mobilecoin VS ContactDiscoveryService

On this day last month, v.4.1.0 of the protocol was released, enabling atomic swaps on the MobileCoin blockchain.

There is a distinction between "begin wrong" and "being so absolutely wrong that making a statement transparently communicates how small one's understanding is". The second applies here. He is absolutely wrong here. SGX is one aspect that has some beneficial contribution to the overall ideas in MobileCoin. It is not at all an elementary part. You can read here in detail what happens if SGX would be totally pwned: https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog-threat-model-2.1.0.md

General thoughts for a MobileCoin Fog Threat Model can be found here: https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog-threat-model-2.1.0.md E.g. you find a summary of what an 'SGX-compromising Adversary with root on Fog Infrastructure' can achieve.

Since you're passionate about the topic, it might make sense to read a bit about why Signal chose MobileCoin as well as MobileCoin's design goals.

You are welcome to audit the code yourself.

Link here: https://github.com/mobilecoinfoundation/mobilecoin#consensus

[1] https://signal.org/blog/private-contact-discovery/

Signal uses SGX for remote attestation, which presumably lets the client verify that the code running on the server is a build of the OSS code and not a modified version. But I don't know the details or if this is reliable.

SGX and remote attestation described here:

https://signal.org/blog/private-contact-discovery/

Signal does private contact discovery and the effort they've gone to to do this is quite impressive.

TEEs have numerous privacy-enhancing applications that may benefit users. One of them is, as discussed earlier, private contact discovery; the Signal application uses a contact discovery service enhanced using Intel SGX, a TEE technology, to protect its users' privacy. A similar application of TEEs is performing malware analysis in a remote cloud service, so that the service may not identify users by the contents of their devices, such as the applications they have installed, especially important as 98.93% of users may be uniquely identified by the list of applications they have installed.

Signal (or, more accurately, one of its predecessors) used to use client-side private set intersection for contact discovery, but this scales poorly [1].

Now they use a solution based on Intel SGX and server-side trusted computing [2].

[1] https://signal.org/blog/contact-discovery/

[2] https://signal.org/blog/private-contact-discovery/