Comment by abalone | Hacker News Reader

Comment by abalone | Hacker News Reader

Parent Full thread

> I’m placing my trust in the open source community

You’re right, security is a matter of degrees not absolutes, but open source software requires considerably less trust than closed source. Right?

PCC applies this principle by making the binaries it runs public and auditable by you or anyone in the security community. (In some cases the source code as well.) The craziness is in the architecture that provides cryptographic proof to clients that the server they’re connecting to is running an audited binary and running on secure hardware. It even does TLS termination at the shard level so you can have high confidence that if the binary isn’t connecting to anything your data will be unreadable by any other server in the org.

So it goes way beyond trusting what the whitepaper says. Data center hardware deployments are audited by a third party that signs the servers in a key ceremony. That ultimately undergirds the cryptographic attestation that servers provide to clients that everything has been audited. And it’s also the element that tighter supply chain control helps shore up.

If you’re new to security the architecture documentation I linked to is a very friendly read and a good intro to some of these threats, countermeasures and rationales.

Thank you for the really great response! It answered my main question:

> The craziness is in the architecture that provides cryptographic proof to clients that the server they’re connecting to is running an audited binary and running on secure hardware.

I definitely missed this concept when skimming the links before posting my comment - very very cool!

> open source software requires considerably less trust than closed source. Right?

Of course… but at the same time, I think the difference in the degree of trust I am placing in say, Signal’s end to end encryption and Apple’s (claims of) end-to-end encryption is not as large as it might cursorily seem. Would I be more surprised to read in the news that Apple had secretly embedded some back door than I would be reading in the news that malicious actor managed to push some hidden exploit through to Signal in an otherwise innocent PR? I’m genuinely not sure which would surprise me more, or which event would be more probable, so can I really make any claim as to which is more secure, given the current knowledge I have? Obviously I could think more deeply about this, but superficially, both are requiring pretty large amounts of trust from me - which I don’t think is misplaced in either… though I do personally trust something like signal more at the end of the day based on… what, intuition? A gut feeling?

That’s good food for thought! I would just add that the kinds of threats PCC is primarily targeting, I think, are attacks by malicious third parties (including state actors), rogue internal employees, and privacy-leaking software bugs. These are sort of bread and butter real world threats.

I would go out on a limb and say Apple would love to also prove beyond a reasonable doubt that they too as an organization cannot get away with planting a secret back door — not because they have pure angelic hearts, but because this is good for their privacy-differentiated business model. And PCC certainly makes a huge leap in that direction. But it’s not the problem it’s primarily targeting nor an easy one to solve completely.

As another example, Apple has an implementation of OHTTP onion routing[1] called iCloud Private Relay. It’s really cool and easy to use. The point is to make it so nobody but you can tell what website your IP address is connecting to, not even Apple, the operator of the relay. But bottom line, Apple picks who they collaborate with for the gateways and there’s nothing stopping them from colluding out of band to de-anonymize you if that’s what they wanted to do.

Does this defeat the purpose of iCloud Private Relay? No. Its purpose is to better protect you from common privacy attacks, better than a traditional VPN would. It happens to also narrow the trust you need to place in Apple, namely that they would need to collude with another company to defeat the system as opposed to some rogue lone wolf SRE deciding to access your logs. But it wasn’t put in place to make people who fundamentally distrust Apple as a company start trusting them.

[1] https://datatracker.ietf.org/doc/rfc9458/

Reply on news.ycombinator.com