4 ms·
Very interesting, thanks for sharing. I had one idea of extreme transparency. What if the Signal server used a per-user-thread model where each thread was isola
by hestefisk 7y ago
Very interesting, thanks for sharing.
I had one idea of extreme transparency. What if the Signal server used a per-user-thread model where each thread was isolated in a sandbox, which only the user has access to. The user can log in with read only access via ssh and certify that nothing is logged, nothing is tampered with etc. A kind of extreme transparency.
- thu2111 7y agoYou're heading in the right direction but traditional UNIX tools don't work here. That's why Signal needs to use SGX. Consider: how do you know the SSH server isn't tampered with? It could be feeding you an entirely fake session. You might say, the sandbox. How do you know the sandbox isn't tampered with? How do you know the hard disk or the RAM isn't tampered with? The third party owns the machine itself. SGX is based on the insight that it's very, very difficult to tamper with a physical circuit as small as a CPU. The CPU is the root of trust in any machine. If a CPU can produce a report that says the moral equivalent of "I'm running an OpenSSH server version X" and the CPU itself is preventing the server owner from tampering with the software, then you have the ability to reason about what the server is doing with your data.