Privacy and trust: FHE, law enforcement hacking, and self-hosting
Three threads today circle the same anxiety from different angles. Google announced homomorphic encryption for private AI, but commenters immediately pushed back: FHE guarantees your inputs are hidden, but not that the computation being run is the one you think it is. The 'trust me bro' model of cloud privacy, as one commenter put it, still applies. A separate thread on law enforcement hacking made the case for self-hosting as the only real defense. A third on Boeing 737 vulnerabilities highlighted how deeply trusted physical access undermines digital security claims.
The pattern: every new privacy technology gets announced with strong guarantees, and then people with technical depth poke the actual threat model and find the guarantees are narrower than advertised. FHE is real cryptography, but it doesn't solve the problem of verifying what computation was run. That's a different, harder problem.
The law enforcement thread is worth reading alongside the FHE one. The argument there is that end-to-end encryption and self-hosting are the only durable defenses, because any cloud dependency creates a legal surface area for compelled access.
So what?
If you're building anything where user data privacy is a selling point, you need to be precise about what your guarantees actually cover. FHE as a marketing term is going to get abused. Founders in security, health, legal, or finance should pressure-test their privacy claims against the actual threat model, not just the cryptographic primitive.