Confessions to a Data Lake • Hacker News Board

Re: Confessions to a Data Lake

#11

Post by TimC123456 » Tue, Dec 30, 2025, 8:52 PM UTC

RadiozRadioz wrote: post #10

How does this work technically? I am unable to go to their website because: > "This application requires passkey with PRF extension support for secure encryption key storage. Your browser or device doesn't support these advanced features" Is this really necessary for a product's webpage? I would understand for the application itself.

There's a more-recent post on the same blog that gets into the details of how they're using the WebAuthn PRF extension to store key material, but for platforms and browsers that don't yet support the extension, you'll need a password manager that does. There's a table midway down the post with details: https://confer.to/blog/2025/12/passkey-encryption/

Re: Confessions to a Data Lake

#12

Post by recursivetree » Tue, Dec 30, 2025, 8:58 PM UTC

Neither the article nor the linked application explain how confer maintains privacy. As much as I'd like to see something like this, I'm still a bit skeptical as long as they can't explain how the technology at the heart of their product works.

Re: Confessions to a Data Lake

#13

Post by 3s » Tue, Dec 30, 2025, 9:04 PM UTC

RadiozRadioz wrote: post #10

How does this work technically? I am unable to go to their website because: > "This application requires passkey with PRF extension support for secure encryption key storage. Your browser or device doesn't support these advanced features" Is this really necessary for a product's webpage? I would understand for the application itself.

It uses confidential computing primitives like Intel TDX and NVIDIA CC, available on the latest generations of GPUs. Secure hardware like this is a building block to enable verifiably private computation without having to trust the operator. While Confer hasn’t released the technical details yet, you can see in the web inspector that they use TDX in the backend by examining the attestation logs. This is a similar architecture to what we’ve been developing at Tinfoil (https://tinfoil.sh) if you’re curious to learn more!

Re: Confessions to a Data Lake

#14

Post by abeyer » Tue, Dec 30, 2025, 11:52 PM UTC

TimC123456 wrote: post #11

RadiozRadioz wrote: post #10

How does this work technically? I am unable to go to their website because: > "This application requires passkey with PRF extension support for secure encryption key storage. Your browser or device doesn't support these advanced features" Is this really necessary for a product's webpage? I would understand for the application itself.

There's a more-recent post on the same blog that gets into the details of how they're using the WebAuthn PRF extension to store key material, but for platforms and browsers that don't yet support the extension, you'll need a password manager that does. There's a table midway down the post with details: https://confer.to/blog/2025/12/passkey-encryption/

This kind of insistence that their way is "better" and thus justifying removing agency from the user is the exact same thing that's kept me away from signal, too. Even their own blog post acknowledges a perfectly good current method for supporting what they want to do without any of this, yet they reject even allowing it as an option because they don't like the ux.

This arguably is more interesting than yet another closed messaging platform, but still not gonna use it with this requirement in place.