I am shocked at how quickly everyone is trying to forget that TEE.fail happened, and so now this technology doesn't prove anything. I mean, it isn't useless, but DNS/TLS and physical security/trust become load bearing, to the point where the claims made by these services are nonsensical/dishonest.
Confer – End to end encrypted AI chat
61–70 of 180 posts
Re: Confer – End to end encrypted AI chat
#62Earlier quoted context omitted.
Looks like Confer is hosting its own inference: https://confer.to/blog/2026/01/private-inference/ > LLMs are fundamentally stateless—input in, output out—which makes them ideal for this environment. For Confer, we run inference inside a confidential VM. Your prompts are encrypted from your device directly into the TEE using Noise Pipes, processed there, and responses are encrypted back. The host never sees plaintext.…
> Looks like Confer is hosting its own inference Even so, you're still exposing your data to Confer, and so you have to trust them that they'll behave as you want. That's a security problem that Confer doesn't help with. I'm not saying Confer isn't useful, though. e2ee is very useful. But it isn't enough to make me feel comfortable.
That’s true, but it’s still a distinct threat model from “we use the API of a company run by one of the least trustworthy humans on the planet.” We can talk through side channel attacks and whatnot, but we’re discussing issues with Confer’s implementation, not trusting a different third party.
Re: Confer – End to end encrypted AI chat
#63Earlier quoted context omitted.
If Bob and Alice are in an E2EE chat Bob and Alice are the ends. Even if Bob asks Alice a question and she replies back to Bob, Alice is still an end. Similarly with AI. The AI is one of the ends of the conversation.
So ChatGPT is end-to-end encrypted?
Yes. I include Cloudflare as part of the infrastructure of the ChatGPT service.
Re: Confer – End to end encrypted AI chat
#64I am super curious about this. I wonder baseline it needs to meet to pull me away from using ChatGPT or Claude.
My usage of it would be quite different than ChatGPT. I’d be much freer in what I ask it.
I think there’s a real opportunity for something like this. I would have thought Apple would have created it but they just announced they’ll use Gemini.
Awesome launch Moxie!
Re: Confer – End to end encrypted AI chat
#65Aha. This, ideally, is a job for local only. Ollama et al. Now, of course, it is in question as to whether my little graphics card can reasonably compare to a bigger cloud thing (and for me presently a very genuine question) but that really should be the gold standard here.
I have a hybrid model here. For many many tasks a local 12b or similar works totally fine. For the rest I use cloud, those things tend to be less privacy sensitive anyway.
Like when someone sends me a message, I made something that categorises it for urgency. If I'd use cloud it means they get a copy of all those messages. But locally there's no issue and complexity wise it's pretty low for an LLM.
Things like research jobs I do do in cloud, but they don't really contain any personal content, they just research using sources they already have access to anyway. Same with programming, there's nothing really sensitive in there.
Re: Confer – End to end encrypted AI chat
#66Earlier quoted context omitted.
Because anyone with access to the TEE also has access to the data. The owners can say they won't tamper with it, but those are promises, not guarantees.
That is where the attestation comes in to show that the environment is only running cryptographically verified versions of open source software that does not have the mechanisms to allow tampering.
That's insufficient. Code signing doesn't do anything against theft or malfeasance by internal actors. Or external ones, I suppose.
If the software can modify data legitimately, it can be tampered with.
Re: Confer – End to end encrypted AI chat
#67Re: Confer – End to end encrypted AI chat
#68MM is basically up-selling his _Signal_ trust score. Granted, Signal/RedPhone predecessor upped the game but calling this E2E encrypted AI chat is a bit of a stretch..
Re: Confer – End to end encrypted AI chat
#69Earlier quoted context omitted.
> you're still exposing your data to Confer They use a https://en.wikipedia.org/wiki/Trusted_execution_environment and iiuc claim that your client can confirm (attest) that the code they run doesn't leak your data, see https://confer.to/blog/2026/01/private-inference/ So you should be able to run https://github.com/conferlabs/confer-image yourself and get a hash of that and then confer.to will send you that same hash…
> I feel like this needs diagrams. And there's the problem. All of that stuff is well and good, but it seems like I have to have a fair degree of knowledge and technical skill, not to mention time and effort, to confirm that everything is as they're representing. And it's time and effort I'd have to expend on an ongoing basis. That's not an expectation I could realistically meet, so in practice, I still have to just…
In most of modern life we trust to experts to some degree. I couldn't off the top of my head explain DH key exchange, I don't know if I'll ever understand elliptic curves, but I see that most of the cryptographic community understands them as good methods for many problems and if lots of experts who otherwise argue about anything will agree "what yes, of course DH is good for key exchange but that's beside the point and djb is still wrong about florbnitz keys" then it's likely DH is indeed good for key exchange.
If everyone had to understand every detail to trust in tech we would not have nuclear plants or coast around on huge flammable piles of charged lithium
Re: Confer – End to end encrypted AI chat
#70Earlier quoted context omitted.
> you're still exposing your data to Confer They use a https://en.wikipedia.org/wiki/Trusted_execution_environment and iiuc claim that your client can confirm (attest) that the code they run doesn't leak your data, see https://confer.to/blog/2026/01/private-inference/ So you should be able to run https://github.com/conferlabs/confer-image yourself and get a hash of that and then confer.to will send you that same hash…
As I read it, the attestation is simply that the server is running a particular kernel and application in the Secure Enclave using the hardware’s certification. That does not attest that there is no sidechannel. If exfiltration from the TEE is achieved, the attestation will not change. To put it another way, I am quite sure that a sufficiently skilled (or privileged: how do you know the manufacturer is not keeping co…
That's the main selling point of TEE though, isn't it? That what your hypothetical team could do, can't be done?