Hey @dallyshalla I am listening to let’s talk Bitcoin and guy from rivetz is on talking about working with infinity algorythms which is a company you own or work for thats building SAFEx? I’m just trying to understand how these relationships all connect, how rivetz will help security, and how the exchange is coming along? 
Yes, @nigel the company Infinity Algorithms is collaborating with Rivetz, exploring their know-how in securing hardware so that actions taken by the user can not be infiltrated by outsiders;
so imagine if remotely a rogue agent wanted to attack your device at the BIOS level; meaning on the metal; we could use what Rivetz has developed over many years to secure the connection of the hardware into the Operating System; this means that for example a safecoin farming rig is secured against attacks on the hardware, or mobile devices storing safecoins; current demonstrations are shown with Rosie’s bitcoin wallet;
Currently this approach only works on the mobile devices, primarily Samsung devices; though it can work on AMD based devices in which case farming machines; and network access machines can be secured at the access point; all the way to the network; SAFE Network;
Rivetz could be playing a part in securing the hardware; which could be used to access the SAFE Network;
11 Likes
That’s awesome. So it sounds like Apple iOS has its own ‘secure enclave’ that is closed to outsiders so that would be whats used as their trust execution environment for SAFEx? I’m sure I didn’t phrase that properly. Also is rivetz something that will be used securing user credentials for access to the safe network?
@nigel, not exactly like this; Rivetz is like a trezor built into your device
So, if you are using a device that runs Rivetz software then your machine would be more secure against attacks against your machine, and therefore; more secure user credentials;
Rivetz and Factom Announce Collaboration
Rivetz and Factom Add Device-Level Security to the Blockchain Ecosystem
Today, Rivetz (http://rivetz.com/), and Factom (www.factom.org) announced that Factom has selected Rivetz to integrate world cyber-security for the Factom applications, and that Rivetz has selected Factom to assure the global integrity of attribute data for Rivetz-protected applications.
This collaboration will leverage Rivetz’s Trusted Execution model for the secure protection and processing of data and collection of user intent with Factom’s data layer on the blockchain to provide organizations in the financial, manufacturing, distribution and wholesale industries with the efficient means of verifying processes and registering data.
David Johnston, chairman of the Factom Foundation board of directors said, "We are excited to integrate Rivetz’s capabilities to bring world-class protection of users’ identities and private keys as an option for all of Factom’s users.
Rivetz is providing a fundamental technology that will benefit all new blockchain-based applications."
“Rivetz is pleased to partner with Factom to bring a new capability to all applications – the ability to store a fact. We look forward to integrating Factom’s capabilities into our solution to protect and attest to the attributes of modern devices for security, convenience and privacy,” stated Rivetz CEO Steven Sprague.
Factom uses blockchain technology to innovate how organizations can manage and record their data. Businesses can now reliably look to Factom and Rivetz for highly secure, decentralized record-keeping using their API, without having to ensure their information is being stored in a compliant and private manner.
All the data managed by Factom is hashed (a process by which mathematical algorithms encode data into a different form), resulting in an indistinguishable string of alphanumeric characters, rendering information such as names, addresses, transactions and finances impermeable.
Only the person who sent the information into the Factom layer is aware of what data it contains. Rivetz provides the local environment which assures that the information being protected was what the user intended, and enhances the quality of the hash signatures by incorporating cyber-security controls for the local keys and identity information.
Rivetz believes that keeping both the data and the location of the data private is essential to many business and consumer transactions. Rivetz allows the assurance of the Factom network to meet all of the global requirements for protection of identity keys and encryption process. Together, the solution will meet the needs of the most demanding customers and substantially reduce the cyber-security risks which face so many solutions today.
3 Likes
I thought Factom’s story was fact veracity through the Bitcoin blockchain. Now they’re basically saying your facts are as secure from tampering as the Factom server you happen to be using. But there’s 3 likes already, so maybe I’m missing something obvious here.
In case of clients apps (e.g. bitcoin payments - do you want to pay Yes/No) or maybe MaidSafe farmer rigs, I can see why someone may need that.
“protection of users’ identities and private keys” would imply the equivalent of a launcher I’m guessing…
It seems that way.
That’s really weird. They merge a bunch of files into bigger blocks and save a hash on the BTC blockchain. The cost of their coin should never be more than the cost of a single blockchain transaction. Considering how cheap those are, for single documents it wouldn’t be cost prohibitive to avoid Factom and just save the doc’s hash on the blockchain and avoid the complexity of Factom.
Maybe for a bank or some archive it would make sense to save hashes of chunks that contain millions of files, but how is that better than simply using a file server or say MaidSafe to store the files? The hashes can still be stored on the BTC blockchain. At least with MaidSafe its a storage solution so no need to worry about that.
Their servers are really like a MaidSafe App Launcher.
2 Likes
I spoke extensively with Steven Sprague at the Texas Bitcoin Conference over the weekend and got some better insights into what Rivetz is about.
Rivetz is a proprietary architecture that is licensing with various chip manufacturers for use of the Trusted Computing Environment (or the like) which has been shipping on many Intel and ARM chips for years. Many millions of these are out there as the capability has been standard on many chips for years, though no one has utilized the capability. Rivetz’s mother company has been the main mover in getting this capability built into a lot of these chips. Now Rivetz is formed to exploit their capabilities.
Essentially the TCE allows operation of a mini OS that the main OS can’t see, and allows the screen to display data that only the TCE can see.
An app developer will then establish a relationship with Rivetz to access this capability for their app. The relationship is established by the consumer via an in-app purchase from Rivetz, of which the app developer gets a cut.
What is will allow is that private keys, key login data, etc. are isolated from the main OS’s view. This is a device-specific relationship, thus tying data security to physical security to a large degree. You will be able to have multiple devices which share the relationship and give you various portals which can constitute proofs of identity. If you lose a device, you’ll most likely know it and be able to exclude it. If a keylogger steals your passwords or private keys, you don’t know it till you’re screwed.
Infinity Algorithms is a new company dedicated to developing on the SAFE network and is engaging in talks with them to utilize Rivetz for their apps on the SAFE protocol.
Basically, while you can log in to SAFE, or a bitcoin wallet, or whatever, on any device, you have the possibility of having your key credentials stolen by a key logger or the like. With the Rivetz app running on your devices, you can reasonably assure that those private keys are not visable to any malware. This would be a hardware/software union that would be below the SAFE Launcher, for initial access to the device, or whenever you needed to expose your keys. It could also hold your bitcoin keys, wallet ids, etc.
I found it interesting and probably worth using, but if you ask me more technical questions I probably won’t be able to help further.
Apple has a similar capability built in to their devices, apparently, but they hold proprietary access, so we’ll have to see what they do. Maybe they’ll let Rivetz in and maybe not.
1 Like
My question is how to trust the proprietry closed systems (rivetz / Intel / arm) from criminal or state sponsored theft/vulnerability insertion?
Does this really create a trustable environment? @dallyshalla
2 Likes
I’d just like to add that some 17 years ago Phonenix Technologies had a similar technology that didn’t take off.
I didn’t Google it today and I can’t remember what it was called and what they did with it later, but at the time viruses and malware were somewhat manageable so they were trying to use it to place … … links to pre-dot-com Web portals on users’ Windows 98 Desktop… Provided you paid them to do that for you.
Another time I worked a similar technology was in the field of embedded Linux, some 15 years ago, that too wasn’t used for security, but as a primitive predecessor to today’s virtualization. That use case worked out better and they made money from it.
We can run, but we can’t escape… Even with decentralized s/w you have to trust someone…
Considering the choice (trust Rivetz or the gov’t), I’ve no problem picking the greedy capitalists. Unlike the gov’t they’re likely to behave if they know you can leave. 
2 Likes
Good question. When more open source hardware options are available it’ll be easy to implement open software to it right? Closed hardware/closed software. 
I think the only thing on our side is that a company has to live knowing they’d be accountable for anything naughty they do. Unfortunately that’s not much of a consequence it seems if the govt is involved.
We can only hope for increasing levels of trustability, I think.
SAFE is a major move to obstruct the ability at mass hoovering of all data, predictive social algorithms, etc. We already know that the NSA, et al, have tremendous broad access to data streams, and quite an incursion into being able to hack targeted devices. There’s a lot of security in making them HAVE to individually target. The Trusted Computing Environment might have a backdoor. But accessing everyone’s backdoor all the time is less and less feasible the more roadblocks to such are put in.
Plus, while this sort of thing might not completely protect from targeted NSA\gov’t scrutiny, it will make a lot of other hacking measurably more difficult.
1 Like
If there’s a backdoor there’s no individual targeting required, they (NSA/criminals) have exactly the same situation as “collect everything and access at will” - we just save them the trouble & cost of building servers to host it!
Perhaps, but you’ve got to start somewhere and do the best you can.
For SAFE credentials stored in a TCE/Rivetz lock, they would still have to specifically target whose traffic they wanted to snoop, isolate the keys and log onto SAFE. I believe that they would still have to go to Rivetz to get access to the backdoor as it’s not only a hardware relationship, which would make them have to target rather than sweep.
Maybe it’d be easier than that, but another layer of barrier that lots of people can adopt is a good thing in any case.
Even if you cannot trust it with 100% certainty it’s still more secure than to not use any of the trusted platform/trusted hardware infrastructure. I would say definitely use it because while the NSA or someone else might be able to find some backdoor at least Mallory the blackhat wont be able to get your keys.
It’s ultimately more secure than nothing at all but maybe not so secure that the military wont be able to get into it. I think none of the hardware even if you had tried to perfect the design would be secure from the NSA/military. But at least it would be expensive enough, difficult enough, that they’d have to use their focused effort.
So for the NSA/military it would really have to be worth it. If you’re a terrorist suspect then they’ll probably find some way to get at your private keys even if it means kidnapping you. If you’re not then they probably will not care but might notice you’re a privacy advocate who knows quite a bit about encryption.
The point? Don’t be surprised if during some terrorist investigation that you get questioned or have to deal with the side effects. On the other hand at least no script kiddie could run off with your life savings. So the point is you can protect yourself from most adversaries with this technology even if perhaps not the most persistent and determined adversaries. If that is level of protection is valuable to you then this technology and others like it will be valuable.
I am also an advocate of biometrics. Again it’s a situation where while nothing is 100% going to protect you from an advanced persistent threat it is a technology which can protect you from the vast majority of threats.
If you’re trying to protect yourself from NSA/military snooping the best way to do that is not to make yourself a target. Once you’re a target there is nothing you can do to protect yourself anymore.
One system I had forgotten about is Vsentry by Bromium…not sure if it has any benefit for SAFE hosts.
Micro-virtualization
Bromium micro-virtualization technology uses the Bromium microvisor, a purpose-built, Xen-based security-focused hypervisor, in conjunction with the VT features built into Intel®, AMD® and other CPUs to create hardware-isolated micro-VMs for each task a user performs on information originating from unknown sources. These hardware-isolated micro-VMs provide a secure environment where user tasks are isolated from one another, the protected system and the network it is attached to.
A “task” comprises all computation — both within an application and within the kernel — that is required to complete a particular user-initiated activity. For example, opening a single web-browser tab or a PDF document is considered an individual task. Bromium applies the principle of least privilege to each task, granting access to only the specific resources — files, network services, the clipboard, interaction with the user, devices or network shares that are needed to complete the particular task.
This task-based isolation enables vSentry to protect the system from any attempted changes or theft of information made by an attacker. For example, it provides the granularity required to protect against modern attacks like “man-in-the-browser.” This type of attack can compromise the entire web browser, gain access to system resources and steal information from unsuspecting users. The same attack if targeted against a Bromium user would only see the very limited set of resources necessary to perform the task on the specific web-browser tab. Valuable data, networks and devices are not accessible. When the user closes the task, the micro-VM is simply discarded — with all malware it may have contained.
Task Introspection
Task introspection provides a comprehensive view of tasks running within a micro-VM from the perspective of the Bromium microvisor, from the outside in. This viewpoint provides a perfect view of the attacker’s every move and enables Bromium to detect attacks targeted below the operating system, such as rootkits and bootkits. Task introspection ensures that observation and recording of attacks is immune to avoidance by an attacker.
Bromium safely allows malware to fully execute within a hardware isolated virtual container, enabling LAVA post-exploitation analysis of the complete attack cycle and establishing a full malware kill-chain. Comprehensive information on the vector, target and methods used by the attacker and full details of the attack are preserved, including network traffic, file signatures and all changes that malware attempts to make to the operating system or file system. Memory exploits, execution of new tasks, attempts to download and save files, attempts by malware to connect to external command-and-control systems, and much more information are available in real-time.
Advanced visualization and categorization automatically “connects the dots” of complex attacks and categorizes the malicious behavior detected, thereby freeing up security team resources and time needed for endeavors more strategic than routine security alert analysis. Armed with this information, enterprise security teams can respond to threats quickly and efficiently by updating existing security mechanisms, fortifying the defenses of specific attack targets and alerting the targets of the attack to be aware of the threat.
http://www.bromium.com/sites/default/files/videos/introducing-vsentry.mp4
1 Like
That VM technology looks pretty good, excellent actually. Does SAFE Network isolate its processes using a VM? What if data leaks somehow if there isn’t a VM to isolate each process?