7 ms·
You don't need to trust the server with E2E encryption. If you can review and trust the client, the server only has access to the information that the client s
by Caligatio 6y ago
You don't need to trust the server with E2E encryption. If you can review and trust the client, the server only has access to the information that the client sends.
Even if they release up-to-date server code, we have no way to confirm that's the code that's running on their servers. People would then complain that they don't have shell access to the servers to ensure the code is what is expected.
- bilal4hmed 6y agoWell one way you could confirm is to run your own instance of the server and run the client against it and the client works as if you are going against Moxie's server Right now if you run the published server code and point the client certain features don't work. Doesn't that sound a little concerning ?
- vbezhenar 6y agoActually there's a way to check the code running on their servers. At least Signal claimed that: Modern Intel chips support a feature called Software Guard Extensions (SGX). SGX allows applications to provision a “secure enclave” that is isolated from the host operating system and kernel, similar to technologies like ARM’s TrustZone. SGX enclaves also support a feature called remote attestation. Remote attestation provides a cryptographic guarantee of the code that is running in a remote enclave over a network. https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ But of course you need published source code and reproducible build.