CipherCloud DMCA notice to remove discussion of homomorphic encryption | Hacker News Reader

CipherCloud DMCA notice to remove discussion of homomorphic encryption

meta.crypto.stackexchange.com

40 pointsdfc14 comments

It was originally posted six months ago. So if you wanted to see what the Streisand is all about, Google cache to the rescue:

http://webcache.googleusercontent.com/search?q=cache:FYBbAFU...

I don't have enough points to post an answer there, so I'll do it here:

Anyone who posted in the original thread can file a DCMA counter-notification. There is a form to generate one at chillingeffects.org: http://www.chillingeffects.org/dmca/counter512.pdf

After a counter-notification is filed the entity that filed the original notice has 14 days to file suit, after which the notice is no longer effective.

The content is still gone for 14 days though.

One of my friends had his server taken down by his hosting company due to a DMCA. By the time he had filed a counter-claim a few hours later, they'd already binned his server, binned the backups, and filled the slot with a new customer. The kicker was that it was completely false; an infringement notice based on him having a text file containing the names of TV series he had watched over the year.

Just because you can file a counter notice doesn't mean that the DMCA isn't devastatingly to the owner of the website.

Which hosting company?

Wow, that sounds pretty terrible. Hopefully stackoverflow isn't hit that hard with a takedown like this. Did your friend blog/write about it at all at the time?

Since I am not going to log into their blog thingy to answer their question as to why it was taken down I'll just answer 'Why the DMCA request?'

It's illegal in the United States to have the capability or share information on how defeat crypto that is used for the purposes of enforcing copyright restrictions.

Since DRM-style cryptography is fundamentally flawed technology (ie: you have to give the crypto keys, the software,and the hardware capable of decrypting the media to the people you want to protect the media from) in depends on government enforcement (ie: threats of violence) to stop people from making products that make it easy to break DRM.

We can thank Bill Clinton and friends for this lovely bit of legislation.

DMCA notices can only be used to allege copyright infringement, not violation of the anticircumvention rules. If SE was delivered a DMCA notice, it was over the images or text in the post infringing some copyright, not the nature of their content.

While they're technically both part of the same bill, the safe harbor system (Title II, the Online Copyright Infringement Liability Limitation Act) is totally separate from the anticircumvention stuff (Title I, WIPO Copyright and Performances and Phonograms Treaties Implementation Act).

Oh, and given that 'CipherCloud' seems intent on suppressing information about their cryptography it's probably a very safe bet that it's utter shit.

It's certain that it's shit. They pull words out of strings and AES encrypt each one with the provided key (deterministically, either no IV, or a constant one). "Hi, Alice" -> <AES "Hi"> + ", " + <AES "Alice"> + ".".

That way a query for strings containing "Alice" (through virtue of symmetry and determinism) can have the expected results, as well as allowing them virtually any storage back end.

This makes them vulnerable to frequency analysis and known-plaintext attacks, as well as probably not working at all for CJK languages or any other type of value which isn't trivial to split into useful tokens.

Thanks for the explaination. Even if this is a protected and valid use of DMCA, it doesn't strike me as a strong move for a company confident in its product.

This isn't what I would consider "technologically sophisticated cryptattack", but instead just looking at some screenshots or slides and doing a quick observational analysis on them.

If the analysis were wrong, it might just come down to "well that's how our designers ended up making the slides/video" (replacing each word with a hash of itself), then I think it might make more sense to issue a statement that the advertising materials weren't exactly matching how the encryption works. Not sure if that would open them up to libel though.

Did you just refer to stackexchange as a "blog thingy"?

Worth reading:

title: Consequences of Filing a False DMCA Takedown Request

http://www.aaronkellylaw.com/internet-law/consequences-of-fi...

I hope they file a counter claim. Though this DMCA takedown is unrelated to software patents, could it possibly help establish how obvious some software "inventions" really are?

If I were CipherCloud, I'd file a DMCA to attempt to cover up how bad my "homomorphic encryption" works.

Reply on news.ycombinator.com