3 ms·

No, you have to trust anyone with access to the server; secure enclave provides no security given it appears it is vulnerable to side channel attacks; see comme

No, you have to trust anyone with access to the server; secure enclave provides no security given it appears it is vulnerable to side channel attacks; see comment you just replied to for related link. Basically all it does is given Signal plausible deniability for public search warrants: https://signal.org/bigbrother/ https://signal.org/bigbrother/ It would do nothing to stop national security letters. Basically, you should assume the functionality provided by the secure enclave is only in name; given the NSA ATT national security letters enabled both physical access and system modifications, see no reason to believe others would not be required to do so as well: https://en.m.wikipedia.org/wiki/Room_641A https://en.m.wikipedia.org/wiki/Room_641A Again, average person does not have a threat model that makes this relevant, but to say Signal does not have access to the SGX data is purely based on trust, not mathematical proofs.

palata 4y ago
At that point, your phone is vulnerable. As is your computer, and your connected fridge. If your threat model does not allow it, use manual e2ee with pigeons. Otherwise, well secure enclave will get better with time, which will make Signal better too.
- O__________O 4y ago
  Signal should make threats clear to users, just as they should have notified all users that multiple 3rd parties downloaded all the phone numbers in Signal. Offering federated servers would also allow users to secure their own servers.
- s_ting765 4y ago
  > secure enclave will get better with time Intel already dropped SGX from their new line up of CPUs (11th gen +). https://news.ycombinator.com/item?id=29932630 https://news.ycombinator.com/item?id=29932630
  - palata 4y ago
    Does that mean that the secure enclave technology will die? Feels like: 1. SGX is just an implementation, could be replaced by something else. 2. SGX still works on CPUs that have it.
    - deleted 4y ago
      [deleted]

palata 4y ago

At that point, your phone is vulnerable. As is your computer, and your connected fridge. If your threat model does not allow it, use manual e2ee with pigeons. Otherwise, well secure enclave will get better with time, which will make Signal better too.

O__________O 4y ago
Signal should make threats clear to users, just as they should have notified all users that multiple 3rd parties downloaded all the phone numbers in Signal. Offering federated servers would also allow users to secure their own servers.
s_ting765 4y ago
> secure enclave will get better with time Intel already dropped SGX from their new line up of CPUs (11th gen +). https://news.ycombinator.com/item?id=29932630 https://news.ycombinator.com/item?id=29932630
- palata 4y ago
  Does that mean that the secure enclave technology will die? Feels like: 1. SGX is just an implementation, could be replaced by something else. 2. SGX still works on CPUs that have it.
  - deleted 4y ago
    [deleted]