Karthikeyan Bhargavan

Antoine Delignat-Lavaud

Web-based Attacks on Host-Proof Encrypted Storage

Cloud-based storage services, such as Wuala, and password managers, such as LastPass, are examples of socalled host-proof web applications that aim to protect users from attacks on the servers that host their data. To this end, user data is encrypted on the client and the server is used only as a backup data store. Authorized users may access their data through client-side software, but for ease of use, many commercial applications also offer browser-based interfaces that enable features such as remote access, form-filling, and secure sharing.

We describe a series of web-based attacks on popular host-proof applications that completely circumvent their cryptographic protections. Our attacks exploit standard web application vulnerabilities to expose flaws in the encryption mechanisms, authorization policies, and key management implemented by these applications. Our analysis suggests that host-proofing by itself is not enough to protect users from web attackers, who will simply shift their focus to flaws in client-side interfaces.

Host-Proof Web Applications

The remarkable increase in website attacks in recent years and the consequent loss of sensitive user data has motivated a security-focused redesign of web applications where data is now routinely stored in encrypted form on web servers and only decrypted when needed. This architecture protects users from malicious hackers who may steal a database from the server but will not be able to decrypt it. However, it does not prevent data theft by disgruntled employees, who may have access to the decryption keys. Moreover, since the server application has access to decrypted data and is itself accessible over the web, any vulnerability in its code risks leaking user data to a web-based attacker through standard attacks like cross-site request forgery (CSRF).

Server-side encryption may be adequate for casual websites, but users of cloud-based storage and privacy-Figure 1: Host-proof web application architecture sensitive applications such as password managers demand stronger security guarantees. For example, when the storage service Dropbox [5] revealed that some of its employees could read user files, it was widely criticized for violating user privacy [START_REF]Keys to the cloud castle[END_REF]. Conversely, when the password manager LastPass [START_REF]LastPass[END_REF] announced that its servers may have been compromised [16], public reaction was mitigated because of the host-proof [START_REF]Host-proof hosting[END_REF] design that LastPass implements against this class of attacks.

A host-proof web application follows the architecture depicted in Figure 1. Personal data is encrypted on the client using a key or passphrase known by the user, while the web server only acts as an encrypted data store. The full functionality of the application is implemented in the client-side app, which performs all encryptions and decryptions, backs up the database to the server and, only when the user authorizes it, shares decrypted data with other users or websites. Since the server never sees unencrypted data (nor any decryption key, ideally), even if an attacker steals the database from the server, he cannot recover the plaintext without substantial computational effort to brute-force through every user's decryption key.

This design is sometimes called cryptographic cloud storage, and may use cryptographic mechanisms that enable some operations on encrypted data (such as search) [START_REF] Kamara | Cryptographic cloud storage[END_REF]. The design is also sometimes misleadingly called zero-knowledge [START_REF]Clipperz[END_REF][START_REF] Spideroak | [END_REF]. We use the more neutral term host-proof to simply mean that the security of the application does not depend on trusting the server.

We consider two classes of host-proof web applications: cloud-based storage and password managers.

• Storage services, such as Wuala [12] and Spi-derOak [START_REF] Spideroak | [END_REF], offer a remote encrypted backup folder synchronized across all of the user's devices. The user may explicitly share specific sub-folders or files with other users, groups, or through a web link.

• Password managers, such as LastPass [START_REF]LastPass[END_REF] and 1Password [START_REF]1Password[END_REF], offer to store users' confidential data, such as login credentials to different websites, or credit card numbers. When the user browses to a website, the password manager offers to automatically fill in the login form with a username and password retrieved from the encrypted database. The password database is backed up on a server and synchronized across the user's devices.

These applications differ from each other in their precise use of cryptography and in their choice of web interfaces. Tables 1 and2 summarize the main features of a series of host-proof applications. In addition to those mentioned above, these tables include the cloud storage applications BoxCryptor [START_REF]BoxCryptor[END_REF] and CloudFogger [START_REF] Cloudfogger | [END_REF] that add client-side encryption to non host-proof cloud services such as Dropbox. They also include the password managers RoboForm [START_REF]RoboForm[END_REF], PassPack [START_REF]PassPack[END_REF], and Clipperz [START_REF]Clipperz[END_REF]. For each application, Table 1 notes the cryptographic algorithms and mechanisms used, while Table 2 summarizes the web interfaces offered.

Despite differences in their design and implementation, the common security goals of host-proof encrypted storage applications can be summarized as follows:

• confidentiality: unshared user data must be kept secret from all web-based adversaries (including the server application itself);

• integrity: encrypted user data cannot be tampered with without it being detected by the client;

• authorized sharing: data shared by the user may be read only by explicitly authorized principals.

In the rest of this paper, we describe five exemplary attacks on commercial host-proof applications that break these security goals by exploiting flaws in both their cryptographic design and their web interfaces.

Metadata Tampering Attacks on Client-side Encryption

Client-side encryption typically relies on the user either knowing an encryption key or knowing a secret passphrase from which a key may be derived. All the applications analyzed in this paper support the PBKDF2 password-based key derivation function [START_REF]PKCS #5: Password-Based Cryptography Specification, Version 2.0[END_REF] that takes a passphrase p, salt s, and iteration count c, and generates an encryption key k (of a given length):

k = KDF(p, s, c)
The salt ensures that different keys derived from the same passphrase are independent and a high iteration count protects against brute-force attacks by stretching the low-entropy password [START_REF] Kelsey | Secure applications of low-entropy keys[END_REF]. The choice of s and c varies across different applications; for example LastPass uses a username as s and c = 1000, whereas SpiderOak uses a random s and c = 16384. When c is too low or the passphrase p is used for other (cheaper) computations, the security of the application can be compromised [START_REF] Belenko | Secure Password Managers" and "Military-Grade Encryption" on Smartphones: Oh, Really? Technical report[END_REF]. The attacks in this paper do not rely on brute-force attacks against passwords. In the rest of this paper, we assume that all passphrases and keys derived from them are strong and unguessable.

Given an encryption key k and data d, each application uses an encryption algorithm to generate a ciphertext e: e = ENC(k, d)

The applications in this paper all support AES encryption, either with 128-bit or 256-bit keys, and a variety of encryption modes (CTR, CBC, CFB). Some applications also support other algorithms, such as Blowfish, Twofish, 3DES, and RC6. In this paper, we assume that all these encryption schemes are correctly implemented and used. Instead, we focus on what is encrypted and how encrypted data is handled.

On storage services, such as SpiderOak and Wuala, each file is individually encrypted using AES and then integrity protected using HMAC (with another key derived from the passphrase)

h = HMAC(k , ENC(k, d))
To avoid storing multiple copies of the same file, some services, including Wuala, perform the encryption in two steps: first the file is encrypted using the hash of its contents as key, then the hash is encrypted with a passphrasederived key. The first encryption doesn't depend on the user, enabling global deduplication: the server can identify and consolidate multiple copies of a file. Although the contents

# ! ! # SpiderOak Application Server JavaScript Website # ! # # BoxCryptor Third-party (Dropbox) None # ! # # CloudFogger Third-party (Dropbox) None ! ! # # LastPass Application Server JavaScript Website ! # # ! PassPack Application Server JavaScript Website ! # # # RoboForm Application Server None ! ! # ! 1Password Third-party (Dropbox) None # ! # ! Clipperz Application Server JavaScript Website ! # ! #
Table 2: Example host-proof web applications and their web interfaces of each file is encrypted, metadata, such as the directory structure and filenames, may be left unecrypted to enable directory browsing. Some password managers, such as LastPass, separately encrypt each data item: username, password, credit card number, etc. but leave the database structure unencrypted. Others, such as RoboForm and 1Password, encrypt each record as a separate file. Still others encrypt the full database atomically. In most of these cases, there is no integrity protection for the ciphertext. Moreover, some metadata, such as website URLs, may be left unencrypted to enable search and lookup.

When metadata is left unprotected and is not strongly linked to the encrypted user data using some integrity mechanism (such as HMAC), it becomes vulnerable to tampering attacks. We illustrate two such attacks.

RoboForm Passcard Tampering The RoboForm password manager stores each website login in a different file, called a passcard. For example, a Google username and password would be stored in a passcard Google .rfp of the form: URL3:Encode('https://accounts.google.com') +PROTECTED-2+ <ENC(k,(username,password))> That is, it contains the plaintext URL (encoded in ASCII) and then an encrypted record containing all the login data for the URL. By opening this passcard in RoboForm, the user may directly login to Google using the decrypted login data. Notably, nothing protects the integrity of the URL. So, if an adversary can modify the URL to bad.com, RoboForm will still decrypt and verify the passcard and leak the Google username and password to the attacken when the user browses bad.com.

A web-based attacker can exploit this vulnerability in combination with RoboForm's passcard sharing feature. RoboForm users may send passcards over email to their friends. So if an adversary could intercept such a passcard and replace the URL with bad.com, the website can then steal the secret passcard data. Similar attacks apply when synchronizing RoboForm with a compromised backup server or when malware on the client has access to the RoboForm data folder.

1Password Keychain Tampering 1Password uses a different encryption format, but similarly fails to protect the integrity of the website URL. For example, a Google record in 1Password's Keychain format is of the form: {"uuid":"37F3E65BA83C4AB58D8D47ED26BD330B", "title":"Google", "location":"https://accounts.google.com/", "encrypted":<ENC(k,(username,password))>} Hence, an attacker who has write access to the keychain may similarly modify the location field to bad. com and obtain the user's Google password. Concretely, since 1Password keychains are typically shared over Dropbox, any attacker who has (temporary) access one of the user's Dropbox-connected devices will be able to tamper with the keychain and cause it to leak secret data to malicious websites.

Similar vulnerabilities due to lack of integrity protection on filenames in BoxCryptor and CloudFogger enable an attacker to modify filenames of encrypted files, say from a.pdf to a.exe.

Towards Authenticated Encryption It is generally accepted among the cryptographic community that "encryption without integrity-checking is all but useless" [START_REF] Steven | Cryptography and the internet[END_REF]. A simple fix to tampering attacks would be to use an MAC to protect the integrity of both the metadata and the encrypted items, as in Wuala and SpiderOak. Alternately, the metadata could also be encrypted and the integrity of the plaintext could be protected by a cryptographic hash (before encryption).

More generally, many host-proof applications appear to use encryption algorithms as if they guaranteed ciphertext integrity. This assumption is false for many modes of AES and especially for hybrid encryption using a combination of RSA and AES. Instead, each password manager should seek to implement a scheme that provides authenticated encryption with associated data [START_REF] Rogaway | Authenticated-encryption with associated-data[END_REF], where the associated data includes unencrypted metadata.

Vulnerability Response We notified both 1Password and RoboForm about these attacks on April 3, 2012.

The 1Password team responded within days with details of their new keychain format for their next version (4.0); this format includes integrity protections which potentially addresses our concerns, but a more detailed analysis of the new format remains to be done.

The RoboForm team proved more resistant to changing their design. They questioned our threat model ("if a malware can modify passcards, it can be just a keylogger instead"), but our attack works even on passcards transported over insecure email. Despite our demo, they refused to believe that we can tamper with passcards ("produce as many passcards as you want and then modify them. they all should be rejected"). We are continuing our discussions with RoboForm but do not anticipate any fixes in the near future.

Both vulnerabilities were publicly disclosed [START_REF]RoboForm "Receive Passcard by E-mail" Feature Accepts Tampered Metadata[END_REF][START_REF]1Password Restore Feature Accepts Tampered Metadata[END_REF].

3 Cross-Site Request Forgery on Remote Web Access Some host-proof applications such as LastPass and Spi-derOak offer fully-featured JavaScript interfaces to its roaming users. A user may login to the website with her passphrase and access her data. However, the passphrase itself should never be sent to the server; instead the JavaScript client should derive decryption keys within the browser. Ideally, all decryptions would also be run within the user's browser, but for efficiency, some decryptions may be executed server-side, with the promise that decryption keys are destroyed on logout.

SpiderOak JSONP CSRF Attack The SpiderOak website uses AJAX with JSONP to retrieve data about the user's devices, directory contents and share rooms. So, when a user is logged in, a GET request to /storage/<u32>/?callback=f on https://spideroak.com where <u32> is the base32-encoded username returns:

f({"stats": {"firstname": "Legit", "lastname": "User", "devices": 3, ... "devices": [["homepc", "homepc/"],

["laptop", "laptop/"],

["mobile","mobile/"]]}})

Hence, by accessing the JSON for each device (e.g. /storage/homepc/), the JavaScript client retrieves and displays the entire directory structure for the user.

It is well known that JSONP web applications are subject to Cross-Site Request Forgery if they do not enforce an allowed origin policy [START_REF] Barth | Robust defenses for cross-site request forgery[END_REF]. SpiderOak enforces no such policy, hence if a user browsed to a malicious website while logged into SpiderOak, that website only needs to know or guess the user's SpiderOak username to retrieve JSON records for her full directory structure.

More worryingly, if the user has shared a private folder with her friends, accessing the JSON at /storage/<u32> /shares yields an array of shared "rooms" that includes access keys:

{"share_rooms" :

[ { "url" : "/browse/share/<id >/<key >" , "room_key" : "<key >" , "room_description" : "" , "room_name":<room >}] , "share_id" : "<id >" , "share_id_b32" : "<u32 >"} So, the malicious website may now at leisure access the shared folders at https://spideroak.com/browse/share/ <id>/<key> to steal all of a user's shared data.

Key Management for Shared Data Our specific attack can be prevented by simply adding standard CSRF protections to all the JSONP URLs offered by Spi-derOak. However, a more general design flaw is the management of encryption keys for shared data. When a folder is shared by a user, it is decrypted and stored in plaintext on the server, protected only by a password that is also stored in plaintext on the server. This breaks the host-proof design completely since flaws in the SpiderOak website may now expose the contents of all shared folders (as indeed we found). A better design would be to use encrypted shared folders as in Wuala [START_REF] Grolimund | Cryptree: A folder tree structure for cryptographic file systems[END_REF], where decryption keys are temporarily provided to the website but not stored permanently.

Vulnerability Response We notified the SpiderOak team about the attack on May 21, 2012; they acknowledged the issue and disabled JSONP within one hour. However, no change was made to the management of share room keys, and no additional protections against CSRF attacks, such as Referer or token based checks, have been put in place. We fear that shared data on Spi-derOak remains vulnerable to other website attacks; notably, many of the problems reported on the SpiderOak Security Response page relate to cross-site scripting.

Stealing Data from Client-side Websites

Wuala is a Java application that may be run directly as a desktop client or as a Java applet from the Wuala website. It maintains an encrypted directory tree where each file is encrypted with a different key and the hierarchy of keys is maintained by a sophisticated key management structure [START_REF] Grolimund | Cryptree: A folder tree structure for cryptographic file systems[END_REF]. When started, Wuala asks for a username and password, uses them to derive a master key which is then used to decrypt the directory tree. On Windows systems, Wuala creates the following local directory structure: %userprofile%/AppData Local Wuala Data (local cache) Roaming Wuala defaultUser (master key file)

The defaultUser file contains the master key for the current user. The Data folder contains the encrypted directory tree along with plaintext data for files that have been recently uploaded or downloaded from the server. Wuala also runs a lightweight HTTP server on localhost at port 33333. This HTTP server is primarily meant to provide various status information, such as whether Wuala is running, whether backup is in progress, log error messages, etc. It may also be used to open the Wuala client at an given path from the browser. The user may enable other users on the LAN to access this HTTP server to monitor its status. The HTTP server cannot be disabled but is considered a mostly harmless feature.

Database recovery attack on Wuala

We discovered a bug on the Wuala HTTP server, where files requested under the /js/ path resolve first to the contents of the main Wuala JAR package (which has some JavaScript files) and then, if the file was not found, to the content of Wuala's starting directory.

If Wuala was launched as an applet, its starting directory will be Roaming in the above tree, meaning that browsing to http://localhost:33333/js/defaultUser will return the master key of the current active user. Using this master key file anyone can masquerade as the user and obtain the full directory tree from Wuala.

If Wuala was started from as a desktop client, its stating directory will be Local instead, allowing access to the local copy of the database, including some plaintext files. These flaws can be directly exploited by an attacker on the same LAN (if LAN access to the HTTP server is enabled; it isn't by default), or by any malware on the same desktop (even if the malware does not have permission to read or write to disk or to access the Internet). The attacker obtains the full database if Wuala was started as an applet, and some decrypted files otherwise.

Protecting Keys from Web Interfaces Our attack relies on a bug in the HTTP server, it simply should not allow access to arbitrary files under the /js/ path. More generally, the attack reveals a design weakness that the Wuala master key is available in plaintext when Wuala is running and is stored in plaintext on disk if the user asks Wuala to remember his password. This file is extremely sensitive since obtaining the file is adequate to reconstruct and decrypt a complete copy of the user's directory tree (on any machine). The software architecture of Wuala makes the file available to all parts of the application including the HTTP server. We advocate a more modular architecture that isolates sensitive key material and cryptographic operations in separate processes from (potentially buggy) web interfaces.

Vulnerability Response We notified the Wuala team about the vulnerability on May 21, 2012. They responded immediately and released an update (version 399) within 24 hours that disabled file access from the local web server. No other change was made to the HTTP server or master key cache file following our report. The vulnerability has been publicly disclosed [START_REF]Wuala Status Page Leaks Plaintext Files[END_REF].

Phishing Attacks on Browser Extensions

Password managers typically offer browser extensions that can be used to fill forms automatically on known websites. These extensions are written in JavaScript and either implement cryptography in JavaScript (e.g. Last-Pass) or call out to an external desktop application (e.g. 1Password and RoboForm). When a user visits a website, say gmail.com with a password manager's browser extension installed, the extension examines the URL of the page to decide whether or not to automatically fill in the login form (using data re-trieved and decrypted from the database). However, the code for parsing the URL is often flawed and does not account for maliciously crafted URLs. 1Password Phishing Attack For example, the URL parsing code in the 1Password extension (version 3.9.2) attempts to extract the top-level domain name from the URL of the current page:

var href = getBrowser().contentWindow.location.href + "/"; var domain = href.replace(/^http[s]*:\/\/(.*?)\/.*$/i, "$1"); var middle = domain.replace(/^(www.)*(.*)/i, "$2"); return middle.substring(0,1).toUpperCase() + middle.substring(1,middle.length);

So given a URL http://www.google.com, this code returns the string Google.com. However, this code does not correctly account for URLs of the form http://user: password@website. So, suppose a malicious website redirected a user to the url http://www.google.com:xxx@bad. com. The browser would show a page from http://bad. com (after trying to login as the "user" Google.com), but the 1Password browser extension would incorrectly assume that it was on the domain Google.com and release the user's Google username and password. This amounts to a phishing attack on the browser extension, which is particularly serious since one of the advertised features of password managers like 1Password is that they attempts to protect naive users from password phishing. Similar attacks can be found on other password managers, such as RoboForm's Chrome extension, that use URL parsing code that is not defensive enough.

URL Parsing Parsing URLs correctly with regular expressions is a surprisingly difficult task, despite URLs having a well understood syntax [START_REF]Uniform Resource Identifier (URI): Generic Syntax[END_REF], and leading websites often get it wrong [START_REF] Rydstedt | Busting frame busting: a study of clickjacking vulnerabilities at popular sites[END_REF]. Perhaps the most widely used URL parsing library for JavaScript is parseUri [START_REF]Split urls in javascript[END_REF] which uses the following regular expression (in "strict" standard-compliance mode): This regular expression is also incomplete. For example, given the URL http://bad.com/#@accounts.google.com, it yields a domain accounts.google.com whereas the correct interpretation is bad.com.

Domain-based Authorization

Password managers authorize websites based on their domain name. The basic flaw that enables our phishing attacks is that the interpretation of the domain of the URL by the browser extension is inconsistent with the interpretation of the browser. In the cases shown above, the extension was wrong and the browser was right. But even if the extension were right and the browser were wrong, a secret password may be leaked. An easy fix that prevents our attack is for the extension to directly use the parsed window.location object given by the browser. A different fix is to use a careful regular expression parser that mimics the browser. A more general design question is whether domain-based authorization is appropriate for website login. On hosting websites such as WordPress and Google Sites, hundreds of different websites may share the same domain name, causing domain-based password managers to be very error-prone. Moreover, users may wish to only release their passwords over HTTPS, but domains do not include protocol information. So for example, if a user asked LastPass to remember her password to https: //facebook.com, and later she was redirected to the HTTP login form on http://facebook.com, LastPass will happily fill in her username and password, revealing it to eavesdroppers on the network. We advocate that password managers implement site-specific authorization policies that include full origins (scheme, host, port) and enable users to choose their desired level of security.

Vulnerability Response

We notified 1Password about the phishing vulnerability on April 3, 2012. The 1Password team responded immediately and released a new beta version of their browser extensions on April 5, 2012 (build 39304) that implements a new, more careful, URL parsing function. This function fixes the specific attack that we found but a full verification of their new URL parsing code and its consistency with different browsers remains an open question. The 1Password vulnerability has been publicly disclosed [START_REF]Phishing attack on 1Password Browser Extensions[END_REF].

Rootkit attacks on bookmarklets

Bookmarklets are bookmarks that contain a fragment of Javascript code. When clicked, this code is injected into the current active page, a feature commonly used by password managers to fill login forms on the page using the user's password database. Bookmarklets can be considered lightweight substitutes for browser extensions and are particularly suited for mobile and roaming users. Unlike extensions, bookmarklets are evaluated inside the Javascript scope of the page they are being injected into, making them vulnerable to a variety of threats, collectively called rootkit attacks [START_REF] Adida | Rootkits for JavaScript environments[END_REF] that are very hard to protect against. Of particular concern are bookmarklets that handle sensitive data like passwords: they must ensure that they do not inadvertently leak the data meant for one site to another. The countermeasure proposed in [START_REF] Adida | Rootkits for JavaScript environments[END_REF] addresses exactly this problem by verifying the origin of the website and has been adopted by a number of password managers, including LastPass and PassPack. However, they are still vulnerable to attack.

LastPass master key theft The LastPass Login bookmarklet loads code from lastpass.com that defines various libraries and then runs the following (stripped down) function: This code retrieves the encrypted username and encrypted password for the current website, it downloads a decryption key (encrypted with the secret key associated with the bookmarklet), and uses the decryption key to decrypt the username and password before filling in the login form. Even though the decryption key is itself encrypted, it is enough to know <user> and _LASTPASS_RAND to decrypt it. Hence, a malicious page can detect when the _LP_CONTAINER object becomes defined (i.e. when the user has clicked the LastPass bookmark), redefine this object and call _LP_START again to decrypt and leak the key, username, and password. Since the username and password are meant for the current (malicious) page, this does not seem like a serious attack, until we note that the decryption key obtained by this attack is the permanent master key that is used to encrypt all the usernames and passwords in the user's LastPass database. Hence, the bookmarklet leaks the decryption key for the full database to a malicious website. A similar attack applies to the PassPack bookmarklet: a malicious website can steal a temporary encryption key that enables it to add a new record into the user's password database for any URL.

Per-record Key Derivation

To protect host-proof applications against bookmarklet attacks, it is not enough to strongly authenticate the page that loads the content script. We also need to verify that the website is authorized to read any secret included in the content script. For example, our attacks would not be so serious if the keys revealed by the bookmarklet were specific to the website. Instead, they reveal a design flaw in the ways keys are used in LastPass; LastPass derives a master key from a username and a master password, without using any seed. This key remains constant for a long time (until the master password is changed). Moreover, it is used to individually encrypt each username and password field, and also used to re-encrypt the full database. To correctly implement data sharing with different websites, we advocate that different keys be generated for different records, by using per-record salts, or by including the URL (or its domain name) into the key derivation process.

Vulnerability Response

We notified LastPass about the vulnerability on May 21, 2012. The LastPass team acknowledged the risk of leaking the master decryption key to malicious websites and changed their bookmarklet design within 24 hours. Decryption is now performed inside an iframe loaded from the https://lastpass.com origin, preventing the host page from stealing the key. However, they did not modify the overall design; hence, LastPass still uses a single master key for all encryptions.

Conclusions

The host-proof application design pattern provides one level of isolation between sensitive user data and website attackers, but this is not enough. Moving cryptography to the client means that special attention should be paid to enforcing strong isolation between code that is relevant to the user interface and code that performs security-sensitive cryptographic operations. Current commercial host-proof client applications have critical flaws in the way they integrate browser-based interfaces with cryptographic code. We have presented a series of practical attacks that exploit these flaws. We have built demonstrations of these attacks and helped various vendors fix their software. From the viewpoint of web application security, our attacks are not new; what is novel is their interaction with cryptographic mechanisms, and the way they reveal security design flaws. We found these attacks by a careful but manual study of selected host-proof applications over a few weeks. It is worrying that we were able to find attacks on most applications we looked at without the aid of any sophisticated tools. To find more subtle attacks or to verify that an application is free from attack will require automated tools that can account for both web-specific threats and a precise model of cryptography but still scale up to realistic web applications. As ongoing and future work, our goal is to build such analysis tools based on sound formal foundations [START_REF] Akhawe | Towards a formal foundation of web security[END_REF][START_REF] Bansal | Discovering concrete attacks on website authorization by formal analysis[END_REF] and apply them, for example, to the verification of the host-proof web applications studied here.

e

  = ENC(HASH(d), d), ENC(k, HASH(d))

s t r i c

  t : / ˆ( ? : ( [ ˆ: \ / ? # ] + ) : ) ? ( ? : \ / \ / ( ( ? : ( ( [ ˆ:@] * ) ( ? : : ( [ ˆ:@] * ) ) ? ) ?@) ? ( [ ˆ: \ / ? # ] * ) ( ? : : ( \ d * ) ) ? ) ) ? ( ( ( ( ? : [ ˆ? # \ / ] * \ / ) * ) ( [ ˆ? # ] * ) ) ( ? : \ ? ( [ ˆ# ] * ) ) ? ( ? : # ( . * ) ) ? ) /

Table 1 :

 1 Example host-proof web applications and their cryptographic features

	Name Wuala SpiderOak BoxCryptor CloudFogger Files Data Format Key Derivation Blobs PBKDF2-SHA256 AES, RSA Encryption Encrypted Data Ciphertext Integrity Metadata Protection Files, Folders HMAC ! Files PBKDF2-SHA256 AES, RSA Files HMAC ! Files PBKDF2 AES Files, Filenames None # PBKDF2 AES, RSA Files None # LastPass XML PBKDF2-SHA256 AES, RSA Fields None # PassPack JSON SHA256 AES Records None ! RoboForm PassCard PBKDF2 AES, DES Records None # 1Password Keychain PBKDF2-SHA1 AES Records None # Clipperz JSON SHA256 AES Records SHA-256 !
	Name	Backup Location	Remote Access	Bookmarklet Custom Client Local Page Browser Extension
	Wuala	Application Server	Java Web Applet

Acknowledgments Bhargavan is supported by the ERC Starting Grant CRYSP. This work was done during Delignat-Lavaud's internship at INRIA.


Alberto Romele

The goal of this article is to show how Ricoeur's perspective on traces could be used in the current debate on digital traces and the "right to be forgotten" -the recent ruling by the Court of Justice of the European Union according to which people have the right, under certain conditions, to ask search engines like Google to remove results for queries that include their name. In the first section, the author discusses Ricoeur's unexpected "love for technology". In particular, he shows how externalizations -i.e. methods, techniques and technologies -have been at the heart of Ricoeur's hermeneutical reflections. In the second section, he takes into account Ricoeur's considerations on traces and memory in Memory, History, Forgetting as potential replies to the several issues posed by digital traceability. The hypothesis is that Ricoeur's perspective, and especially his motto "you are better than your actions", could represent an ethical integration of both the juridical imposition of the European Court of Justice and the technical-moral solutions suggested by authors such as Luciano Floridi and Viktor Mayer-Schönberger.

Introduction

Several academics have already dealt with the topic of Paul Ricoeur as a philosopher of technology.

According to Ernst Wolff, one can distinguish between three main research directions 1 . The first one is that of David Kaplan who investigated what Ricoeur effectively said about technology. He then tried to develop a "Ricoeurian critical theory" and to think of the manner in which the Ricoeurian philosophy and philosophy of technology could contribute to each other. 2 . The second one is that David Lewin's who tried to show how Ricoeur's thoughts could be relevant in a debate à la Heidegger on Being and Technology 3 . The third one is the work of Wolff himself who has been using Ricoeur's hermeneutics and philosophical anthropology for some years in order to develop an interdisciplinary approach on the technical dimension of human action 4 . In addition to these approaches, my personal contribution consists of using the Ricoeurian hermeneutics in the specific context of ICTs (Information and Communication Technologies) for the past two or three years 5 . This article belongs precisely to this line of research. In particular, its goal is to show how Ricoeur's perspective on traces could be used in the current debate on digital traces and the "right to be forgotten" -the recent ruling by the Court of Justice of the European Union according to which people have the right, under certain conditions, to ask search engines like Google to remove results for queries that include their name. The discussion will be developed in two steps. In the first section, I am going to discuss Ricoeur's unexpected "love for technology". In particular, I will show how externalizations -i.e. methods, techniques and technologies -have been at the heart of his hermeneutical reflections. In the second section, I will take into account his considerations on traces and memory in Memory, History, Forgetting as potential replies to the several issues posed by digital traceability. My hypothesis is that Ricoeur's perspective, and especially his motto "you are better than your actions" 6 , could represent an ethical integration of both the juridical imposition of the European Court of Justice and the technical-moral -the relation between morality and technology will be explained -solutions suggested by authors such as Luciano Floridi and Viktor Mayer-Schönberger.

Paul Ricoeur or the love of technology

I was rather surprised when I first read this statement in a still little known text by Ricoeur entitled

Sens et fonction d'une communauté ecclesiale (Meaning and Function of a Church Community) 7 :

I am very attached to the work of a young philosopher, named Simondon, who wrote a very interesting book on "the technical object". He shows that, too often, we regard the technical object as an enemy, simply because we ignore it.

But if we had a better knowledge of how machines work, we would realize that it is a materialized humanity, a crystalized humanity into things. The modern matter is much more spiritual than the ancient matter. We master unleashed forces, like the steam, less than information's schemes, which are our intellect (raison) into the things; […] we tame signs, systems of signs, much more than nonhuman energies. […] The modern citizens will have to be more competent! 8 This passage is remarkable for two reasons. First, because it is one of the rare occasions -to my knowledge the only one -when Ricoeur explicitly refers to Objects). Incidentally, that book is not part of Ricoeur's private library, housed at the Fonds Ricoeur in Paris, yet the two authors met at least twice. The first meeting took place when Simondon defended his major thesis L'individuation à la lumière des notions de forme et information (Individuation in the light of the notions of Form and Information) in 1958. Ricoeur was one of the members of the jury. The second one occurred on February 27, 1960, when Simondon presented his works at the Société française de philosophie before a prestigious audience, and Ricoeur was part of it [START_REF] Simondon | Centenaire de la société française de philosophie. Les grandes conférences du XXe siècle: texts téléchargeables en intégralité[END_REF] . On that occasion, Ricoeur criticized Simondon for having attempted an axiomatization of human sciences from a domain that does not belong to them: "can we attempt an axiomatization of humanities from a field that does not belong to humanities? More precisely, what seems to me prior to human sciences is not nature, but the totality of Humaness + Nature; can we, from a structure of thought borrowed from nature, axiomatize the totality of Humaness + Nature? I think that we are necessarily doomed to something like a fallacy whenever we try to explain the totality of the laws through one of its parts" 10 . Reproached for the "metaphorical character" of his transpositions from nature to human signification, Simondon claimed that in his reflection it is not a matter of metaphors or translations, but rather of "transduction". For him, "[t]he transductive process of thinking consists of establishing identities among relations. Such a process, however, cannot be assimilated into a simple translation. Indeed, it is not based on identity, but rather on the differences that it aims to explain" [START_REF] Simondon | L'individuation à la lumière des notions de forme et d'information[END_REF] . With this notion, whose value is both epistemological and ontological, he wanted to formulate a "relational ontology", which, however, is capable of maintaining the distinctions between the different modes of existence, in particular between nature -animals, plants and minerals -, human beings and technologies [START_REF]On the notion of transduction in Simondon and the difference between Simondon's and Bruno Latour's relationism[END_REF] . With regard to the relation between human beings and technical objects, he argues in Du mode d'existence that "the first condition for incorporating technical objects into culture would be to acknowledge that human beings are neither inferior nor superior to technical objects. It would consist int approaching them, getting to know them, having an equal relationship and a reciprocity of exchanges with them: a kind of asocial relationship" [START_REF] Simondon | Du mode d'existence des objets techniques[END_REF] . Because of his predilections for symbols and signs, Ricoeur has obviously the tendency to humanize both nature and technologies. For Simondon, by contrast, signification cannot be reduced to human discourse. For this reason, he replies to Ricoeur that "there is here [in your critique] a theory of the word that overlooks what can be admitted; it means to attribute all the value to the word. In what I have tried to present, there is a theory of nature that cannot admit such a theory of signification as if it were included entirely in the word"14 . Similarly, when Ricoeur presents Simondon's modern machines as being "materialized" and "crystalized" humanity, he is clearly misunderstanding Simondon's intentions. Yet despite this "idealism of the matter" [START_REF] Latour | Prendre le plis des techniques[END_REF] , the fact remains that Ricoeur defends the necessity for human beings "to find a certain fraternity with technological machines" [START_REF] Ricoeur | Sens et fonction d'une communauté ecclesiale[END_REF] . In the text Prévision économique et choix éthique (Economic prevision and ethical choice) published in 1966, he had already stressed that technicization does not cause alienation, but rather increases prevision, and then choice and responsibility: "One might think that prospective, prevision and planning denote progress in the mechanization of existence. On the contrary […], it must be understood that the more we multiply the zones of intervention, the more we multiply the zones of responsibility, conquered by chance and disorder, the wider are the range of alternatives" 17 . In his Moralizing Technology, the Dutch philosopher Peter-Paul Verbeek has similarly argued that "[w]hen technology is used, it organizes a situation of choice" [START_REF] Verbeeek | Moralizing Technology: Understanding and Designing the Morality of Things[END_REF] . According to him, while fulfilling their function, technologies do much more: they give shape to what we do and they contribute actively to the ways we live our lives: "By making it possible to detect specific diseases, medical diagnostic devices do not simply produce images of the body but also generate complicated responsibilities, especially in the case of antenatal diagnostics and in situations of unbearable and endless suffering" 19 . In the next section, I will show how some academics suggested the implementation of new technical features in digital devices as a moral solution for the issue of online traceability.

The context is the second reason why the passage quoted at the beginning of this section is interesting. Ricoeur is talking about the role of the Protestant church communities in the modern societies before a non-academic audience. In a long part of Sens et fonction, Ricoeur discusses the importance of Rudolph Bultmann's "demythologization" for an internal critique that would permit the Protestant church communities to have a role in contemporary technicized societies. Such a role would consist of bringing " hope for a meaning, to witness this meaning by reflecting on the methods and the goals of our society […]" [START_REF] Ricoeur | Sens et fonction[END_REF] . When I titled this section "Paul Ricoeur or the love of technology", I was clearly thinking of Bruno Latour's book Aramis ou l'amour des techniques (Aramis or the love of technology). In this book, Latour investigated the reasons for the failure of the project Aramis, a revolutionary transport system that the company Matra, supported by RATP (the Parisian transport company), conceived in the 1970s. The book is both a popularization of STS (science and technology studies) and a strong critique of the thesis on the autonomy of technology, put forward, for instance, by Jacques Ellul: "I have sought to offer humanists a detailed analysis of a technology sufficiently magnificent and spiritual to convince them that the machines by which they are surrounded are cultural objects worthy of their attention and respect. […] I have sought to show technicians that they cannot even conceive of a technological object without taking into account the mass of human beings with all their passions and politics" 21 . Rather than approaching human beings and technologies as belonging to two separate domains, Latour suggests to keep the interwoven character of the two spheres at the center. Humans and nonhumans are conceived according to the "principle of symmetry", which confers upon them the same dignity. Reflecting on the possible sources of Latour's approach toward techniques, I remembered a rather long passage of an interview that he released when his latest book was published, Enquête sur les modes d'existence

(An Inquiry into Modes of Existence):

From 1966 to 1973, when I was a militant Catholic student at the University of Dijon, I had the good fortune to have as a philosophy professor André Malet, a Protestant minister and Rudolf Bultmann's French translator. In his hands, which were as lustrous as parchment, the Biblical text finally became comprehensible, revealed as a lengthy process of transformations, inventions, glosses, and diverse rationalizations which, taken together, sketched out a layer of interpretations that played out -this is the essential point -each in its own way the question of fidelity or treason: faithful or falsified invention, impious reworking or astounding rediscovery? We spent hours outside of class comparing the various resurrection narratives; for example, should they be read as informative stories -the tomb really is emptyor as transformational stories -the angel with a raised finger makes it clear how the Scriptures are to be read, how what they say manages to resuscitate the person to whom they are addressed? Because they escaped from an inexplicable form of transcendence and immobility, because they became localized, historical, situated, artificial, yes, invented and constantly reinvented, by raising the question of their own veracity anew at every turn, these texts finally became active and accessible. […]Strangely, to my eyes, the systematic destruction by exegesis of all dogmatic certitudes, far from weakening the truth value that the successive glosses played out over and over, made it possible at last to raise the question of religious truth 22 .

For Latour and Ricoeur, Butlmann's approach opens up a more authentic understanding of the Biblical texts. Demythologization is a technique for interpreting the New Testament that enables people today to grasp the message of the myths without abandoning their scientific knowledge. In fact, "we cannot use electric lights and radios and, in the events of illness, avail ourselves of modern medical and clinical means and at the same time believe in the spirit and wonder world of 21 the New Testament" 23 . Would it be too rash to see a continuity between demythologization and the love for technology? Doesn't demythologization mean acknowledging the theoretical (and moral) relevance of science and technology for the contemporary societies? At the same time, isn't demythologization, the effort of tidying up two opposite attitudes toward the same object, an esprit de finesse and an esprit de géometrie? If it were so, it could not be a coincidence that Jacques Ellul considered Karl Barth the most important theologian of his century 24 .

Last but not least, isn't all this closely related to Paul Ricoeur's famous motto "explain more is to understand better", which in turn is a mise en abyme of his entire hermeneutical challenge of bringing together truth and method? Ricoeur is the philosopher who abandoned symbols in favor of signs, because of their higher controllability -especially after the development of the structural linguistics' techniques. Moreover, among the representatives of ontological hermeneutics, he is the one who most externalized the language and its effectiveness. Let us consider, for example, the role of narrative for the reconfiguration of the self. Of course, Ricoeur remains an "idealist of the matter", insofar he never questioned the materiality and the technicity of texts and traces. However, it is fair to say that he paved the way for a hermeneutical understanding of science and technology 25 .

In the next section, I will consider how Ricoeur's hermeneutics might possibly contribute to the specific issue of digital traceability and the right to be forgotten.

Digital traceability and the right to be forgotten

It is often said that we live in an information and communication society. Yet what characterizes contemporary societies is not information and communication per se, but rather the fact that all information and communication leave a digital trace of its passage. Digital technologies -e.g. Internet, Web 2.0, mobile access to the Internet, Internet of things and wearable devices -are making digital traceability a "total social fact". There are at least two kinds of issues related to this phenomenon. First, digital traces can be easily collected and analyzed both for commercial and for scientific purposes. "Critical data studies" is an emerging research field focusing on the ontological, 23 R. Bultmann, New Testament and Mythology: The problem of Demythologizing the New Testament Proclamation, in New Testament and Mythology and other Basic Writings, Philadelphia, Fortress, 1984, p. 4. 24 The relation between Ricoeur, Barth, Bultmann and the theology of the Word is rather complex. For instance, in his Preface to Bultmann -available today in The conflict of Interpretations -he praises demythologization and defends it from possible misunderstanding. Yet he also accuses Bultmann of having remained within the limits of anthropological philosophy. In this way, he assumes, at least implicitly, a Barthian perspective. It is noteworthy that Ricoeur's criticism of Bultmann's existentialism is mitigated in an article he wrote in 1991, which is devoted to the work of Latour's first master. Cfr. P. Ricoeur, Hommage à André Malet, interprète de Bultmann, in M.-F. Conad, C. Picard and M. Vautrin (éds.), André Malet ou un homme en quête de Dieu. Hommage de l'université de Bourgogne, Editions Universitaires, Dijon, 1991, pp. 157-166. On Ricoeur and the theology of the Word, cfr. A. Romele, La parole efficace chez Gerhard Ebeling et Paul Ricoeur, in "Revue de théologie et de philosophie", vol. 144, 2012, pp. 305-318. 25 Cfr. D. Ihde, Expanding Hermeneutics: Visualism in Science, Evanston IL, Northwestern University Press, 1999. epistemological, anthropological, political and ethical challenges posed by (big) data analytics [START_REF]On the difference between digital traces and data, as well as the distinction between different forms of data, cfr[END_REF] .

Second, there is daily access via search engines to the part of these traces that is available on the Internet, the consequences of which are not less problematic. This is precisely the topic of this section.

According to danah boyd, four affordances -i.e. specific properties that make possible certain types of practices -characterize social media: persistence -the durability of online expressions and contents; visibility -the potential audience who can bear witness; spreadability -the ease with which content can be shared; searchability -the ability to find content [START_REF] Boyd | It's complicated. The social lives of networked teens[END_REF] . These affordances can be extended to the entire Web 2.0. Taken together, they make the Internet a sort of flatland, lacking depth both in time and space. According to Floridi, on the Internet, information is "dynamically structured 'on the fly' by our researches" [START_REF] Floridi | Right to be forgotten poses more questions than answers[END_REF] . The "right to be forgotten" ruling has been introduced by European Commission with the intention to offer its citizen a juridical resource in case some digital traces are considered by someone detrimental for his or her own privacy [START_REF]Collomb, Et s'il n'y avait pas de traces numériques?, Exposé présenté le 21 Mars 2013 à Toulouse lors du colloque "E-réputation et traces numériques: dimensions instrumentales et enjeux de société[END_REF] .

In 2010, a Spanish citizen complained to the National Data Protection Agency about the presence of an auction notice of his repossessed home in Google's search results. According to him, this infringed his privacy because all the proceedings concerning him had been fully resolved many years ago. The citizen requested that Google Spain and Google Inc. be required to remove the personal data relating to him, so that it no longer appeared in the search results. The Spanish court referred the case to the Court of Justice of the European Union. In its ruling of May 13, 2014, the EU Court of Justice declared that (1) search engines are controllers of personal data. Google cannot therefore escape the EU data protection law; (2) even if the server of a company is located outside Europe, EU rules apply to it if it has a branch or a subsidiary in a Member State; (3) individuals have the right -under certain conditions 30 -to ask search engines to remove links with personal information about them 31 . Google had to make an online complain form available for its European customers, specifying, however, that "[w]hen you make such a request, we will balance the privacy rights of the individual with the public's interest to know and the right to distribute information.

When evaluating your request, we will look at whether the results include outdated information about you, as well as whether there's a public interest in the information" 32 . Since the company first started to process requests in May 2014, it has received more than 280,000 requests. Less than 5% concern criminal, politicians and high-profile public figures, while 95% percent comes from everyday members of the public 33 . Google also set up an advisory council, which held consultations in several European cities in order to "gather input from Europeans". In January 2015, the advisory council published its findings and recommendations in a report, which is available online 34 . It is noteworthy that the report refers to the right to be forgetting as "delisting". In fact, the European ruling does not concern the source site and hence it does not really has the effect of "forgetting" information about data subjects: "Once delisted, the information is still available at the source site, but its accessibility to the general public is reduced because search queries will not return a link to the source publication" 35 . There are many issues related to the EU ruling. As Floridi, who was 30 Generally, the ruling applies when the information is inaccurate, inadequate, irrelevant or excessive for the purposes of the data processing. Cfr. the European Commission's Factsheet on the "Right to be forgotten" ruling, http://ec.europa.eu/justice/data-protection/files/factsheets/factsheet_data_protection_en.pdf. Accessed on September 1, 2015. 31 Jurists have been discussing the eventuality of a "right to be forgotten" ruling in Europe and its consequences for many years. In particular, US scholars have seen a possible conflict with other fundamental rights such as the freedom of expression and the freedom of the media. Law professor Jeffrey Rosen, for instance, argued that EU and US have opposite approaches to the issue. In Europe, the right to be forgotten finds its intellectual roots in the French droit à l'oubli, which allows a convicted criminal, who has served his time, to object to the publication of the facts of his conviction. In the United States, by contrast, publication of someone's criminal history is protected by the First Amendment, which concerns among other things the freedom of speech and of the press. According to him -the article was published in 2012 -after the European ruling "[i]t's hard to imagine that the Internet results will be as free and open as it is now". For Steven C. Bennet, despite cultural divisions between the EU and the US on the substance of privacy rights and the reach of jurisdiction over the Internet, a process of convergence seems inevitable. Firstly, because outside the context of newsworthy stories, US courts have been generally less inclined to insist on unrestrained access to information. Secondly, because recent EU pronouncements expressly recognize the need to balance right of privacy with freedom of expression. For the European Commission, the right to be forgotten is not a "super-right" and the request for erasure has to be assessed on a case-by-case basis. Cfr. J. Rosen, "The Right to be forgotten", in Stanford Law Review, http://www.stanfordlawreview.org/online/privacy-paradox/right-to-be-forgotten. Accessed on September 1, 2015; S. C. Bennett, "The 'Right to be forgotten': reconciling EU and US perspectives", in Berkeley Journal of International Law, Vol. 30, No. 1, pp. 161-195. 32 Cfr. https://support.google.com/legal/contact/lr_eudpa?product=websearch&hl=en. Accessed on September 1, 2015. 33 S. Tippmann and J. Powel, Google accidentally reveals data on 'right to be forgotten' requests, "The Guardian", July 14, 2015, http://www.theguardian.com/technology/2015/jul/14/google-accidentally-reveals-right-to-be-forgottenrequests. Accessed on September 1, 2015. 34 https://drive.google.com/file/d/0B1UgZshetMd4cEI3SjlvV0hNbDA/view. Accessed on September 3, 2015. 35 Ivi, p. 4. In the central part of the report, the authors highlight the main criteria for assessing delisting requests such as the types of information, their source and time -"the Ruling refers to the notion that information may at one point be relevant but, as circumstances change, the relevance of that information may fade" (Ivi, p. 14). In the final part, the report refers to procedural elements that are not explicitly addressed by the ruling, but on which the authors chosen to give their advice: the need to make the removal request form easily accessible; the need of notifying webmasters of a delisting; the possibility for data subjects of challenging the delisting decision; the appropriate geographic scope of the among the members of the advisory council, pointed out, "[s]ome expected a grand finale, a denouement in which the problems raised by the ruling would be resolved. Instead, a sense of déjà vu soon dawned on the final meeting in Bruxelles. […] [P]erhaps it was a missed opportunity to run some intellectual risks and think outside the proverbial boxes" 36 . According to me, the most evident limit of the ruling is its contingent character. First, because it does not prevent, but rather intervenes afterwards, when privacy is felt as having been already infringed. Second, its application depends upon the individual sensitivity to digital traceability's pervasiveness. Some academics thought of another kind of solution that might be called technical-moral. Floridi, for instance, suggested the technical implementation of a "right to comment": "There are many alternative technical possibilities to de-indexing, including reordering information results, deidentifying information, and appending additional qualifying information […]. Instead of an all-ornothing approach, internet services could be encouraged to consider a generally-available right to comment -for example, by linking metadata to alternative URLs that clarify, update, or contextualize" [START_REF] Powels | A manifesto for the future of the 'right to be forgotten' debate[END_REF] . For Viktor Mayer-Schönberger, an expiration date for the information would be the most suitable solution. Our digital devices would be made to automatically delete information that has reached its expiry date. When saving a document, users would have to select an expiration date in addition to the document's name [START_REF] Mayer-Schönberger | Delete: the Virtue of Forgetting in the Digital Age[END_REF] . According to him, "[t]he need to enter an expiration date should prompt users to reflect, at least for a moment, about the lifespan of the information they intend to store" 39 . The author is not directly concerned with the right to be forgotten but, more generally, with information persistency in the digital age. However, his idea could be extended to uploading and availability of contents online. I call this solution "technical-moral" because it suggests the implementation of technical features in order to introduce a situation of choice. As Verbeek said, when technologies are used, moral decisions are not taken autonomously by humans.

delisting -the links are removed just from the European-directed services of Google such as google.fr and google.it; the issue of transparency toward the public and the data subject. 36 L. Floridi, Right to be forgotten poses more questions than answers, cit. For him, the most significant questions that were raised during the consultations concern: the sedimentation of personal information online; a new, two-tier approach to information; the territoriality of the law versus the non-territoriality of the Internet; a conflict by proxythe right to be forgotten and the right to information; information cartography -indexing by search engine is today more important than the corresponding information; public interest versus what is interesting to the public; the relevance of relevance -it is impossible to identify the relevance of some information without referring to the context; the all-encompassing nature of data processing -there is currently no distinction between recording, copying, formatting, linking and manipulating data; algorithms versus humans; information powers. Cfr. also L. Floridi, "The Right to be Forgotten": a Philosophical View, in "Annual Review of Law and Ethics", forthcoming. A pre-print version of the article is available at

Rather, moral agency is distributed among humans and nonhumans: "ultrasound imaging organizes a specific form of contact between expectant parents and unborn child, in which the parents and the child are constituted in specific ways with specific moral roles" [START_REF] Verbeek | [END_REF] . The introduction of an expiration date for the information would fully recognize such a morality to digital traces, which organize a specific form of contact between search engines' users and data subjects. Yet this approach has two limits. First, it could positively affect the way one treats his or her personal data, but it is uncertain what kind of effect it would have on the information he or she makes available online about others.

Indifference is a possibility, but it could also happen that a person decides for some reasons to unduly delay the expiration date of an information concerning someone else. Second, the possibility to choose an expiration date for information, as Mayer-Schönberger presents it, remains, so to incompleteness. In other words, people might become comfortable in dealing with digital traces, but they would also become increasingly incapable to see their limits -fortunately, not everything we communicate, think and do is captured in digital format 42 . But it is precisely with the intention of putting a spotlight on the incompleteness of the digital traces that I am going to discuss Ricoeur's hermeneutics of the traces -"hermeneutics of the historical condition", as he calls it -in the rest of this section and in the brief conclusion [START_REF]On the application of Ricoeur's hermeneutics of traces to digital traceability[END_REF] .

First of all, it is important to say what, according to me, is a hermeneutical approach to technology.

On one hand, it means to recognize the relevance that technological mediations have on the relation between human beings and the world [START_REF] Cfr | Technology and the Lifeworld: From Garden to Earth[END_REF] . On the other hand, it also means to recognize the limits of technological mediation as such. For Don Ihde, all technologies have a "magnification/reduction structure", i.e. they amplify some aspects of reality but neglect some others. This is also the case of the technologies related to digital traceability. As I said, among the representatives of ontological hermeneutics, Ricoeur is the one who most valued the externalizations of language. Symbols, signs, metaphors and narrations are necessary mediations for the human understanding of the world, the others and oneself. It is precisely this predilection for externalizations that makes Ricoeur's hermeneutics interesting for the philosophy of technology. There is no room here for such a reflection, but his perspective should be confronted with popular notions from the philosophy of technology such as Bernard Stiegler's "tertiary retention" and Clark and Chalmers' "extended mind". The central part of Memory, History, Forgetting is devoted to the articulation -the hermeneutical circularity -between the phenomenology of memory and the epistemology of history. On one hand, Ricoeur stresses the importance of historiography for fixing, accessing and processing living memory. On the other hand, he highlights its reductionist character. He refers in particular to Plato's myth of Theuth, god of writing and Derrida's critical interpretation of it: "That this extension of the myth of the origin of writing may sound as a myth on the origin of history, thanks to rewriting, is, if I may put in this way, authorized by the myth itself, inasmuch what is at stake is the fate of memory. […] [I]t is to true memory, genuine memory, that the invention of writing and its related drugs is opposed as a threat" 45 . History, writing, traces and, more generally, all kinds of inscription are pharmakon, i.e. remedy and poison, for the living experience of memory. For Ricoeur, the moment of the archive determines the passage of memory from its oral to its written form: "The moment of the archive is the moment of the entry into writing of the historiographical operation. Testimony is by origin oral. It is listened to, heard. The archive is written. It is read, consulted" 46 . Moreover, he defines the archive as "the physical place that shelters the destiny of that kind of trace that I have so carefully distinguished from the cerebral trace and the affective trace, namely, the documentary trace" 47 . It seems possible to me to transpose Ricoeur's pharmacological attitude toward history, writing and traces to digital traceability, all the more so because the Internet is understandable as -although not reducible to -a dynamic archive, i.e. a database where information can be added, browsed and, with much more difficulty, changed and destroyed. Digital traces are pharmakon, since they are both important resources to access information and, because of their intrinsic incompleteness, limits for a genuine understanding of the world, the others and oneself.

  Simondon and the book resulting from his minor thesis Du mode d'existence des objets techniques (On the Mode of Existence of Technical

5 A. Romele, Narrative Identity and Social Networking Sites, in "Etudes Ricoeuriennes/Ricoeur Studies", vol. 4, n. 2, 2013, pp. 108-122; Herméneutique du digital: les limites techniques de l'interprétation, in "Etudes Digitales", vol. 1, n. 1, 2015 (forthcoming). 6 P. Ricoeur, Memory, History, Forgetting, Chicago, The University of Chicago Press, 2004, p. 493. 7 The text (II.A.247 according to the Vansina's bibliography) was published in 1968 in the Cahiers d'études du Centre protestant de recherches et de rencontres du Nord. 8 P. Ricoeur, Sens et fonction d'une communauté ecclesiale, cit., p. 63. English translation is mine.

  B. Latour, Aramis or the Love of Technology, Cambidge MA, Harvard University Press, p. VIII.

22 B. Latour, Biography of an Inquiry: On a Book about Modes of Existence, in "Social Studies of Science", vol. 43, n. 2, 2013, pp. 287-301, pp. 288-289. Emphasis is mine.

  speak, externally induced. Referring to the work of Foucault, Verbeek distinguishes between morality as the behavior corresponding to a specific moral code, and ethics as the way in which human beings constitutes themselves as subjects: "ethics is not only a matter of a person who is the 'subject' of his or her actions […] but of a person who also 'subjects' himself or herself to […] a vision of what constitutes a good life or a good behavior"41 . This means that we cannot confine

ourselves to disciplining humans by implementing new technical features. However useful it might be in the short term, one must also consider the long term necessity to "subject" users to a vision of what is a good use of digital traces. Mayer-Schönberger refers to it as "cognitive adjustment". Yet cognitive adjustment would fail for him to address a fundamental downside of digital memory:

G. Simondon, Forme, Information, Potentiels, cit., p. 760. English translation is mine.

In Memory, History, Forgetting, Ricoeur articulates forgetting and forgiveness; despite a certain reticence, he also sketches the outlines of an ars oblivionis, "a path of a forgetting that would no longer be a strategy, nor a work, an idle forgetting. […] If memory-as-care we hold ourselves open to the past, we remain concerned about it. Would there not then be a supreme form of forgetting, as a disposition of being in the world, which would be insouciance, carefreeness?" 48 . In our context, insouciance would be a specific disposition of being in the digital world: despite their "being-readyto-hand", digital traces might not always be the most authentic way to access the world, the others and oneself. This does not mean abstinence, but rather moderation. Verbeek insists on the fact that ethics should not aim at protecting "humanity" from "technology" but should consist in carefully assessing and dealing with technological mediations [START_REF] Verbeek | [END_REF] . According to him, ethics is "about excellence in living, or mastering the art of living. In a technological culture, an ethics of the good life is about developing forms of excellence in living with technology" 50 . When moderation -which might be seen as a hermeneutical process of distantiation and appropriation -is not contemplable, another principle intervenes. Ricoeur argues that "under the sign of forgiveness, the guilty person is to be considered capable of something other than his offenses and his faults" [START_REF] Ricoeur | Memory, History, Forgetting[END_REF] . He also suggests to expand this principle to all relations between a person and his or her own actions. In this sense, "[t]he formula for this liberating word, reduced to the bareness of its utterance, would be: you are better than your actions" 52 . "You are better than the digital traces your actions left behind you" is the principle of charity that should guide our attitude toward traceability in the digital age. As principle of charity, it goes further than the golden rule according to which "one should treat others' digital traces as one would like others to treat one's own digital traces". In conclusion, the question arises whether the limit of Ricoeur's ethical perspective consists of remaining "externalist" with respect to the digital technologies of traceability. Yes and no. Yes, insofar it does not permit to sketch the outlines of an ethics of design. By contrast, this is among the main tasks of Verbeek's approach 53 . No, because Ricoeur's reflection on traces, and, more generally, his hermeneutical approach has the merit to encourage reflection on the excellence of living in relation with, and not outside of externalizations, i.e. methods, techniques and, potentially, technologies.