16 ms·

Confer – End to end encrypted AI chat

• AdmiralAsshat 9mo ago
  Well, if anyone could do it properly, Moxie certainly has the track record.
• f_allwein 9mo ago
  Interesting! I wonder a) how much of an issue this addresses, ie how much are people worried about privacy when they use other LLMs? and b) how much of a disadvantage it is for Confer not to be able to read/ train in user data.
• JohnFen 9mo ago
  Unless I misunderstand, this doesn't seem to address what I consider to be the largest privacy risk: the information you're providing to the LLM itself. Is there even a solution to that problem? I mean, e2ee is great and welcome, of course. That's a wonderful thing. But I need more.
  • roughly 9mo ago
    Looks like Confer is hosting its own inference: https://confer.to/blog/2026/01/private-inference/ https://confer.to/blog/2026/01/private-inference/ > LLMs are fundamentally stateless—input in, output out—which makes them ideal for this environment. For Confer, we run inference inside a confidential VM. Your prompts are encrypted from your device directly into the TEE using Noise Pipes, processed there, and responses are encrypted back. The host never sees plaintext. I don’t know what model they’re using, but it looks like everything should be staying on their servers, not going back to, eg, OpenAI or Anthropic.
    • dang 9mo ago
      We'll add that link to the toptext as well. Thanks! (It got submitted a few times but did not get any comments - might as well consolidate these threads)
    • jeroadhd 9mo ago
      That is a highly misleading statement: the GPU runs with real weights and real unencrypted user plaintext, since it has to multiply matrices of plain text, which is passed on to the supposedly "secure VM" (protected by Intel/Nvidia promises) and encrypted there. In no way is it e2e, unless you count the GPU as the "end".
      • Imustaskforhelp 9mo ago
        So what you are saying is that all the TEE and remote attestation and everything might work for CPU based workflows but they just don't work with GPU effectively being unencrpyted and anyone can read it from there? Edit: https://news.ycombinator.com/item?id=46600839 https://news.ycombinator.com/item?id=46600839 this comment says that the gpu have such capabilities as well, So I am interested what you were mentioning in the first place?
      • AlanYx 9mo ago
        It is true that nVidia GPU-CC TEE is not secure against decapsulation attacks, but there is a lot of effort to minimize the attack surface. This recent paper gives a pretty good overview of the security architecture: https://arxiv.org/pdf/2507.02770 https://arxiv.org/pdf/2507.02770
    • JohnFen 9mo ago
      > Looks like Confer is hosting its own inference Even so, you're still exposing your data to Confer, and so you have to trust them that they'll behave as you want. That's a security problem that Confer doesn't help with. I'm not saying Confer isn't useful, though. e2ee is very useful. But it isn't enough to make me feel comfortable.
      • internet_points 9mo ago
• jeroenhd 9mo ago
  An interesting take on the AI model. I'm not sure what their business model is like, as collecting training data is the one thing that free AI users "pay" in return for services, but at least this chat model seems honest. Using remote attestation in the browser to attest the server rather than the client is refreshing. Using passkeys to encrypt data does limit browser/hardware combinations, though. My Firefox+Bitwarden setup doesn't work with this, unfortunately. Firefox on Android also seems to be broken, but Chrome on Android works well at least.
• datadrivenangel 9mo ago
  Get a fun error message on debian 13 with firefox v140: "This application requires passkey with PRF extension support for secure encryption key storage. Your browser or device doesn't support these advanced features.Please use Chrome 116+, Firefox 139+, or Edge 141+ on a device with platform authentication (Face ID, Touch ID, Windows Hello, etc.)."
  • pona-a 9mo ago
    In KeePassXC: > Your authenticator doesn't support encryption keys. Please try again using 1Password — some password managers like Bitwarden don't work yet.
  • crtasm 9mo ago
    That is funny it won't even show us the homepage. We are allowed into the blog though! https://confer.to/blog/ https://confer.to/blog/
  • Marsymars 9mo ago
    I'm getting that that on macOS with Firefox 139+, for whatever reason...
  • butz 9mo ago
    Great new way to lock out potential new users. I bet large part of users interested in privacy are using Linux and some fork of Firefox.
  • gregors 9mo ago
    I was also getting this, but works today.
• hiimkeks 9mo ago
  I am confused. I get E2EE chat with a TEE, but the TEEs I know of (admittedly not an expert) are not powerful enough to do the actual inference, at least not any useful one. The blog posts published so far just glance over that.
  • dfajgljsldkjag 9mo ago
    It seems like the H100 gpu itself has some kind of secure execution environment built in. Not sure of the details but it appears that all data going to and from the gpu will be encrypted. https://developer.nvidia.com/blog/confidential-computing-on-h100-gpus-for-secure-and-trustworthy-ai/ https://developer.nvidia.com/blog/confidential-computing-on-...
    • donaldihunter 9mo ago
      Yes, the TEE is CPU + H100 GPU.
    • hiimkeks 9mo ago
      Huh, thanks!
• shawnz 9mo ago
  I don't agree that this is end to end encrypted. For example, a compromise of the TEE would mean your data is exposed. In a truly end to end encrypted system, I wouldn't expect a server side compromise to be able to expose my data. This is similar to the weasely language Google is now using with the Magic Cue feature ever since Android 16 QPR 1. When it launched, it was local only -- now it's local and in the cloud "with attestation". I don't like this trend and I don't think I'll be using such products
  • Stefan-H 9mo ago
    Just like your mobile device is one end of the end-to-end encryption, the TEE is the other end. If properly implemented, the TEE would measure all software and ensure that there are no side channels that the sensitive data could be read from.
    • paxys 9mo ago
      By that logic SSL/TLS is also end-to-end encryption, except it isn't
      • Stefan-H 9mo ago
        When the server is the final recipient of a message sent over TLS, then yes, that is end-to-end encryption (for instance if a load balancer is not decrypting traffic in the middle). If the message's final recipient is a third party, then you are correct, an additional layer of encryption would be necessary. The TEE is the execution environment that needs access to the decrypted data to process the AI operations, therefore it is one end of the end-to-end encryption.
        • paxys 9mo ago
          No need to make up hypotheticals. The server isn't the final destination for your LLM requests. The reply needs to come back to you.
          • 9mo ago
• jeroadhd 9mo ago
  Again with the confidential VM and remote attestation crypto theater? Moxie has a good track record in general, and yet he seems to have a huge blindspot in trusting Intel broken "trusted VM" computing for some inexplicable reason. He designed the user backups of Signal messages to server with similar crypto secure "enclave" snake-oil.
  • liuliu 9mo ago
    I think there is only so much you can do practically. Without a secure "enclave", there isn't really much you can do. What's your alternative?
  • tkz1312 9mo ago
    AFAIK the signal backups use symmetric encryption with user generated and controlled keys and anonymous credentials (https://signal.org/blog/introducing-secure-backups/ https://signal.org/blog/introducing-secure-backups/). Do you have a link about the usage of sgx there? Also fwiw I think tees and remote attestation are a pretty pragmatic solution here that meaningfully improves on the current state of the art for llm inference and I'm happy to see it.
• paxys 9mo ago
  "trusted execution environment" != end-to-end encryption The entire point of E2EE is that both "ends" need to be fully under your control.
  • Stefan-H 9mo ago
    The point of E2EE is that only the people/systems that need access to the data are able to do so. If the message is encrypted on the user's device and then is only decrypted in the TEE where the data is needed in order to process the request, and only lives there ephemerally, then in what way is it not end-to-end encrypted?
    • paxys 9mo ago
      Because anyone with access to the TEE also has access to the data. The owners can say they won't tamper with it, but those are promises, not guarantees.
      • Stefan-H 9mo ago
        That is where the attestation comes in to show that the environment is only running cryptographically verified versions of open source software that does not have the mechanisms to allow tampering.
        • habinero 9mo ago
          That's insufficient. Code signing doesn't do anything against theft or malfeasance by internal actors. Or external ones, I suppose. If the software can modify data legitimately, it can be tampered with.
          • Stefan-H 9mo ago
            The point of measured environments like the TEE is that you are able to make guarantees about all the software that is running in the environment (verified with the attestation). "If the software can modify data legitimately, it can be tampered with." - the software that makes up the SBOM for these environments do not expose administrator functions to access the decrypted data.
• letmetweakit 9mo ago
  How does inference work with a TEE, isn’t performance a lot more restricted?
• LordDragonfang 9mo ago
  > Advanced Passkey Features Required > This application requires passkey with PRF extension support for secure encryption key storage. Your browser or device doesn't support these advanced features. > Please use Chrome 116+, Firefox 139+, or Edge 141+ on a device with platform authentication (Face ID, Touch ID, Windows Hello, etc.). (Running Chrome 143) So... does this just not support desktops without overpriced webcams, or am I missing something?
  • literalAardvark 9mo ago
    Windows Hello should work fine just by PIN, it's the platform authentication part that's important, not the way you unlock it
• slipheen 9mo ago
  Does it say anywhere which model it’s using? I see references to vLLM in the GitHub but not which actual model (Llama, Mistral, etc.) or if they have a custom fine tune, or you give your own huggingface link?
• jdthedisciple 9mo ago
  The best private LLM is the one you host yourself.
• orbital-decay 9mo ago
  At least Cocoon and similar services relying on TEE don't call this end-to-end encryption. Hardware DRM is not E2EE, it's security by obscurity. Not to say it doesn't work, but it doesn't provide mathematically strong guarantees either.
• throwaway35636 9mo ago
  Interestingly the confer image on GitHub doesn’t seem to include in the attestation the model weights (they seem loaded from a mounted ext4 disk without dm-verity). Probably this doesn’t compromise the privacy of the communication (as long as the model format is not containing any executable part) but it exposes users to a “model swapping” attack, where the confer operator makes a user talk to an “evil” model without they can notice it. Such evil model may be fine tuned to provide some specifically crafted output to the user. Authenticating the model seems important, maybe it is done at another level of the stack?
• jrm4 9mo ago
  Aha. This, ideally, is a job for local only. Ollama et al. Now, of course, it is in question as to whether my little graphics card can reasonably compare to a bigger cloud thing (and for me presently a very genuine question) but that really should be the gold standard here.
  • wolvoleo 9mo ago
    I have a hybrid model here. For many many tasks a local 12b or similar works totally fine. For the rest I use cloud, those things tend to be less privacy sensitive anyway. Like when someone sends me a message, I made something that categorises it for urgency. If I'd use cloud it means they get a copy of all those messages. But locally there's no issue and complexity wise it's pretty low for an LLM. Things like research jobs I do do in cloud, but they don't really contain any personal content, they just research using sources they already have access to anyway. Same with programming, there's nothing really sensitive in there.
    • jrm4 9mo ago
      Nice. You're exactly nailing what I'm working towards already. I'm programming with gemini for now and have no problem there, but the home use case I found for local Ollama was "taking a billion old bookmarks and tagging them." Am looking forward to pointing ollama at more personal stuff.
      • wolvoleo 9mo ago
        Yeah I have two servers now. One with a big AMD for decent LLM performance. And one for a smaller Nvidia that runs mostly Whisper and some small models for side tasks.
• azmenak 9mo ago
  As someone who has spent a good time of time working on trusted compute (in the crypto domain) I'll say this is generally pretty well thought out, doesn't get us to an entirely 0-trust e2e solution, but is still very good. Inevitably, the TEE hardware vendor must be trusted. I don't think this is a bad assumption in today's world, but this is still a fairly new domain and longer term it becomes increasingly likely TEE compromises like design flaws, microcode bugs, key compromises, etc. are discovered (if they haven't already been!) Then we'd need to consider how Confer would handle these and what sort of "break glass" protocols are in place. This also requires a non-trivial amount of client side coordination and guards against any supply chain attacks. Setting aside the details of how this is done, even with a transparency log, the client must trust something about “who is allowed to publish acceptable releases”. If the client trusts “anything in the log,” an attacker could publish their own signed artifacts, So the client must effectively trust a specific publisher identity/key, plus the log’s append-only/auditable property to prevent silent targeted swaps. The net result is a need to trust Confer's identity and published releases, at least in the short term as 3rd party auditors could flag any issues in reproducible builds. As I see it, the game theory would suggest Confer remains honest, Moxie's reputation plays are fairly large role in this.
• saurik 9mo ago
  I am shocked at how quickly everyone is trying to forget that TEE.fail happened, and so now this technology doesn't prove anything. I mean, it isn't useless, but DNS/TLS and physical security/trust become load bearing, to the point where the claims made by these services are nonsensical/dishonest.
  • george_atom 9mo ago
    Exactly. That's why we're building an offline device for portable AI. Check it out at https://atomcomputers.org https://atomcomputers.org
• jmathai 9mo ago
  I am super curious about this. I wonder baseline it needs to meet to pull me away from using ChatGPT or Claude. My usage of it would be quite different than ChatGPT. I’d be much freer in what I ask it. I think there’s a real opportunity for something like this. I would have thought Apple would have created it but they just announced they’ll use Gemini. Awesome launch Moxie!
• lsofzz 9mo ago
  MM is basically up-selling his _Signal_ trust score. Granted, Signal/RedPhone predecessor upped the game but calling this E2E encrypted AI chat is a bit of a stretch..
• 4d4m 9mo ago
  Has anyone gotten access yet?
  • DyslexicAtheist 9mo ago
    it fails with "touch your security key", hell who is this for? Epstein? I don't touch anything, especially not "security keys" (whatever tf that means)
• deleted 9mo ago
  [deleted]
• b65e8bee43c2ed0 9mo ago
  what did he do for messaging? Signal is hardly more private than goddamn Whatsapp. in fact, given that Whatsapp had not been heavily shilled as the "totally private messenger for journalists and whistleblowers :^)" by the establishment media, I distrust it less. edit @ -4 points: please go ahead and explain why does Signal need your phone number and reject third party clients.
  • anilgulecha 9mo ago
    He implemented E2EE in Whatsapp as well.
  • bigfishrunning 9mo ago
    Yeah, it seems kind of funny how Signal is marketed as a somewhat paranoid solution, but most people run it on an iPhone out of the app store with no way to verify the source. All it takes is one villain to infiltrate one of a few offices and Signal falls apart. Same goes for Whatsapp, but the marketing is different there.
    • maqp 9mo ago
      Ok so which iPhone app can be verified from source? Or is your problem that your peer might run the app on an insecure device? How would you exclude decade old Android devices with unpatched holes? I don't want to argue nirvana fallacy here but what is the solution you'd like to propose?
      • bigfishrunning 9mo ago
        I don't think there is a solution -- Signal advertises itself as having a sort of security that isn't really possible with any commercially available device. You have to trust more people then just the person you're communicating with; if that's unacceptable then you need to give up a bunch of convenience and find another method of communicating. Fortunately, the parties that you have to trust when you use signal haven't been malicious in any way, but that doesn't mean that they can't.
  • 9mo ago
• lrvick 9mo ago
  What he did with messaging... So he will centralize all of it with known broken SGX metadata protections, weak supply chain integrity, and a mandate everyone supply their phone numbers and agree to Apple or Google terms of service to use it?
  • fsflover 9mo ago
    Not sure why you're gettimg downvoted. This is exactly what he did to instant messaging; extremely damaging to everyone and without solid arguments for such design.
    • maqp 9mo ago
      Or, he took a barely niché messaging app plugin (OTR), improved it to provide forward secrecy for non-round trips, and deployed the current state-of-the art end-to-end encryption to over 3,000,000,000 users, as Signal isn't the only tool to use double-ratchet E2EE. >broken SGX metadata protections Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't collecting metadata. The real talking is done by the responses to warrants https://signal.org/bigbrother/ https://signal.org/bigbrother/ where they've been able to hand over only two timestamps of when the user created their account and when they were last seen. If that's not good enough for you, you're better off using Tor-p2p messengers that don't have servers collecting your metadata at all, such as Cwtch or Quiet. >weak supply chain integrity You can download the app as an .apk from their website if you don't trust Google Play Store. >a mandate everyone supply their phone numbers That's how you combat spam. It sucks but there are very few options outside the corner of Zooko's triangle that has your username look like "4sci35xrhp2d45gbm3qpta7ogfedonuw2mucmc36jxemucd7fmgzj3ad". >and agree to Apple or Google terms of service to use it? Yeah that's what happens when you create a phone app for the masses.
      • josephg 9mo ago
        > You can download the app as an .apk from their website if you don't trust Google Play Store. I wish apple & google provided a way to verify that an app was actually compiled from some specific git SHA. Right now applications can claim they're opensource, and claim that you can read the source code yourself. But there's no way to check that the authors haven't added any extra nasties into the code before building and submitting the APK / ios application bundle. It would be pretty easy to do. Just have a build process at apple / google which you can point to a git repo, and let them build the application. Or - even easier - just have a way to see the application's signature in the app store. Then opensource app developers could compile their APK / ios app using github actions. And 3rd parties could check the SHA matches the app binaries in the store.
• colesantiago 9mo ago
  The website is: https://confer.to/ https://confer.to/ "Confer - Truly private AI. Your space to think." "Your Data Remains Yours, Never trained on. Never sold. Never shared. Nobody can access it but you." "Continue With Google" Make of that what you will.
  • irl_zebra 9mo ago
    Looks like using Google for login. You can also "Continue with Email." Logging in with Google is pretty standard.
    • colesantiago 9mo ago
      It is not privacy oriented if you are sharing login, profile information with Google and Confer. It wouldn't be long until Google and Gemini can read this information and Google knows you are using Confer. Wouldn't trust it regardless if Email is available. The fact that confer allows Google login shows that Confer doesn't care about users privacy.
      • pousada 9mo ago
        You don’t have to use Google login though? People building solutions like this that aim for broad adoption have to make certain compromises and this seems OK to me (just talking about offering a social login option, haven’t checked the whole project in detail)
      • fasterik 9mo ago
        Most people don't care about Google knowing whether they're using a particular app. If they do, they have the option not to use it. The main concern is that the chats themselves are E2E encrypted, which we have every reason to believe. This is a perfect example of purism vs. pragmatism. Moxie is a pragmatist who builds things that the average person can actually use. If it means that millions of people who would otherwise have used ChatGPT will migrate because of the reduced friction and get better privacy as a result, that's a win even if at the margin they're still leaking one insignificant piece of metadata to Google.
• throwpoaster 9mo ago
  Add a defunct cryptotoken?
  • temp8830 9mo ago
    Hey, Telegram had one. He had to get to feature parity.
• frankdilo 9mo ago
  I do wonder what models it uses under the hood. ChatGPT already knows more about me than Google did before LLMs, but would I switch to inferior models to preserve privacy? Hard tradeoff.
• moralestapia 9mo ago
  Backdoor it?
• voidfunc 9mo ago
  Do what he did for messaging? Make a thing almost nobody uses?
  • anonymous908213 9mo ago
    If this is how little you think of an app with ~50 million monthly active users, I take it making apps with a billion MAU is something you routinely do during your toilet breaks, or...?
  • maqp 9mo ago
    3 billion WhatsApp users use protocol built on his labor, every day.
• bookofjoe 9mo ago
  https://news.ycombinator.com/item?id=46619643 https://news.ycombinator.com/item?id=46619643
• kfreds 9mo ago
  It’s exciting to hear that Moxie and colleagues are working on something like this. They definitely have the skills to pull it off. Few in this world have done as much for privacy as the people who built Signal. Yes, it’s not perfect, but building security systems with good UX is hard. There are all sorts of tradeoffs and sacrifices one needs to make. For those interested in the underlying technology, they’re basically combining reproducible builds, remote attestation, and transparency logs. They’re doing the same thing that Apple Private Cloud Compute is doing, and a few others. I call it system transparency, or runtime transparency. Here’s a lighting talk I did last year: https://youtu.be/Lo0gxBWwwQE https://youtu.be/Lo0gxBWwwQE
  • stavros 9mo ago
    I don't know, I'd say Signal is perfect, as it maximizes "privacy times spread". A solution that's more private wouldn't be as widespread, and thus wouldn't benefit as many people. Signal's achievement is that it's very private while being extremely usable (it just works). Under that lens, I don't think it could be improved much.
    • maqp 9mo ago
      >Signal's achievement is that it's very private while being extremely usable (it just works). Exactly. Plus it basically pioneered the multi-device E2EE. E.g., Telegram claimed defaulting to E2EE would kill multi-client support: "Unlike WhatsApp, we can allow our users to access their Telegram message history from several devices at once thanks to our built-in instant cloud sync" https://web.archive.org/web/20200226124508/https://tgraph.io/Why-Isnt-Telegram-End-to-End-Encrypted-by-Default-08-14 https://web.archive.org/web/20200226124508/https://tgraph.io... Signal just did it, and in a fantastic way given that there's no cross device key verification hassle or anything. And Telegram never caught up.
    • attendant3446 9mo ago
      It's not perfect simply because it's a mobile-first app. That's Signal's main problem.
• imustachyou 9mo ago
  I’m missing something, won’t the input to the llm necessarily be plaintext? And the output too? Then, as long as the llm has logs, the real input by users will be available somewhere in their servers
  • fasterik 9mo ago
    According to the article: >Data and conversations originating from users and the resulting responses from the LLMs are encrypted in a trusted execution environment (TEE) that prevents even server administrators from peeking at or tampering with them. I think what they meant to say is that data is decrypted only in a trusted execution environment, and otherwise is stored/transmitted in an encrypted format.
• pona-a 9mo ago
  Collecting the email doesn't inspire much confidence. An account-number model like Mullvad's would seem preferable, or you could go all-in on syncable passkeys as the only user identifier. The web app itself feels poorly made—almost vibe-coded in places: nonsensical gradients, UI elements rendering in flashes of white, and subtly off margins and padding. The model itself is unknown, but speaks with the cadence reminiscent of GPT-4o. I'm no expert, but calling this "end-to-end encrypted" is only accurate if one end is your client and the other is a very much interposable GPU (assuming vendor’s TEE actually works—something that, in light of tee.fail, feels rather optimistic).
  • kfreds 9mo ago
    > An account-number model like Mullvad's would seem preferable Thank you! :) > .. assuming vendor’s TEE actually works For sure TEEs have a rich history of vulnerabilities and nuanced limitations in their threat models. As a concept however, it is really powerful, and implementers will likely get things more and more right. As for GPUs, some of Nvidia’s hardware does support remote attestation. https://docs.nvidia.com/attestation/index.html https://docs.nvidia.com/attestation/index.html
• piloto_ciego 9mo ago
  I really really want this, however keypass doesn't work with bitwarden and no, I'm not moving to 1Password.