News for hackers. Stuff that matters.

A comment on Signal Server code on GitHub is up to date again. Parent comment

Re:Signal Server code on GitHub is up to date again by Someone1234 on Wednesday April 07, 2021 @11:10AM (#26726054)
How would that work? You'd be layering trust on trust, wherein if they're willing to lie about one thing they're willing to lie about confirmation of that same thing (or not).

Unless you're going to hire some independent auditor (that you still have to trust) it seems logically problematic.

[ Parent | on HN ]
Re:Signal Server code on GitHub is up to date again by madars on Wednesday April 07, 2021 @11:13AM (#26726085)
SGX enclaves can attest to the code they are running, so you don't exactly need to take Signal's word on faith.
[ Parent | on HN ]
Re:Signal Server code on GitHub is up to date again by Someone1234 on Wednesday April 07, 2021 @12:55PM (#26727566)
That isn't a solution to the problem being discussed (a provider's server code being verifiable by end users). I'm quite confused by the suggestion that it could be/is.
[ Parent | on HN ]
Re:Signal Server code on GitHub is up to date again by eptcyka on Wednesday April 07, 2021 @11:18AM (#26726154)
Except SGX enclaves are horribly broken.
[ Parent | on HN ]
Re:Signal Server code on GitHub is up to date again by monocasa on Wednesday April 07, 2021 @11:23AM (#26726240)
Like, does an SGX enclave attest that meltdown is patched in microcode? That's one way to pull the keys out.

The recentish work to get read write access to some Intel CPU's microcode can probably break SGX too. I wouldn't be surprised if the ME code execution flaws could be used that way too.

[ Parent | on HN ]