3 ms·
This is a bit of a tangent, but I first heard of Intel SGX (Secure Guard Extensions) via Signal's blog post about secure contact sharing[0], so it's almost rele
by faitswulff 9y ago
This is a bit of a tangent, but I first heard of Intel SGX (Secure Guard Extensions) via Signal's blog post about secure contact sharing[0], so it's almost relevant :p From what I've read[1][2][3], Intel SGX is vulnerable to Spectre exploits. Does anyone know if this has changed Signal's approach to security at all? Granted, contact sharing was a technology preview, but I'm curious if SGX is still considered a feasible, "good enough" security measure for Signal Foundation.
[0]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
[1]: https://software.intel.com/en-us/forums/intel-software-guard-extensions-intel-sgx/topic/754168 https://software.intel.com/en-us/forums/intel-software-guard...
[2]: https://github.com/lsds/spectre-attack-sgx https://github.com/lsds/spectre-attack-sgx
[3]: https://security.stackexchange.com/questions/176635/how-does-meltdown-spectre-impact-intel-sgx https://security.stackexchange.com/questions/176635/how-does...
- deleted 9y ago[deleted]
- tatterdemalion 9y agoSignal's use of SGX was to increase users' trust in Signal - OpenWhisperSystems couldn't log your contacts even if they wanted to. Its up to potential users to decide if they think OpenWhisperSystems will surreptitiously perform an attack on their own secure enclave to secretly log your contact information.
- porjo 9y agoRegarding the SGX enclave and contacting sharing, the blog post announcement dated 26 Sept 2017 says 'deploying into production...over the next few months'. Can we assume that's happened already? Or are contacts still being exchanged in a way that would allow a middle man to reconstruct an individual's social graph?
- gsch 9y agoGiven that it now takes an order of magnitude more time than it used to for newly added contacts to appear in my list of Signal contacts, I assume /something/ has changed with the way they exchange contact data.