Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Collecting the email doesn't inspire much confidence. An account-number model like Mullvad's would seem preferable, or you could go all-in on syncable passkeys as the only user identifier.

The web app itself feels poorly made—almost vibe-coded in places: nonsensical gradients, UI elements rendering in flashes of white, and subtly off margins and padding.

The model itself is unknown, but speaks with the cadence reminiscent of GPT-4o.

I'm no expert, but calling this "end-to-end encrypted" is only accurate if one end is your client and the other is a very much interposable GPU (assuming vendor’s TEE actually works—something that, in light of tee.fail, feels rather optimistic).





> An account-number model like Mullvad's would seem preferable

Thank you! :)

> .. assuming vendor’s TEE actually works

For sure TEEs have a rich history of vulnerabilities and nuanced limitations in their threat models. As a concept however, it is really powerful, and implementers will likely get things more and more right.

As for GPUs, some of Nvidia’s hardware does support remote attestation.

https://docs.nvidia.com/attestation/index.html




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: