Vanish: self-destruct your Facebook posts, Webmail emails etc

Deutsch | Español | Français | Italiano | Português | 日本語 | 한국어 | 简体中文

If you’re privacy / security conscious and worried that once email or other data gets out onto the internet it’s there forever (usually even if you hit Delete on your own computer), then you may be interested in Vanish, a new open source research prototype (i.e. not yet bug-free), which has just been released by the University of Washington, so that what you say online won't come back and bite you someday!

How it works is, Vanish:

“can place a time limit on text uploaded to any Web service through a Web browser. After a set time text written using Vanish will, in essence, self-destruct.”

Note that it “wraps round” the sensitive text that you want to self-destruct, so it can be included in virtually anything displayed in a browser.

It’s meant to work with Facebook messages or Wall posts, Gmail (Google Mail in the UK), Yahoo! Mail and Hotmail, as well as Google Docs and (if you really must) Blogger posts, even chats and other Web services (Outlook too, see below):

“After a set time period, electronic communications such as e-mail, Facebook posts and chat messages would automatically self-destruct, becoming irretrievable from all Web sites, inboxes, outboxes, backup sites and home computers. Not even the sender could retrieve them.”

Normally I test stuff, often for months, before I blog about it in a full review. But the documentation for this is pretty detailed and well written, complete with video even (embedded above), and I think the concept is brilliant, so I’m doing a quickie overview / review about it now.

So, you'll know I’ve not tried it in depth yet, but I think it’s well worth trying – it’s free so you’ve nothing to lose (but bear in mind it’s beta or even alpha).

I’ll of course blog more about it once I’ve had a proper go, if I've more to add.

How to use Vanish

You need to:

• install the Vanish software (Java 5 minimum required, EDIT: the Vanish team say it's been tested on Linux Fedora Core 7, Ubuntu Jaunty, Mac OS X 10.4+, Windows XP, and Windows 7) and, to use it on the web, install their Firefox plugin, or
• you can just try Vanish online without installing anything.

What it does is to convert the text you select into a jumble of encrypted characters. Paste that text into the email you're going to send, Wall post etc, instead of your original text.

You use Vanish (e.g. via the Firefox plugin or their online page) to do that conversion, and also to convert jumbled text back to plain readable text - see the documentation (scroll down that page a bit).

Note that it doesn't do the conversion automatically - you have to manually select text, convert, copy / paste etc. And the online version UPDATE: (not tried the installed version yet) doesn't let you choose the expiry date / time, it's fixed at about 8 or 9 hours maximum.

UPDATE: another limitation is that you have to be online to do the conversion, either way (though the self-destruct happens automatically even if you're offline), and as it uses Vuze BitTorrent peer to peer systems on the internet, it may be slow if your ISP throttles i.e. slows down BitTorrent traffic. Also, at the moment you can set the expiry time only when using Firefox (in the extension options - Tools, Add-Ons, under Vanish Firefox Plugin choose Options, it's the last option. And currently the expiry is in 8 or 9 hours max generally, so no good for something which you want to remain readable for say a week or a month. Or even a day. But the technically minded, if they control a machine permanently connected to the Net, can increase this period.

I tried it with Thunderbird / Outlook emails too and it worked, at least to convert and then translate back the emails via copy/paste using the online converter.

Whether the self destruct works with Outlook etc I don't know, given the emphasis on the Vanish site on web services, but I'll try it again after the expiry period. I don't see any reason why it wouldn't work in common email clients. UPDATE: that'll larn me to do a quick post. Yes you can copy / paste the converted text into Outlook, Apple Mail etc and according to the team it'll work.

It goes without saying that the person you send Vanish email etc to has to have Vanish installed on their own computer, or use the online Vanish service, in order to read what you wrote. And then do stuff manually.

I can't quite see people doing that, especially with Facebook Wall posts, but you never know..

The biggest usability point to me is that their instructions saying "Use http://vanish.cs.washington.edu/ to read this message" should link direct to the online translator or installation page (with the link to the online converter at the top of that page, not the bottom), in order to encourage people to use it - else many consumers may just not bother, or give up.

Comments / warnings

Remember, it’s only a prototype, so you use it “as is” without warranty, and please report any bugs you find.

And they warn about making sure that draft emails etc haven't been saved.

Also, of course, there may be regulatory "data retention" requirements to preserve certain electronic communications, so if you are obliged by law to keep stuff, I doubt you can get round it just by applying Vanish to your emails etc! (Though if the person who sent you email did that, maybe there's nothing you can do about it? Should you copy / paste the decrypted text and store it elsewhere anyway, if you're required by law to keep your communications? A different issue..)

My point is, if someone you send Vanish text to deliberately copies and pastes the unencrypted version before the expiry date, they'll still have a copy of the text. Vanish only guards against things hanging around forever accidentally, that's all I think it's meant to do; it won't work in the face of deliberate attempts to get round it. And the Vanish team acknowledge that too: but, as I said, that's not the purpose of Vanish. If secrecy / confidentiality is an issue, use encryption with e.g. PGP - ideally combine Vanish with PGP!

On a different matter, it's obviously still a prototype so not as user or non-geek friendly as it could be. See my point above about direct links for users. And maybe instead of using "Encapsulate" and "Decapsulate" for the menu items they could use "Wrap text" and "Read text". <- UPDATE: My bad, I based that comment on the screenshots, the plugin itself is now fine. But automatic conversion of the text on the fly would still be good.

But hopefully that'll come.

More information

See the Vanish overview which has other helpful links; for those interested, see also the full research paper Vanish: Increasing Data Privacy with Self-Destructing Data by Roxana Geambasu, Tadayoshi Kohno, Amit Levy, Henry M. Levy, and the source code.

Tags: Vanish, email, Facebook, Gmail, Webmail, HotMail, Yahoo Mail, Google Docs, encryption, Web, Improbulus, A Consuming Experience