X's new encrypted messaging feature, XChat, has some red flags.
  • earthworm@sh.itjust.worksEnglish
    1271·
    2 months ago

    TL;dr of the article :

    1. They keep your private key on their servers.
    2. Their implementation allows for AITM attacks.
    3. It’s closed source.
    4. There’s no perfect forward secrecy.

    This secret stays between you, me, and Elon.

    I hope politicians use the hell out of it, so we can see what they really think when it gets (inevitably) hacked in a few weeks.

  • artyom@piefed.socialEnglish
    971·
    2 months ago

    offering me end-to-end encrypted chat

    No one - not even X - can access or read your messages

    This key is then stored on X’s servers

    So…they’re just blatantly lying?

    • InnerScientist@lemmy.worldEnglish
      16·
      2 months ago

      It’s encrypted with a 4 digit pin so they’ll have to spend at least 316.8809e-10 years on brute-forcing it.

    • FreedomAdvocate@lemmy.net.auEnglish
      63·
      2 months ago

      No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.

      • Natanael@infosec.pubEnglish
        21·
        2 months ago

        There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key

        A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user’s password would be needed (for key derivation) or some other secret held by the user’s devices (in the TPM chip or equivalent)

          • Natanael@infosec.pubEnglish
            21·
            1 month ago

            I’ve run a cryptography forum for 10 years. I can tell snake oil from the real deal.

            Musk’s Twitter doesn’t know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.

  • obsidianfoxxy7870@lemmy.blahaj.zoneEnglish
    3·
    2 months ago

    I do really like E2EE but why do I need it in everything?

    If I want to talk to someone I would rather them message me on Signal or something that I trust more.

    • renegadespork@lemmy.jelliefrontier.netEnglish
      4·
      2 months ago

      Yeah, way too many services have chats. I think it’s because every large platform wants to be an “everything app”. Messaging is a really easy to feature to implement to (theoretically) add value.

  • hansolo@lemmy.todayEnglish
    101·
    2 months ago

    Quick everyone, install this just so that if Pete Hegseth invites people to the next airstrikes chat group, your satirical JD Vance account will be next to the real JD Vance’s account and he’ll probably add you both and figure it out later.

  • givesomefucks@lemmy.worldEnglish
    91·
    2 months ago

    Never trust any social media sites “private” chat.

    Especially not one of the big ones run by weirdo fascists. You know Elmo is going to snoop on anyone relatively famous, or that just say something he doesn’t like.

    In all honesty, there’s zero reason to even have accounts on them

    • pivot_root@lemmy.worldEnglish
      61·
      2 months ago

      Even if the server had zero knowledge of your private keys (which is doubtful), I’m sure the client code won’t have any backdoors. It’s only the social media “platform” owned by the world’s most thin-skinned billionaire.

      if (message.contains("elon") || message.contains("musk")) {
    upload(chat.privateKey)
}
  • Manjushri@piefed.socialEnglish
    191·
    2 months ago

    Yet? What kind of idiot would imagine that X would or could provide actual secure communication?

  • br0da@lemmy.worldEnglish
    61·
    2 months ago

    It’s like a regular encrypted chat but with peepholes and racism.

  • Typhoon@lemmy.caEnglish
    141·
    1 month ago

    XChat, has some red flags.

    With a white circle and a swastika inside?

    • DarkFuture@lemmy.worldEnglish
      41·
      1 month ago

      Friends and I swapped our group chat to Signal the day Trump was inaugurated…the first time.

      If things keep going the way they are, no one should be communicating on anything but encrypted messaging apps.