Do what he did for messaging? Make a thing almost nobody uses?
3 billion WhatsApp users use protocol built on his labor, every day.
Confer – End to end encrypted AI chat
111–120 of 180 posts
Re: Confer – End to end encrypted AI chat
#112What he did with messaging... So he will centralize all of it with known broken SGX metadata protections, weak supply chain integrity, and a mandate everyone supply their phone numbers and agree to Apple or Google terms of service to use it?
The issue being there's not really a credible better option. Matrix is the next best, because they do avoid the tie-in to phone numbers and such, but their cryptographic design is not so great (or rather, makes more tradeoffs for usability and decentralisation), and it's a lot buggier and harder to use.
Re: Confer – End to end encrypted AI chat
#113Earlier quoted context omitted.
Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't colle…
> You can download the app as an .apk from their website if you don't trust Google Play Store. I wish apple & google provided a way to verify that an app was actually compiled from some specific git SHA. Right now applications can claim they're opensource, and claim that you can read the source code yourself. But there's no way to check that the authors haven't added any extra nasties into the code before building an…
This is what F-droid does (well, I suspect most apps don't have reproducable builds that would allow 3rd-party verification), but Signal does not want 3rd-party builds of their client anyhow.
Re: Confer – End to end encrypted AI chat
#114Earlier quoted context omitted.
Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't colle…
> You can download the app as an .apk from their website if you don't trust Google Play Store. I wish apple & google provided a way to verify that an app was actually compiled from some specific git SHA. Right now applications can claim they're opensource, and claim that you can read the source code yourself. But there's no way to check that the authors haven't added any extra nasties into the code before building an…
[deleted]
Re: Confer – End to end encrypted AI chat
#115Earlier quoted context omitted.
Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't colle…
>over 3,000,000,000 users Is that a typo or are you really implying half the human population use Signal? Edit: I misread, you are counting almost every messaging app user.
Yeah, whatsapp uses the same protocol.
Re: Confer – End to end encrypted AI chat
#116Earlier quoted context omitted.
Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't colle…
>over 3,000,000,000 users Is that a typo or are you really implying half the human population use Signal? Edit: I misread, you are counting almost every messaging app user.
Just WhatsApp. Moxie's ideas are used in plenty of other messengers. The context was "what Moxie did for the field of instant messaging".
Re: Confer – End to end encrypted AI chat
#117Earlier quoted context omitted.
> You can download the app as an .apk from their website if you don't trust Google Play Store. I wish apple & google provided a way to verify that an app was actually compiled from some specific git SHA. Right now applications can claim they're opensource, and claim that you can read the source code yourself. But there's no way to check that the authors haven't added any extra nasties into the code before building an…
This is what F-droid does (well, I suspect most apps don't have reproducable builds that would allow 3rd-party verification), but Signal does not want 3rd-party builds of their client anyhow.
They could still figure out a way to attest their builds against source.
Re: Confer – End to end encrypted AI chat
#118Earlier quoted context omitted.
Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't colle…
>over 3,000,000,000 users Is that a typo or are you really implying half the human population use Signal? Edit: I misread, you are counting almost every messaging app user.
[deleted]
Re: Confer – End to end encrypted AI chat
#119Re: Confer – End to end encrypted AI chat
#120It’s exciting to hear that Moxie and colleagues are working on something like this. They definitely have the skills to pull it off.
Few in this world have done as much for privacy as the people who built Signal. Yes, it’s not perfect, but building security systems with good UX is hard. There are all sorts of tradeoffs and sacrifices one needs to make.
For those interested in the underlying technology, they’re basically combining reproducible builds, remote attestation, and transparency logs. They’re doing the same thing that Apple Private Cloud Compute is doing, and a few others. I call it system transparency, or runtime transparency. Here’s a lighting talk I did last year: https://youtu.be/Lo0gxBWwwQE