Tony (47:56)
Yeah, to just introduce the concept of secure enclaves. We all have these secure elements on our phones for once. That's the easy example. Whenever you're on iPhone on iOS and it pops up, that little face ID thing is because that's actually built into the hardware. Whatever you're trying to access or whatever passwords or, or data you're accessing, it's actually protected by the secure element on the phone. So this is why Apple has always taken and you would know Apple more than me. So correct me if I'm wrong, he's ex Apple. But they have taken the stance on privacy and security and the making that easily accessible by users. They really championed local phone secure enclaves or secure enclaves on the MacBooks. It's built into the hardware itself in a way where not Apple, not even Apple can get into it. Like very often they are not able to whenever like law enforcement requests come in. Now, of course there can always be hacks, right? There's always companies trying to exploit things and hardware itself. But it's like from day one, they're trying to like build it into the hardware in a way where like, you know, whatever data is in that secure element, that secure enclave, like it can't be accessed at least, you know, not reasonably. You know, there's, you know, it's a billion dollar industry for trying to like break into hardware and stuff that, and so much successful. But so I. It's not foolproof by any means, but it just like raises the bar of entry by 100x and you know, for instance, like now we're starting to get into secure elements and secure enclaves in the cloud itself, which is really cool because, you know, Carl Dong talked about it with this Obscura podcast that you, you just did last week. You know, he said that he was like, yeah, someone told him, hey, take a look at like what Apple's doing for their private routing stuff or their private AI, that they're doing their private relay. So all of that privacy stuff. And he looked at it, and we also looked at it too around like a year ago. And it's like, oh, they're doing things right. They're having servers with these secure elements on them. And what happens when you do it at this point on your phone, when you want to store data privately or be able to log in or something like that, it all goes into the secure element and you have to face ID it and it's checked by the secure element with servers. You, you take specific code that you know is like good and correct and you put it into the enclave. And when it's inside of that secure element, the actual hardware itself, you can't penetrate it from then on, like that code is running. You can't like memory inspect it. You can't memory dump it. You can't like, you know, run different code on top of it once it's in there. So it's like, it's a way to, you know, for users with their iPhones, they're sticking data in there and they're having the like face ID or you know, put in the correct password to actually get into it. And it's like a hardware lock at that point. You can do the same thing with code now and running servers inside of it too. So any code that is running in there, you can verify. And we do all client side verification too. So like in the Maple website, which is the first app we built on top of Open secret to like prove this concept, we do all of the checks client side. So like, if they were to fail for whatever reason, if if the code does not match what we expect it to run. And, like, all enclaves, you know, give this, like, attestation report to, like, verify, and it's built into the hardware of it to verify that, like, the hardware is running exactly what the hardware says it's running. If that were to fail for whatever reason, then. Then no calls would proceed forward. We have, like, this check on the front end that just will fail. And you users can see that, like, you know, there's errors processing the request because, like, it doesn't match up. So it, like, stops as soon as it has unexpected code running in the server, which I think is a really nice feature. And it not only protects us to make sure that no one got into the supply chain is running different code on our servers, it would already benefit companies to make sure that they're running the correct code no matter what. There could be backdoors in there. They don't want me to know about it. But not just running the correct code, but now users of their software can verify it too, which is really cool.
