trust your database connection or database as a whole to be spread by client machines?
Whereas when you have all this stuff in a single or multiple machines of which you are the owner of and are the only one with access, you are in full control of it and no client will ever get their hands on that data (provided that you properly secure it from remote access of any shape or form).

It's the difference of having to breach a server remotely to get data or having already the data sitting in your system.
Sure, AES is very secure as well as package signatures, both of them already have identified flaws that made both of them slightly weaker.
Therefore, if in the upcoming years more flaws are found or if new computational leaps are made to make a brute-force possible, then you're screwed if your data is spread by client machines already, whereas in a network of your own you can simply update the security of your servers.

Maybe now you can still host a site with some trust given the encryption and all, but what about the future?

I give you my best example how things can be turned over very quickly: my everyday job shows this sort of stuff to me every single day, and not wanting to enter in details publicly, not long ago a very serious exploit was found that made possible for a certain kind of packages used worldwide (a kind that everyone uses nowadays) to be modified without modifying their certification (package signature signed with the original developer's key, which is supposed to be the one thing that assures the package is genuine and thus secure, sounds familiar?), and I have to say that once found we had to fix it and avoid it in our system.
The exploit itself is fairly simple and is a problem with the format of the packages and how they are read. PM me if you want to know what exactly I am talking about (perhaps you're also aware of this flaw, or maybe not).

Google was the one that created this kind of packages and all the rules about certification on them (with signatures and everything, all the same), and therefore the flaw is theirs, yet we fixed it in our system before they did in theirs, that's how fast things on security can be flipped over and need be looked into, and this distributed site concept, it's flawed by design because you simply cannot fix it in time in case a flaw is found either in the certification or their own structure (because you may not even need to go that far as I have shown in this example), and the data is effectively distributed which is always a bad thing.

Thus if a system is conceptually insecure from the start, it's useless if you do want as much security as you possibly can. It's DDoS vs all sorts of attack vectors and data mining. As for me, I prefer to deal with DDoS which you can always develop mechanisms to resist to anyway.

Furthermore:

Security
...
As the portals are saved locally, one can read the contents even if one works off-line.

.

[Wormbo]

I'd say security in terms of keeping data private isn't quite the goal of any P2P system. You can stay anonymous by keeping the origin of things a secret, you can sign things to ensure authenticity and integrity, but in any case, the data itself is necessarily public in a P2P system.

Ideas like Namecoin (based on Bitcoin techniques) have been proposed as a fully P2P DNS replacement. A similar approach could be used to replace a game's master server, but it can't replace individual game server or web servers.

[Dr.Flay]

Well yes I understand it would be a severe flaw to have any sensitive data stored on someone elses PC in any use usable or accessible form.
I believe the idea is the back-ground data is incomprehensible and unconnected to any source.
Yes every day breaking encryption becomes easier, but you would have to crack every file in your cache, before you could start guessing what files belong to what site.

Then again the assumption here is that everything is being replicated, which is not necessarily so.
Your server can communicate directly with the person logging in, so certification is 1-to-1.
There should be no reason to ever send sensitive data through the p2p pool.

And then again you don't have to make a site that anyone needs to log into
You don't log into it remotely either, it is dealt with locally on your PC.
BTW. this is their meaning of "local". On your PC and not other peoples PC.

I've joined the forum and will see what they have to say about the security of the frame-work, as the "data" security is well described.

I'm only looking for simple needs anyway, so no form of logging-in is necessary. just a file-store as basic as FTP.
So in theory the only files being pooled would be site media and downloads.
How many of you logged into UT-Files to download stuff ? Nobody, and if it is just a site you cannot join anyway, the only one who ever needs to log in is you, on your local machine.

If someone wants to hack a JPG or ZIP, so be-it. The system should reject it as it would fail the hash check even if the authentication was valid, and there will be no sensitive data available in them anyway.

The certificate exploit of which you speak was indeed a topic of discussion in the newsgroups, though I am not sure the same thing can be done with this system, unless you are still using the same validation system on top.
Superbly valid point to raise, something else to look into
(I think we are thinking of the same issue)

I have potentially spotted another security issue, as they use the RSA encryption. If they were lazy and left it on defaults then potentially all current encrypted files can be more easily opened.
Then again like I say, if no sensitive or user-related data is distributed, nothing of any use can be accessed.

Thanks ever so much for ripping into this, as it is exactly the feedback I need. No-holds barred when it comes to security.
Because when it comes to security I am aware there is no such thing as perfect, as all it takes is a creative mind to bypass the uncrackable.
Apples new improved iPhone security lasted only 2 days before being bypassed

As it happens a brand new form of authentication (SQRL) is being discussed and tested for flaws and feasibility by a bunch of security nerds at GRC.
Depending on the results of this, issues of authentication being captured, spoofed or in anyway tampered with, may have just flown over the horizon as we wave goodbye.
https://www.grc.com/sqrl/sqrl.htm
https://www.grc.com/groups/sqrl (web view of the news-group)
http://twit.tv/show/security-now/424 (explanation by the inventor Steve Gibson. Video or audio)

However, I firmly believe "If man can make it, man can break it", so nobody hold your breath.

[Wormbo]

BTW: Osiris in its current form is closed-source software. With all the recent stuff going on, that is a strong point against any kind of security-related software package IMHO. According to the website, v1.x will be open source, but is still a bit away. The v0.x seem to have have serious spamming/flooding issues according to the same page.