Few consumers realize how much of their personal information can be gathered by commercial Web sites that require users to create unique accounts and divulge personal information - or how easily databases storing such information can be hacked. But now, thanks to Assistant Professor of Computer Science Anna Lysyanskaya's research into "zero-knowledge proof," or ZKP, companies may soon be able to identify Web site subscribers without knowing their real identities, dissociating the individual user from any usage data collected about him or her while logged in.
"My hope is that there will be a standard for how authentication should be done online. (Companies) should never ask for more information than they need," Lysyanskaya said. ZKP has the potential to reduce the amount of personally identifiable information collected by companies.
As an example of a simple ZKP, Lysyanskaya described holding a "Where's Waldo?" puzzle behind a black sheet with a small, Waldo-shaped hole. By moving the puzzle behind the screen such that Waldo - and only Waldo - is visible through the hole, Lysyanskaya can prove that Waldo exists in the puzzle without revealing his location.
Similarly, a ZKP would allow users to show an online newspaper that they have subscription access to the Web site's content without revealing their identities to the newspaper.
According to Lysyanskaya, the best solution for true privacy on the Internet is to minimize the amount of information demanded of users.
"Everyone should get together and say privacy matters," she said. "People should not give away information that they don't have to."
Lysyanskaya's work in cryptography and ZKP began with her dissertation at the Massachusetts Institute of Technology, which she has continued to refine.
Her work is beginning to pay off. In its September/October 2007 issue, MIT's Technology Review magazine recognized Lysyanskaya as one of the world's "top young researchers under age 35," with work that is "changing our world."
