Research challenges for the Tor anonymous communication system

The Tor anonymous communication system helps millions of users every day to use the Internet more safely, protecting their identity, blocking tracking, and in some cases circumventing censorship. Since its creation in 2005, the Tor Project has worked to enhance the usability and security of Tor, bringing it from a research prototype with a handful of users to an easy-to-use modern application today. In this talk, I’ll discuss the research challenges that had to be addressed during this journey and open research questions that remain, including on usability, traffic-analysis resistance, ethical considerations, and post-quantum cryptography.

FrodoPIR: Simple, Scalable, Single-Server Private Information Retrieval

In this talk, Sofía will present FrodoPIR, a highly configurable, stateful, singleserver Private Information Retrieval (PIR) scheme that involves an offline phase that is completely client-independent.

Privacy with Good Taste: A Case Study in Quantifying Privacy Risks in Genetic Scores

In this talk, Raul will present a novel methodology to quantify and prevent privacy risks by focusing on polygenic scores and phenotypic information.

Transport-Level Privacy for Instant Messaging

In this talk, I will present DenIM (Deniable Instant Messaging), a novel protocol built on the idea of hiding traffic to make it unobservable to an adversary by piggybacking it on observable traffic. We posit that resilience to traffic analysis must be directly supported by major IM services themselves, and must be done in a low-latency manner without breaking existing features. Hence, DenIM is designed both for compatibility and performance; DenIM is a variant of the Signal protocol—commonly used for strong encryption in instant messaging services, and, DenIM’s bandwidth overhead scales with the volume of regular traffic, as opposed to scaling with time or the number of users.

Victor Morel's introductory talk - Design and analysis of technical systems for humans

Victor will present in this introductory talk his past work on informed consent in the IoT, and his research perspectives for the CyberSecIT project. The first part of his presentation will summarize his PhD work, including a short video demonstration. The second part will introduce his interdisciplinary experience within the Sustainable Computing Lab in Vienna on the standardization of consent in the IoT. Finally, the third part will expose his research perspectives for the CyberSecIT project with the iSec group at Chalmers.

Practical problems in enforcing Data Protection by Design & by Default - the perspective of a Data Protection Authority

Marit will explain various difficulties of enforcing Art. 25 GDPR from the perspective of a supervisory authority. She will compare the deficiencies in this area with the situation of implementing "security-by-design" approaches. Also, current trends stemming from technology design and from recent court decisions will be discussed concerning their relevance for compliance with data protection requirements. To achieve built-in data protection, Marit will present her "wish list" that addresses stakeholders such as researchers, developers, academic teachers, data protection officers, lawyers and the data protection authorities themselves.

With a Little Help from My Friends: Transport Deniability for Instant Messaging

Traffic analysis for instant messaging (IM) applications continues to pose an important privacy challenge. In particular, transport-level data can leak unintentional information about IM – such as who communicates with whom. Existing tools for metadata privacy have adoption obstacles, including the risks of being scrutinized for having a particular app installed, and performance overheads incompatible with mobile devices.

Challenges of User-centric Privacy Enhancing Technologies

The GDPR promotes the principle of Privacy by Design and Default, acknowledging that the individual’s privacy is best protected if privacy law is complemented by privacy enhancing technologies (PETs). While technically advanced PETs have been researched and developed in the last four decades, challenges remain for making PETs and their configurations usable. In particular, PETs are often based on “crypto-magic” operations that are counterintuitive and for which no real-world analogies can be easily found.