This is my theory on why santoshi released bitcoin anonymously. ad hominem attacks like this are way too common in security. Often there's some justifications, but i'd prefer if conversations were about the content alone.
True, there may well be outliers who, with little to no previous experience in a field, are able to master and advance it - but they are outliers.
As to specific comparison with Santoshi and Bitcoin, it doesn't stand, due to the relatively poor history and documentation for LogDog and the relatively greater history and documentation for Bitcoin: There is the 2008 research paper that built upon well-known and well-examined previous work on electronic cash, anonymous payments, etc., etc., and there is the subsequent open source client. No one ever said "trust us, this is cool". Instead, they wrote detailed papers and code and released those to the world - and we made up our own minds.
LogDog is, by comparison, sui generis, a thing of itself, that has sprung into being with neither preamble nor publicized foundations.
URB may be the outlier. Or not. Given the lack of documentation, the lack of openness, and the apparent lack of expertise, we are but wise to raise the questions.
So far, URB seems responsive and engaged, and not particulary evasive. Those are good things for that particular hominid.
Asking for the credentials (and the research) of someone claiming to have a new security product is a shortcut to knowing how well acquainted they are with this difficult field. Yes, it's a shortcut, but it's also warranted. It doesn't mean they won't be heard, just that they will be heard with healthy skepticism.
Thank you for your comprehensive and insightful comments. We have a great team at LogDog and a product that can really help people. I agree that this is a complicated field and that the "bad guys" are really really smart. But you must agree with me that that is no reason not to push forward with ideas and technologies that can help people better protect themselves.
In the short time since we launched, our system has already made several confirmed catches - where we were able to warn users of unauthorized access to their accounts.
We put tremendous effort into securing the privacy of our users' data. We have undergone an external security audit and will continue to do so periodically.
We look forward to a fruitful discussion with the security community and to providing a service that we know to be both necessary and important.
My two greatest concerns reflect this: Without sufficient forethought, planning, and implementation, 1) your servers will be compromised and that anonymized data stolen and misused, and 2) users will have a false sense of security, especially the naive who have no reason to doubt the bold claims.
Think of the recent attacks on CurrentC systems after participating retailers disabled NFC to prevent use of Apple Pay: That brought them a lot of attention and that attention revealed that they were not ready for prime time, they simply did not grasp the enormity of the threat environment in which they hope to operate.
If you have the DevOps experience for defense-in-depth and PDRR, excellent! Hats off to you for attacking an interesting problem in an interesting manner.
Such a tool would also be useful to prevent* "local hacking" - where your credentials have been hacked by someone in your trust circle. Sad, but it happens. However, luckily for the victims, such people aren't usually aware of the hints they may be leaving after they came.
I agree with your other points.
* Or, rather, retaliate after the deed has been done, but it's a good start.
From reading the site and URB's comments on this page, LogDog appears to be a host intrusion detection (HID) package that works first in "learning mode" to establish a baseline set of acceptable or normal behaviours for any given user then eventually moves into notification mode in which it signals to the user that unusual activity has taken place.
Unusual, in this context, means anything outside the thresholds established during learning mode. Presumably, learning mode continues over time and the system becomes more refined.
So far, so good.
What's not so good:
1. The basic premise is "trust us, we know what to look for, but won't tell you because we don't want the bad guys to know". This is security through obscurity and I'm afraid I can characterize this only as "charmingly naive". A) The bad guys already know, guaranteed. B) Unless you are truly expert in this area (see below), you don't and are only guessing. I don't want to harsh anyone's mellow, but you need to be able to back up your claims - especially when you claim your product will make someone's life more secure. We will consider believing your claims after we have read the research papers you are going to publish, the papers that provide enough information for thems of us who know this area to guess at your bona fides but not so much as to reveal all your secrets.
2. All data sent to servers is anonymized. So you say. I will take you at your word. But it means nothing, unless you have done the extremely hard work necessary to show that the data you maintain cannot in any way be used to establish identity after the fact, whether it be by patterns of behaviour or other means. This is an area of active security research and active attacks, and is not for the faint of heart. I invite you to research super cookies, click profiling, etc., etc.
3. Re #2: Your servers are now known to attackers who want that juicy high value data that they can probably do more with than you - unless you are as large and as well funded (they are both). Please describe, at least at a high level, how you are protecting this high value asset you have created. If you cannot, we cannot expect our data to be safe. Regardless of claims of anonymization. Convince us you understand defense in depth, prevent-detect-respond-recover, etc.
4. No offense, but this is a security product from someone with no documented (as far as we can tell) expertise or experience in this area. Everyone who has ever developed a security product from scratch has gotten the first release wrong. Every single time. This stuff is complex and complicated, it takes tremendous experience in the field to design a tool properly, let alone implement one, experience gained either from starting from scratch and surviving to release 4 or 5 or from working on other products developed by experts/survivors.
URB, you may find comments herein and on this page to be assertive, even aggressive. None of us will apologize for this. You are making BOLD claims and providing no reasons for anyone to believe you know what you are doing. You need to do that work before the security community will accept this product.
Try to get hold of Bruce Schneier or another well-known, respected commenter in the field. If you can convince a few such people by giving them a privileged, behind the scenes view (they won't sign your NDA, there is nothing for them in that), that will a) provide real marketing bumpf and b) go a long way to silencing many critics.
But note that you still need to address 2 and 3, even if you convince the best of the best of 1 and 4. Good luck, those are hard problems to solve.