Peter Ney

Postdoc. Security and Privacy Researcher. Studies IMSI-catchers and bio-cyber security.

[Peter Ney @_peterney]

@secparam @yoshi_kohno @matthew_d_green Recruiting drivers was surprising easy. Much harder was managing a remote deployment of sensors that needed constant power for months. With more engineering it could be much easier. Getting good 4G/5G sensors is also hard. Been some work on the sensor front from the EFF @cooperq

[Peter Ney @_peterney]

@DocEdge85 @ShaiCarmi @Graham_Coop I'm pretty skeptical that any SNP-level visualizations are secure against these types of information leakage attacks. They just reveal too much information about the target kit. You may not even have to use artificial kits, although that would make things more complicated.

[Peter Ney @_peterney]

@DocEdge85 @ShaiCarmi @Graham_Coop However, I view jittering as more of a stop-gap solution rather than a long term fix. As @DocEdge85 & @Graham_Coop allude, it may possible to "re-synchronize" the visualizations to undo the jittering. This is similar to autocorrelating that is done in signal processing.

[Peter Ney @_peterney]

Between the security issues and warrants, I think Curtis had enough. What a strange few years for GEDmatch where it transformed from an obscure genetic genealogy site to forensic database. I wonder if Verogen will give other player like Parabon access for IGG purposes.

[Peter Ney @_peterney]

@erlichya @DocEdge85 @Graham_Coop @sarahzhang @23andMe @Ancestry @FTDNANews @MyHeritage I have heard examples of people that had good reason to believe a service (unrelated to GG) was vulnerable, but couldn't ethically/legally test these problems and companies just ignored their concerns.

[Peter Ney @_peterney]

@erlichya @DocEdge85 @Graham_Coop @sarahzhang @23andMe @Ancestry @FTDNANews @MyHeritage The challenge is legal/ethical issues with white hat hacking on live services because of ToS or CFAA issues, especially if a company is being adversarial or non-responsive to concerns. Ideally companies have something like a bug bounty program so this is explicitly allowed.

[Peter Ney @_peterney]

@sarahzhang Or if the entire database has security issues and is scrapable.

[Peter Ney @_peterney]

@DebbieKennett @Graham_Coop @antonioregalado @yoshi_kohno Depends on what you want to do. Not sure if such a thing is even possible in this case. If the goal is to prevent leaking SNPs from other users, it is going to be really hard if you display SNP-resolution visualizations when you compare kits directly.

[Peter Ney @_peterney]

@Graham_Coop @DebbieKennett @antonioregalado @yoshi_kohno The only way I would trust such high resolution images is if formal mathematical guarantees could be made about how much information is revealed using cryptographic approaches, for example.

[Peter Ney @_peterney]

@Graham_Coop @DebbieKennett @antonioregalado @yoshi_kohno In general, the more information that is revealed (like high resolution visualizations), the easier it is to extract information. I am skeptical that SNP-level resolution can ever be made secure.

[Peter Ney @_peterney]

@Graham_Coop @antonioregalado Of course, an open GG database like this could have broad privacy and national security implications, but that is a separate issue.

[Peter Ney @_peterney]

@Graham_Coop @antonioregalado Whether genetic data should be publicly available, like addresses, isn't relevant here. If they want to make a GEDmatch equivalent where raw data is downloadable, like OpenSNP, then they could do so, but that decision would have to be clear to their users up front.

[Peter Ney @_peterney]

Thanks @blueyedgenes! Shout out to my co-authors @yoshi_kohno and @luisceze.

[Allen School @uwcse]

The DNA database used to find the Golden State Killer is a national security leak waiting to happen - More on the analysis of genetic genealogy security by @UW #UWAllen researchers @_peterney @yoshi_kohno @luisceze, via @techreview https://t.co/Rodb7eUmcX

[Peter Ney @_peterney]

@erlichya @luisceze Just wanted to tag the other author on the work @yoshi_kohno