apppets/privacyservice

Implementation of privacy-friendly services

privacyservice's Issues

Configure comparison key for visualization in URL

Once the visualization is reloaded the previously selected key is reset. This does not help to use compare the previous view with the one expected after the reload. The selected key should be part of the URL.

Add introspection API

In order to visualize/demonstrate the knowledge of the P-Service operator an introspection API is required, where the whole database can be retrieved.

This issue was migrated from https://gitlab.prae.me/apppets/PrivacyService/issues/2.

Track everything

Our attacker model states that the P-Service operator should not learn more from the data sent by the client. Therefore we should implement a "bad" operator and keep track of everything the client sends.

This includes, for each request (creation/modification/access):

• Date and time
• IP-Adress
• HTTP-Headers
• Keys and values

The basic assumption is that there are many clients accessing the service simultaneously to avoid timing side-channels.

This issue was migrated from https://gitlab.prae.me/apppets/PrivacyService/issues/1.

Use FoundationDB as backend

Apple released FoundationDB a distributed key-value store supporting ACID transactions.

This issue was migrated from https://gitlab.prae.me/apppets/PrivacyService/issues/3.

Enable adversarial behavior only if a specific header is set

In order to avoid tracking every request, the service should only track requests, where a specific header, e.g., X-AppPETs-BadProvider: 1 is set. This header then acts as a tracking consent. This feature is used for demonstration purposes only.

Check if keys are case insensitive

The keys are hex encoded Blake 2b digests. Hex encoding means, that the keys should be case insensitive, which is not the case in the database.

The issue exists on the master branch as well. It does not need to be fixed there. I'm fine with merging wsgi into master.

This issue was migrated from https://gitlab.prae.me/apppets/PrivacyService/issues/4.

Highlight last changed element

When demonstrating adding elements when there are already elements stored, it's not so easy to see which or if an element got added. It might help if the last added or updated element is highlighted (bold text).

Since elements can be deleted, this might be a bit difficult. If the latest action was to remove an element, no element should be highlighted.

This might not work well, if multiple users are using the P-Service simultaneously but should suffice for demonstration purposes.