“The guy who helped install Donald Trump, did a Nazi Salute at Trump’s victory parade on live TV, supports authoritarians, and who has declared war on transgender people to the point you’re not allowed to say “Cis” or “Cisgender” on his platform, has created an end to end encrypted chat.”
All of this has the same vibes as the time Brigham Young University amended their code of conduct to allow people to come out as queer, let some students come out, and then changed the CoC back and expelled the students.
XChat, has some red flags.
With a white circle and a swastika inside?
Shouldn’t trust it yet.
Or ever.
Hey y’all. Reminder not to trust a platform owned and operated by a Nazi manchild.
“xchat” sounds like one of those porn chat rooms
If you trust ANYTHING Musk has for you well then have I got a bridge to sell you.
Yet? More like never.
I trust it but there is a major misunderstanding of end to end encryption. Some implementations the platform holder does not have a key to decrypt data but it is far from a requirement. All end to end means is there’s a blocker preventing the network from seeing what you send not twitter who im assuming has a copy of the key.
That is NOT end to end encryption. That is transport layer encryption. So basically SSL
End to end is from sender to recipient. No one in the middle should be able to read anything
It’s like ssl but done at the application layer. Nobody in the middle can read it except it’s nobody in the middle of you and twitter and twitter and the recipient. If you put something on a platform and they have the key they will always be able to read it if they want to.
are you being dense on purpose? sender and recipient are both users. never twitter.
i’m not saying that twitter’s messaging is secure. the opposite. what i’m saying is that you statement of “All end to end means is there’s a blocker preventing the network from seeing what you send not twitter” is 100% objectively wrong.
Brain damaged people trust x again.
Signal and encrypted email only.
Friends and I swapped our group chat to Signal the day Trump was inaugurated…the first time.
If things keep going the way they are, no one should be communicating on anything but encrypted messaging apps.
I don’t trust anything coming out of Elon’s fascisthole. Deleted the app when he bought it and never looked back.
I refuse to even click on links. If a friend sends me an X link to something funny/interesting I tell them “I don’t click on Nazi links” and ask them to find me another source.
Why are people evening using this site anymore? It’s been severely compromised.
most likely vendor lockin and i hate it its common on social media.
What some call “normies” besides most celebrities.
Cause it has an audience unlike mastodon or bluesky. All the other alternatives are dead.
but bluesky(i think similar to twitter but slightly lower users??) has a bigger audience then mastodon, most people i saw there still use twitter.
Your hero just joined bluesky so not that dead
YET?
TL;dr of the article :
- They keep your private key on their servers.
- Their implementation allows for AITM attacks.
- It’s closed source.
- There’s no perfect forward secrecy.
This secret stays between you, me, and Elon.
I hope politicians use the hell out of it, so we can see what they really think when it gets (inevitably) hacked in a few weeks.
is it different with signal, telegram, whatsapp?
They keep your private key on their servers.
Then it’s literally not even E2EE, lol
What is the “A” in “AITM”?
Asshole
This is the first time I heard of AITM, thought it was a new name for MITM:
Are you sure that site is trustworthy? It kinda reads like an LLM being told to explain the difference between two names for the same thing and basically rephrasing the same thing. I’d imagine it might just be a different name to get rid of a male-coded word.
Adversary
It’s just MITM but with extra steps
Ah yes, Malcolm in the Middle is behind this all along.
Anal
Aliens
Elon.
Anyone
Apple
Administrator
If you chat on Xitter you‘re chatting with mecha Hitler.
They are stupid, but not that stupid.
Never attribute to malice what can be attributed to incompetence.
I used to give the benefit of the doubt but when there are bad incentives in play and shit keeps happening… then perhaps that is naïve sometimes, unfortunately.
Do you mean bad incentives?
And sure, I don’t disagree, but these people are also not actually that smart. I would worry more about this getting hacked in a week way before Elon gets a chance to use it against anyone.
Thanks, I do.
offering me end-to-end encrypted chat
No one - not even X - can access or read your messages
This key is then stored on X’s servers
So…they’re just blatantly lying?
It’s encrypted with a 4 digit pin so they’ll have to spend at least 316.8809e-10 years on brute-forcing it.
That’s why my PIN is 5 digits: 12345
One. Two. Three. Four. Five?
That’s amazing. I’ve got the same combination on my luggage.
Suck. Suck. Suck. Suck!
Right, they have the key, and the lock, but the key isn’t in the lock, so it’s utterly impossible for them to access it.
Typical corpo doublespeak
No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.
There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key
A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user’s password would be needed (for key derivation) or some other secret held by the user’s devices (in the TPM chip or equivalent)
So again, you think you know better than the employee simply because you want it to be done incorrectly.
I’ve run a cryptography forum for 10 years. I can tell snake oil from the real deal.
Musk’s Twitter doesn’t know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.
So again - you just don’t want it to be true, and you think the people that know more than you about it are lying.
The Muskrat lying? No, never!
