Last week, an attacker broke into one of NEAR AI’s “confidential” AI servers. These servers use a protected environment called an enclave, which is meant to keep your chats private even from
Last week, an attacker broke into one of NEAR AI’s “confidential” AI servers. These servers use a protected environment called an enclave, which is meant to keep your chats private even from the people running the machine.
According to reports, the attacker got in through a bug in the software running inside the enclave. NEAR AI says the intruder could have seen the requests that server handled on 8 November, confidential ones included. The attacker also took account details of about 100 users and chat histories of 18 older agents.
NEAR AI also admitted that confidential computing “does not protect against a vulnerability in the software running inside the environment.”
The point is that “private” was a promise about the environment. One bug inside it was enough to break the promise.
~ The Simple Lesson
When a service can read your data, even inside a locked box, you are trusting that nothing in the box ever goes wrong. Software has bugs, and a locked box with a bug inside is still a problem.
So a better question than “is this service private?” is “can the service see my data at all?”
~ How Liberdus Handles This
This is where the Liberdus feature I want to explain comes in: end-to-end encryption.
Your message is locked on your device before it leaves, and only the person you’re sending it to can unlock it. The network carries your message, but it can’t read it.
So if someone compromises a node or a server, they find locked messages instead of readable ones. The same goes for anyone who gets into the middle of the journey.
Liberdus uses two layers of protection here. AES-256 handles today’s threats, and CRYSTALS-Kyber handles future quantum threats.
~ Be Honest About The Limits
No system is perfect, and I won’t pretend otherwise. The bug in this case was in open-source software, so open code doesn’t make bugs impossible either. A compromised phone can also leak messages, because encryption can’t protect what’s already on your screen. And Liberdus is still in testnet, so it’s still being built and tested.
But there’s a real difference between two designs. In one, the service handles your data in readable form and you trust it to stay safe. In the other, the service never sees your data in readable form at all. That second design leaves an attacker with much less to find when something does go wrong.
~ What You Can Do
1. Ask any app you use whether the company can read your messages.
2. Prefer tools where the answer is “no, by design.”
3. Don’t share sensitive details with any “private” service just because it says it’s private.
