News for hackers. Stuff that matters.

A comment on WhatsApp data leak: 500M user records for sale. Parent comment

Re:WhatsApp data leak: 500M user records for sale by namkt on Saturday November 26, 2022 @10:26AM (#33753388)
Signal uses (or used?) SGX for remote attestation, which presumably lets the client verify that the code running on the server is a build of the OSS code and not a modified version. But I don't know the details or if this is reliable.

SGX and remote attestation described here:

https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/secure-value-recovery/

[ Parent | on HN ]
Re:WhatsApp data leak: 500M user records for sale by kibwen on Saturday November 26, 2022 @11:17AM (#33753887)
It should be possible to independently verify Signal's attestation, but I don't know if anyone has done it. Before you go and say "what's even the point then", the point is that this gives Signal plausible deniability for when the TLAs show up asking for user info.
[ Parent | on HN ]
Re:WhatsApp data leak: 500M user records for sale by viccuad on Saturday November 26, 2022 @11:28AM (#33754022)
I wonder, how could one use SGX for remote attestation when they didn't publish the source code for more than a year just to get their insiders' knowledge cryptocoin deployed.
[ Parent | on HN ]