Make Your Messages Timeout: Review of Vanish Prototype

Review of Vanish
by Tom Olzak, CISSP (6,821 pts ) , published Aug 9, 2009
4

Vanish is a prototype of a new approach to meeting the privacy challenges of sending messages or other information into Web space; you can't delete all copies which immediately begin circulating. Open-source Vanish makes this possible. It also enables expiration of local documents.

The Concept

A team, consisting of University of Washington students and faculty, have created a solution for those of us who don't want our messages, documents, or Web posts potentially lingering forever. The solution, Vanish, encrypts content with a key that disappears after a set period. After the timeout, the encrypted information cannot be accessed by anyone, including the owner.

How it Works

Vanish encrypts text and distributes pieces of the key across multiple P2P sites, as shown in Figure 1. (All graphics in this article are from the white paper, Vanish: Increasing Data Privacy with Self-Destructing Data.)The team used the Vuze Bittorrent client as a distribution engine.

Figure 1: Vanish Architecture

There are two methods for encryption. The first is using the download package available here. Downloads are available for all current versions of Windows and the Mac as well as tested versions of Linux. Once the download package is installed, the only supported application is Gmail. (As I explain later, this didn't work as expected.) Future support is planned for documents, trash folders, Facebook, and other Web posting sites.

The second method, if you choose not to download and install the prototype package (or you can't get to work), is use of the online service. Simply type your text in the provided box, accept the user agreement, and click the Create... button.

Now let's see how this works in practice.

Installing the Download PackageRating Excellent

Downloading and installing the client application on my Windows 7 desktop was easy. The download screen, shown below, asked only for my email address--and I didn't have to provide that. I was provided with an easy to read set of instructions stepping me through the process, as shown in Figure 2.

There are two system requirements listed. First, you much be using Firefox to use the Gmail plugin. Second, the computer must be running Java 5 or later.

Installation was painless and quick. I waited the requisite 10 minutes and jumped right in.

Figure 2: Install Steps

Subscribe to Computer Security
RSS
Get free weekly updates, directly to your inbox.
Browse Computer Security