You're making a fair point-- but I think it's important to reflect on what it says about tinfoil's values: They believe that they are ultimately in charge of computing you purchased from them, rather than you. I agree, It's an improvement that the structure forces them to be somewhat more transparent about their actions and doesn't necessitate the hard privacy loss computing other approaches to subjugating third parties to control over their use of computing. But coercively controlling other parties use of the private computing that they bought and paid for is both unnecessary and unethical, and demonstrates harmful paternalistic and authoritarian tendencies on the part of the companies management.

Depending on the balance of your concerns a ZDR that is lying about their privacy might still be an improvement because they can't both safely conceal the violation of their promises AND tamper with the output.

When one factors in the lack of absolute protection provided by secure enclaves-- that they're reliably bypassable with advanced techniques and thus mostly serve the purpose of keeping honest people honest, I think it would be better to avoid doing business with any enclave provider that has already demonstrated such leanings.

▲

traceroute66 15 hours ago | parent [-]

First, for transparency, I do not work for tinfoil, and I'm not even a paid customer because they are US-based and therefore CLOUD/PATRIOT etc. exposure automatically rules them out for me anyway.

I do broadly agree that of all the things tinfoil could/should be working on in relation to service features, this is perhaps an odd use of their time. And I do wonder if this ultimately came about due to some sort of external pressures or maybe a big-spending customer asked for it. Who knows. Their blog post is a little vague on the background context other than selling it as Good Thing (TM).

	▲	lukewarm707 12 hours ago \| parent [-]
		I was going to comment but figured it would be preaching to the converted. The architecture could be worse. It exfiltrates a log of classifier activations by ID and IP to Tinfoil. It exfiltrates a log of classifier activations by IP to the cloud provider. Transcripts from IP flow to the router enclave. All transcripts flow out of the router enclave to the primary scanner enclave. On primary scanner activation, transcripts flow from the primary scanner enclave to the secondary scanner enclave for verification. For an abuse flag in the primary scanner: 1. A monotonic transcript of size KB flows from IP to router enclave, exits the router enclave and enters the primary scanner enclave. 2. The monotic transcript size KB flows out of the primary scanner enclave to the secondary scanner enclave. 3. Size KB from IP to router enclave, then size KB from primary scanner enclave to secondary scanner enclave, logs an abuse incident in the primary scanner for IP visible to the cloud provider. 4. Transcript size KB from primary scanner enclave to secondary scanner enclave, then tiny flag from secondary scanner to Tinfoil org logs confirmation of abuse by the secondary scanner for IP visible to the cloud provider. -- All that is required to exfiltrate a lossy picture of conversations to the cloud provider is to update the classifier prompt. Assume the prompt is now ["Activate when the conversation is about $PERSON"]. Now the cloud provider has [IP talks about $PERSON]. Continuously update the prompt to keep exfiltrating from the enclave. Actually if you are even more clever you could get 4 bits out per conversation turn. Edit the prompt to tell the scanner to PASS (1) for $PERSON_A or FAIL (0) for $PERSON_B. Two bits, two scanners = 4 bits. Maybe you could get even 8 bits out to tinfoil. Edit the prompt to tell the scanner "think hard" for $PERSON_C or "don't think hard" for $PERSON_D. Then the scanner enclaves already exfiltrate token use. -- Another edit. Now that I think about it, if you have already compromised the user's JWT token you can get their account banned arbitrarily as well. Send some abuse with the token. Then you can't actually verify if the flags are valid or not, without inspecting the chat content. So you either reveal your chats or get banned. This is hilarious. Not to mention you can do it for the API as well if you have compromised the API customer; by sticking the JWT token on their requests XD XD