• throwawayacc0430@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    ·
    5 days ago

    They’ve literally engineered their service to cryptographically prevent themselves from having access to metadata, even if they wanted to.

    So, its all done by the user client? Meaning: If you check the source code, and compiled it yourself, it’s safe? Even against a malicious server?

    • Jean-luc Peak-hard@piefed.social
      link
      fedilink
      English
      arrow-up
      1
      ·
      7 hours ago

      So, its all done by the user client?

      Yes. The client uses what’s called “remote attestation” to verify its talking to, not just official servers, but official server code published on github. Read more about it here: https://signal.org/blog/building-faster-oram/

      To put it simply, they’re using the same technology that allows DRM protected videos to play back on your computer/phone/tablet, but against their own servers, to ensure its not a rogue host or code.