3 ms·
They use remote attestation based on SGX. So, assuming SGX can be trusted, yes. See https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/p
by GranPC 10mo ago
They use remote attestation based on SGX. So, assuming SGX can be trusted, yes. See https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- dathinab 10mo agoand assuming you have a practical way to - verify the attestation - make sure it means the code they have published is the attested code - make sure the published code does what it should - and catch any divergence to this *fast enough* to not cause much damage .... it's without question better then doing nothing but it's fundamentally not a perfect solution but it's very unclear if there even is a perfect solution, I would guess due to the characteristics of phone numbers there isn't a perfect solution
- mjg59 10mo agoWell, no - as long as someone you trust is able to do that verification, that's good enough.