The devil is in the metadata — New privacy challenges in Decentralised Online Social Networks

Decentralised Online Social Networks (DOSN) are evolving as a promising approach to mitigate design-inherent privacy flaws of logically centralised services such as Facebook, Google+ or Twitter. A common approach to build a DOSN is to use a peer-to-peer architecture. While the absence of a single point of data aggregation strikes the most powerful attacker from the list of adversaries, the decentralisation also removes some privacy protection afforded by the central party´s intermediation of all communication. As content storage, access right management, retrieval and other administrative tasks of the service become the obligation of the users, it is non-trivial to hide the metadata of objects and information flows, even when the content itself is encrypted. Such metadata is, deliberately or as a side effect, hidden by the provider in a centralised system. In this work, we aim to identify the dangers arising or made more severe from decentralisation, and show how inferences from metadata might invade users´ privacy. Furthermore, we discuss general techniques to mitigate or solve the identified issues.