It has been five years since the General Data Protection Regulation (GDPR) went into effect in the EU. Ever since, research has continued to show that the creators of online services find it difficult to implement the legal requirements of EU legislation into practice. They mainly resort to lengthy privacy policies and often deceptive cookie notices to ask users for their consent to data processing, rather than revise their own data processing practices and opt for approaches that collect less personal data. This comes to the detriment of service providers and users, who are both faced with decreased usability of websites, apps, and devices.
This talk investigates approaches to both understand the roadblocks that keep system creators and users from adopting a privacy-by-design mindset and to find ways to address them. This is ever more important in the light of new European platform regulations that intend to create boundaries for personalized advertising and introduce interoperability requirements, which in turn pose new opportunities to empower system creators and users alike to take control of users' privacy.
The Tor anonymous communication system helps millions of users every day to use the Internet more safely, protecting their identity, blocking tracking, and in some cases circumventing censorship. Since its creation in 2005, the Tor Project has worked to enhance the usability and security of Tor, bringing it from a research prototype with a handful of users to an easy-to-use modern application today. In this talk, I’ll discuss the research challenges that had to be addressed during this journey and open research questions that remain, including on usability, traffic-analysis resistance, ethical considerations, and post-quantum cryptography.
In this talk, Sofía will present FrodoPIR, a highly configurable, stateful, singleserver Private Information Retrieval (PIR) scheme that involves an offline phase that is completely client-independent.
In this talk, Raul will present a novel methodology to quantify and prevent privacy risks by focusing on polygenic scores and phenotypic information.
In this talk, I will present DenIM (Deniable Instant Messaging), a novel
protocol built on the idea of hiding traffic to make it unobservable to
an adversary by piggybacking it on observable traffic. We posit that
resilience to traffic analysis must be directly supported by major IM
services themselves, and must be done in a low-latency manner without
breaking existing features. Hence, DenIM is designed both for
compatibility and performance; DenIM is a variant of the Signal
protocol—commonly used for strong encryption in instant messaging
services, and, DenIM’s bandwidth overhead scales with the volume of
regular traffic, as opposed to scaling with time or the number of users.
Victor will present in this introductory talk his past work on informed consent in the
IoT, and his research perspectives for the CyberSecIT project.
The first part of his presentation will summarize his PhD work, including a short
video demonstration.
The second part will introduce his interdisciplinary experience within the Sustainable
Computing Lab in Vienna on the standardization of consent in the IoT.
Finally, the third part will expose his research perspectives for the CyberSecIT
project with the iSec group at Chalmers.
Marit will explain various difficulties of enforcing Art. 25 GDPR from the perspective of a supervisory authority. She
will compare the deficiencies in this area with the situation of implementing "security-by-design" approaches. Also,
current trends stemming from technology design and from recent court decisions will be discussed concerning their
relevance for compliance with data protection requirements. To achieve built-in data protection, Marit will present
her "wish list" that addresses stakeholders such as researchers, developers, academic teachers, data protection
officers, lawyers and the data protection authorities themselves.
Traffic analysis for instant messaging (IM) applications continues to pose an important privacy challenge. In particular, transport-level data can leak unintentional information about IM – such as who communicates with whom. Existing tools for metadata privacy have adoption obstacles, including the risks of being scrutinized for having a particular app installed, and performance overheads incompatible with mobile devices.
The GDPR promotes the principle of Privacy by Design and Default, acknowledging that the individual’s privacy is best protected if privacy law is complemented by privacy enhancing technologies (PETs). While technically advanced PETs have been researched and developed in the last four decades, challenges remain for making PETs and their configurations usable. In particular, PETs are often based on “crypto-magic” operations that are counterintuitive and for which no real-world analogies can be easily found.