X's new encrypted messaging feature, XChat, has some red flags.
  • Typhoon@lemmy.caEnglish
    141·
    7 days ago

    XChat, has some red flags.

    With a white circle and a swastika inside?

  • abbiistabbii@lemmy.blahaj.zoneEnglish
    71·
    6 days ago

    “The guy who helped install Donald Trump, did a Nazi Salute at Trump’s victory parade on live TV, supports authoritarians, and who has declared war on transgender people to the point you’re not allowed to say “Cis” or “Cisgender” on his platform, has created an end to end encrypted chat.”

    All of this has the same vibes as the time Brigham Young University amended their code of conduct to allow people to come out as queer, let some students come out, and then changed the CoC back and expelled the students.

  • Hozerkiller@lemmy.caEnglish
    25·
    7 days ago

    I trust it but there is a major misunderstanding of end to end encryption. Some implementations the platform holder does not have a key to decrypt data but it is far from a requirement. All end to end means is there’s a blocker preventing the network from seeing what you send not twitter who im assuming has a copy of the key.

    • notarobot@lemmy.zipEnglish
      6·
      7 days ago

      That is NOT end to end encryption. That is transport layer encryption. So basically SSL

      End to end is from sender to recipient. No one in the middle should be able to read anything

      • Hozerkiller@lemmy.caEnglish
        14·
        7 days ago

        It’s like ssl but done at the application layer. Nobody in the middle can read it except it’s nobody in the middle of you and twitter and twitter and the recipient. If you put something on a platform and they have the key they will always be able to read it if they want to.

        • notarobot@lemmy.zipEnglish
          2·
          7 days ago

          are you being dense on purpose? sender and recipient are both users. never twitter.

          i’m not saying that twitter’s messaging is secure. the opposite. what i’m saying is that you statement of “All end to end means is there’s a blocker preventing the network from seeing what you send not twitter” is 100% objectively wrong.

  • earthworm@sh.itjust.worksEnglish
    1301·
    8 days ago

    TL;dr of the article :

    1. They keep your private key on their servers.
    2. Their implementation allows for AITM attacks.
    3. It’s closed source.
    4. There’s no perfect forward secrecy.

    This secret stays between you, me, and Elon.

    I hope politicians use the hell out of it, so we can see what they really think when it gets (inevitably) hacked in a few weeks.

  • artyom@piefed.socialEnglish
    1021·
    8 days ago

    offering me end-to-end encrypted chat

    No one - not even X - can access or read your messages

    This key is then stored on X’s servers

    So…they’re just blatantly lying?

    • InnerScientist@lemmy.worldEnglish
      16·
      7 days ago

      It’s encrypted with a 4 digit pin so they’ll have to spend at least 316.8809e-10 years on brute-forcing it.

    • FreedomAdvocate@lemmy.net.auEnglish
      73·
      8 days ago

      No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.

      • Natanael@infosec.pubEnglish
        21·
        7 days ago

        There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key

        A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user’s password would be needed (for key derivation) or some other secret held by the user’s devices (in the TPM chip or equivalent)

          • Natanael@infosec.pubEnglish
            21·
            7 days ago

            I’ve run a cryptography forum for 10 years. I can tell snake oil from the real deal.

            Musk’s Twitter doesn’t know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.