Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Confer – End to end encrypted AI chat

confer.to

Post reply on HN
Print view View original

21–30 of 180 posts

Re: Confer – End to end encrypted AI chat

#21

Post by paxys »

Stefan-H wrote: post #19
shawnz wrote: post #10

I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "…

Just like your mobile device is one end of the end-to-end encryption, the TEE is the other end. If properly implemented, the TEE would measure all software and ensure that there are no side channels that the sensitive data could be read from.

By that logic SSL/TLS is also end-to-end encryption, except it isn't

Re: Confer – End to end encrypted AI chat

#22

Post by liuliu »

shawnz wrote: post #10

I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "…

I agree it is more like e2teee, but I think there is really no alternative beyond TEE + anonymization. Privacy people want it locally, but it is 5 to 10 years away (or never, if the current economics works, there is no need to reverse the trend).

Re: Confer – End to end encrypted AI chat

#23

Post by JohnFen »

roughly wrote: post #7
JohnFen wrote: post #4

Unless I misunderstand, this doesn't seem to address what I consider to be the largest privacy risk: the information you're providing to the LLM itself. Is there even a solution to that problem? I mean, e2ee is great and welcome, of course. That's a wonderful thing. But I need more.

Looks like Confer is hosting its own inference: https://confer.to/blog/2026/01/private-inference/ > LLMs are fundamentally stateless—input in, output out—which makes them ideal for this environment. For Confer, we run inference inside a confidential VM. Your prompts are encrypted from your device directly into the TEE using Noise Pipes, processed there, and responses are encrypted back. The host never sees plaintext.…

> Looks like Confer is hosting its own inference

Even so, you're still exposing your data to Confer, and so you have to trust them that they'll behave as you want. That's a security problem that Confer doesn't help with.

I'm not saying Confer isn't useful, though. e2ee is very useful. But it isn't enough to make me feel comfortable.

Re: Confer – End to end encrypted AI chat

#24

Post by 2bitencryption »

shawnz wrote: post #10

I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "…

if (big if) you trust the execution environment, which is apparently auditable, and if (big if) you trust the TEE merkle hash used to sign the response is computer based on the TEE as claimed (and not a malicious actor spoofing a TEE that lives within an evil environment) and also if you trust the inference engine (vllm / sglanf, what have you) then I guess you can be confident the system is private.

Lots of ifs there, though. I do trust Moxie in terms of execution though. Doesn’t seem like the type of person to take half measures.

Re: Confer – End to end encrypted AI chat

#25

Post by Stefan-H »

paxys wrote: post #21
Stefan-H wrote: post #19

Earlier quoted context omitted.

Just like your mobile device is one end of the end-to-end encryption, the TEE is the other end. If properly implemented, the TEE would measure all software and ensure that there are no side channels that the sensitive data could be read from.

By that logic SSL/TLS is also end-to-end encryption, except it isn't

When the server is the final recipient of a message sent over TLS, then yes, that is end-to-end encryption (for instance if a load balancer is not decrypting traffic in the middle). If the message's final recipient is a third party, then you are correct, an additional layer of encryption would be necessary. The TEE is the execution environment that needs access to the decrypted data to process the AI operations, therefore it is one end of the end-to-end encryption.

Re: Confer – End to end encrypted AI chat

#26

Post by paxys »

Stefan-H wrote: post #25
paxys wrote: post #21

Earlier quoted context omitted.

By that logic SSL/TLS is also end-to-end encryption, except it isn't

When the server is the final recipient of a message sent over TLS, then yes, that is end-to-end encryption (for instance if a load balancer is not decrypting traffic in the middle). If the message's final recipient is a third party, then you are correct, an additional layer of encryption would be necessary. The TEE is the execution environment that needs access to the decrypted data to process the AI operations, ther…

No need to make up hypotheticals. The server isn't the final destination for your LLM requests. The reply needs to come back to you.

Re: Confer – End to end encrypted AI chat

#27

Post by shawnz »

liuliu wrote: post #22
shawnz wrote: post #10

I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "…

I agree it is more like e2teee, but I think there is really no alternative beyond TEE + anonymization. Privacy people want it locally, but it is 5 to 10 years away (or never, if the current economics works, there is no need to reverse the trend).

There's FHE, but that's probably an even more difficult technical challenge than doing everything locally

Re: Confer – End to end encrypted AI chat

#28

Post by tkz1312 »

jeroadhd wrote: post #11

Again with the confidential VM and remote attestation crypto theater? Moxie has a good track record in general, and yet he seems to have a huge blindspot in trusting Intel broken "trusted VM" computing for some inexplicable reason. He designed the user backups of Signal messages to server with similar crypto secure "enclave" snake-oil.

AFAIK the signal backups use symmetric encryption with user generated and controlled keys and anonymous credentials (https://signal.org/blog/introducing-secure-backups/). Do you have a link about the usage of sgx there?

Also fwiw I think tees and remote attestation are a pretty pragmatic solution here that meaningfully improves on the current state of the art for llm inference and I'm happy to see it.

Re: Confer – End to end encrypted AI chat

#30

Post by ignoramous »

liuliu wrote: post #22
shawnz wrote: post #10

I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "…

I agree it is more like e2teee, but I think there is really no alternative beyond TEE + anonymization. Privacy people want it locally, but it is 5 to 10 years away (or never, if the current economics works, there is no need to reverse the trend).

> ... 5 to 10 years away (or never, if the current economics works...

Think PCs in 5y to 10y that can run SoTA multi-modal LLMs (cf Mac Pro) will cost as much as cars do, and I reckon folks will buy it.

Post reply on HN