Signal Foundation

Re:Signal Foundation by faitswulff on Wednesday February 21, 2018 @03:04PM (#16432487)

This is a bit of a tangent, but I first heard of Intel SGX (Secure Guard Extensions) via Signal's blog post about secure contact sharing[0], so it's almost relevant :p From what I've read[1][2][3], Intel SGX is vulnerable to Spectre exploits. Does anyone know if this has changed Signal's approach to security at all? Granted, contact sharing was a technology preview, but I'm curious if SGX is still considered a feasible, "good enough" security measure for Signal Foundation.

[0]: https://signal.org/blog/private-contact-discovery/

[1]: https://software.intel.com/en-us/forums/intel-software-guard...

[2]: https://github.com/lsds/spectre-attack-sgx

[3]: https://security.stackexchange.com/questions/176635/how-does...

[ Parent | on HN ]

Re:Signal Foundation by tatterdemalion on Wednesday February 21, 2018 @04:16PM (#16433041)

Signal's use of SGX was to increase users' trust in Signal - OpenWhisperSystems couldn't log your contacts even if they wanted to. Its up to potential users to decide if they think OpenWhisperSystems will surreptitiously perform an attack on their own secure enclave to secretly log your contact information.

[ Parent | on HN ]

Re:Signal Foundation by porjo on Wednesday February 21, 2018 @04:16PM (#16433046)

Regarding the SGX enclave and contacting sharing, the blog post announcement dated 26 Sept 2017 says 'deploying into production...over the next few months'. Can we assume that's happened already? Or are contacts still being exchanged in a way that would allow a middle man to reconstruct an individual's social graph?

[ Parent | on HN ]

Re:Signal Foundation by gsch on Wednesday February 21, 2018 @05:02PM (#16433395)

Given that it now takes an order of magnitude more time than it used to for newly added contacts to appear in my list of Signal contacts, I assume /something/ has changed with the way they exchange contact data.

[ Parent | on HN ]